Legal.digital (Page 19)

Sign in Subscribe

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

In 'Vyriausioji Tarnybinės Etikos Komisija' the CJEU held that the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions (indirectly sexual orientation) are special categories of personal data. The Court relies on the broad definition of "data concerning health"

Directly Discriminatory Algorithms

Directly Discriminatory Algorithms

There is a broad consensus that algorithmic systems should be approached principally through the lens of indirect discrimination and their impact, but researchers argue that this approach is both normatively undesirable and legally flawed. In some cases, algorithmic bias may constitute direct discrimination, and the law should be better equipped

AP is zeer kritisch op de nieuwe voorgenomen FSV-verwerking door de Belastingdienst

Supervisory Authorities

AP is zeer kritisch op de nieuwe voorgenomen FSV-verwerking door de Belastingdienst

https://www.tweedekamer.nl/downloads/document?id=2022D33681

This Surveillance Artist Knows How You Got That Perfect Instagram Photo

This Surveillance Artist Knows How You Got That Perfect Instagram Photo

Mr. Depoorter realized that he could come up with an automated way to combine these publicly available cameras with the photos that people had posted on Instagram. So, over a two-week period, he collected EarthCam footage broadcast online from Times Square in New York, Wrigley Field in Chicago and the

The Belgian SA held that discussing a data subject's health in a staff meeting where she was absent and documenting this in the minutes of the meeting does not have a legal basis

Supervisory Authorities

The Belgian SA held that discussing a data subject's health in a staff meeting where she was absent and documenting this in the minutes of the meeting does not have a legal basis

The Belgian DPA (SA) held that discussing a data subject's health-related personal data in a staff meeting where she was absent and consequently including the data in the minutes of the meeting was incompatible with the purpose of the original processing (personnel management) and did not have any

The Italian SA acted against a municipality due to the use of its video surveillance system and by appointing its DPO to defend it in court proceedings

Supervisory Authorities

The Italian SA acted against a municipality due to the use of its video surveillance system and by appointing its DPO to defend it in court proceedings

Lastly, the DPA held that the controller, by entrusting its DPO with its defence in court proceedings, placed the DPO in a position of conflict of interest in violation of Article 38(6) GDPR. This was especially because it led to the data subject feeling unable to contact the DPO

Danish SA: fine of of approx. EUR 67k for a law firm hit by ransomware for its insufficient security safeguards

Supervisory Authorities

Danish SA: fine of of approx. EUR 67k for a law firm hit by ransomware for its insufficient security safeguards

The Danish DPA held that the law firm lacked basic security measures, especially considering the fact that its processing involved special categories of personal data. The DPA emphasized that in such cases a data breach would almost certainly entail a high risk to the data subjects' rights. Therefore, the

The operation of the CLOUD Act in data storage in Europe

The operation of the CLOUD Act in data storage in Europe

GreenbergTraurig has assessed the scope of the US CLOUD Act on commission by the Dutch government. The CLOUD Act applies to EU entities that process data outside of the US, even if the EU entities are located outside of the US. To completely avoid being subject to the CLOUD Act,

Danish SA temporarily suspended its processing ban for Google Workspace ordered to change the data processing agreement with Google

Supervisory Authorities

Danish SA temporarily suspended its processing ban for Google Workspace ordered to change the data processing agreement with Google

Danish DPA temporarily suspended its processing ban against Helsingor municipality for the use of Google Chromebooks and Workspace for Education until 5 November 2022 and, amongst other things, ordered them to change their data processing agreement with Google. The SA ordered the same to the Aarhus municipality for using Google

The Belgian SA held that a controller can rely on legitimate interest for direct marketing to former customers if the relationship ended 'not that long ago'

Supervisory Authorities

The Belgian SA held that a controller can rely on legitimate interest for direct marketing to former customers if the relationship ended 'not that long ago'

The Belgian DPA (SA) held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing. https://gdprhub.eu/index.php?title=APD/

The Icelandic SA held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer

Supervisory Authorities

The Icelandic SA held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer

The Icelandic DPA (SA) held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer, deputy CEO or board member. However, a DPO can hold the position of compliance officer. https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Iceland)

The SA of Lower Saxony fined a bank EUR 900k for profiling enriched with third-party data for advertising purposes based on legitimate interests

Supervisory Authorities

The SA of Lower Saxony fined a bank EUR 900k for profiling enriched with third-party data for advertising purposes based on legitimate interests

The DPA [SA] of Lower Saxony fined a bank €900,000 for creating customer profiles, enriched with third-party data, for advertising purposes, without consent. The DPA held that such processing cannot be based upon legitimate interest https://gdprhub.eu/index.php?title=LfD_(Lower_Saxony)_-_Fine_EUR_900,000_

ICO: How can Privacy Enhancing Technologies help with data protection compliance?

ICO: How can Privacy Enhancing Technologies help with data protection compliance?

How can PETs help with data protection compliance? At a glance • PETs can help you demonstrate a ‘data protection by design and by default’ approach to your processing. • PETs can help you to comply with the data minimisation principle by ensuring you only process the data you need for your

Legacy Switches: A Proposal to Protect Privacy, Security, Competition, and the Environment from the Internet of Things

Legacy Switches: A Proposal to Protect Privacy, Security, Competition, and the Environment from the Internet of Things

Georgetown University Law Center researchers propose that every IoT device manufacturer build a switch into their devices that disables any smart feature that contributes to security or privacy risks. This will render a smart thermostat just a thermostat and a smart doorbell just a doorbell, and will disable microphones, sensors,

University of Twente: On the Efficacy of Online Proctoring using Proctorio

University of Twente: On the Efficacy of Online Proctoring using Proctorio

The results of a controlled experiment using Proctorio, an online proctoring system, show that it is ineffective at detecting cheating. https://ris.utwente.nl/ws/portalfiles/portal/275927505/3e2a9e5b2fad237a3d35f36fa2c5f44552f2.pdf

Danish SA reprimanded Region Syddanmark for not having sufficiently clear processor auditing procedures

Supervisory Authorities

Danish SA reprimanded Region Syddanmark for not having sufficiently clear processor auditing procedures

The DPA (SA) highlighted that entering into a data processing agreement that contains security obligations is not sufficient, and that the controller must also oversee that the processor actually adheres to the agreement. The fact that the controller had auditing procedures in place was not good enough if these auditing

European regulators are finalizing a decision blocking Meta from transferring data to the US

Supervisory Authorities

European regulators are finalizing a decision blocking Meta from transferring data to the US

“Based on the facts of the case, we do not see how [Meta] could have continued its personal data transfers following the Schrems II judgment had it acted in accordance with the GDPR,” the Norwegian objection reads. https://www.politico.eu/article/norway-wants-facebook-to-be-fined-for-illegal-data-transfers/

Big Data Analytics, Insurtech and Consumer Contracts: A European Appraisal

Big Data Analytics, Insurtech and Consumer Contracts: A European Appraisal

Automated personalization in consumer insurance contracts is not yet a reality in Europe, but mass customization and robotization of insurance contracts are a growing problem, according to this article in European Review of Private Law. https://kluwerlawonline.com/journalarticle/European+Review+of+Private+Law/30.4/ERPL2022030

Greek SA fines Clearview AI for EUR 20M

Supervisory Authorities

Greek SA fines Clearview AI for EUR 20M

A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings https://iapp.org/news/a/greek-dpa-imposes-20m-euro-fine-on-clearview-ai-for-unlawful-processing-of-personal-data

Paper vs. practice: How legal and ethical frameworks influence public sector data professionals in the Netherlands

Paper vs. practice: How legal and ethical frameworks influence public sector data professionals in the Netherlands

There is a wide gap between legal and ethical governance rules and the everyday practices of public sector data professionals. Frameworks are integrated implicitly, subtly influencing decision making. According to this article, mainstreaming literacy, rather than specialization, is a necessary consequence. https://www.cell.com/patterns/fulltext/S2666-3899(22)00229-X

Hunton summarises two articles from the new SCCs: the 'local laws and government access' section

Hunton summarises two articles from the new SCCs: the 'local laws and government access' section

Under Clause 14 of the Data Transfer SCCs, the data importer must carry out a transfer risk assessment to verify whether the laws and practices of the receiving third country could prevent the data importer from complying with the Data Transfer SCCs. If the risk assessment shows that the Data

ICO Publishes Draft Employee Monitoring Guidance for Consultation

ICO Publishes Draft Employee Monitoring Guidance for Consultation

On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on commercial surveillance and lax data security practices. https://www.huntonprivacyblog.com/2022/10/18/uk-ico-publishes-draft-employee-monitoring-guidance-for-consultation/

EU-US Privacy Framework needs a long hard look

EU-US Privacy Framework needs a long hard look

The Commission has endorsed enthusiastically a recent US order to implement a new framework to protect the privacy of personal data shared between the US and Europe. Dick Roche begs to differ. https://iapp.org/news/a/the-redress-mechanism-in-the-privacy-shield-successor-on-the-independence-and-effective-powers-of-the-dprc/ https://www.euractiv.com/section/data-protection/opinion/eu-us-privacy-framework-needs-a-long-hard-look/

On proportionality in the data protection jurisprudence of the CJEU

On proportionality in the data protection jurisprudence of the CJEU

The concept of proportionality is at the very core of the modern understanding of human rights. Proportionality is, first and foremost, a condition for the limitation of a qualified fundamental right. https://academic.oup.com/idpl/advance-article-abstract/doi/10.1093/idpl/ipac014/6647961?redirectedFrom=fulltext

Privacy activists warn against removing compensation for data protection breaches

Privacy activists warn against removing compensation for data protection breaches

The Advocate General of the Court of Justice of the European Union (CJEU) issued a non-binding opinion, which privacy advocates fear could further limit users’ possibilities to enforce their privacy rights under the GDPR. According to the opinion delivered last week, Europeans would hardly get compensated if their rights are