Niels Westerlaken

Media

European Commission launches database: understanding general terms and conditions of digital services

The European Commission today launched the Digital Services Terms and Conditions Database, which contains the terms and conditions of digital services, with a focus on online platforms such as social media, app stores or marketplaces. This database is a Commission initiative, which is in line with the various transparency requirements

Media

noyb sues CRIF and AZ Direct for illegal and secret data processing

noyb sues CRIF and AZ Direct for illegal and secret data processing noyb is suing for injunctive relief and damages, among other things. https://noyb.eu/en/noyb-sues-crif-and-az-direct-illegal-and-secret-data-processing

Government

National Police Privacy assurance report on Police Data Act (Wpg

(Machine translated) https://www.rijksoverheid.nl/documenten/rapporten/2023/10/20/tk-bijlage-1-cra-nationale-politie-privacy-assurancerapport-inzake-wet-politiegegevens

Case law

"Budget of substitute damages under the GDPR"

Art. 81(1) RO. Estimate of substitute damages. Substantiation of challenge to amount of damages. GDPR. (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:HR:2023:1669

Case law

Overijssel court rules on wrongful conduct by camera use in shared space

Camera use shared space. Invasion of privacy? Unlawful conduct? (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBOVE:2023:4831

Case law

Preliminary questions on access to medical records and position of care provider ECLI:NL:HR:2023:1682

Prejudicial questions (art. 392 Rv). Health law. Extrajudicial handling of medical professional liability cases. Can treating lawyer access medical records without patient's consent? Must provider take substantive position on claim if such consent is not given? (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:HR:2023:1682

Guidance

How your Board Deal with Risks relating to AI, Privacy and Cybersecurity

Explore the intersection of privacy, cybersecurity and artificial intelligence related risks and board liabilities with Andy Serwin on our podcast. Andy Serwin, Co-Chair of the Global Data Protection, Privacy, and Security Practice at DLA Piper, is recognized as one of the world’s foremost privacy attorneys. In this edition of

Case law

"Gelderland court protects CBR employees from stalking: remove personal data from website and ban tracking, filming and photographing"

stalking CBR employees, balancing right to privacy and freedom of expression and freedom of the press. order to remove personal data of CBR employees from website, prohibition to post personal data on websites and to follow and photograph and film employees (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:

Supervisory Authorities

Norway's DPA issues NOK20M data security fine

Norway's data protection authority, Datatilsynet, announced a NOK20 million fine issued to the Norwegian Labour and Welfare Administration. A Datatilsynet investigation found the agency's system measures "are not satisfactory to ensure compliance with the privacy regulations, and that the safeguarding of confidentiality in the IT systems is also not satisfactory.

Media

noyb files GDPR complaint against Meta over “Pay or Okay”

noyb files GDPR complaint against Meta over “Pay or Okay” Meta charges up to €251.88 to respect the fundamental right to privacy of EU users. This is a violation of the GDPR https://noyb.eu/en/noyb-files-gdpr-complaint-against-meta-over-pay-or-okay

Guidance

CNIL releases API data-sharing guidance

France's data protection authority, the Commission nationale de l'informatique et des libertés, published recommendations for application programming interface data sharing. The guidance states data holders must ensure the security of any data shared using API, while eliminating risks associated with sharing sensitive data.Full story https://iapp.org/news/a/

Media

Racist Technology in Action: Generative/ing AI Bias

By now we know that generative image AI reproduces and amplifies sexism, racism, and other social systems of oppression. The latest example is of AI-generated stickers in WhatsApp that systematically depict Palestinian men and boys with rifles and guns. When prompting the system on Israel, not even ‘Israeli army’ as

Guidance

AEPD releases guidance on biometric data use

Spain's data protection authority, the Agencia Española de Protección de Datos, published guidance on the use of biometric data for work and personal purposes, noting employers must follow the EU General Data Protection Regulation regardless of employee consent. The AEPD said consent is not a legal basis due to an

Media

‘Unmasking AI’ and the Fight for Algorithmic Justice

A conversation with Dr. Joy Buolamwini. By Joy Buolamwini and Nabiha Syed for The Markup on November 18, 2023 https://themarkup.org/hello-world/2023/11/18/unmasking-ai-and-the-fight-for-algorithmic-justice

Case law

"Midden-Nederland District Court grants request for access to medical information based on Section 843a Rv"

Request for inspection and copy of medical information pursuant to Section 843a Rv. Section 843a subsection 1 Rv complied with. No exception under section 843a paragraph 4 Rv. Request granted. (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBMNE:2023:6059

Guidance

Beyond the Digital Markets Act: much more than a piece of legislation

Inês Neves (Lecturer at the Faculty of Law, University of Porto | Researcher at CIJ - Centre for Legal Research | Member of the Jean Monnet Module team DigEUCit - A Digital Europe for Citizens. Constitutional and policymaking challenges) and Luísa Amaro de Matos (LL.M. in European Legal Studies – College of

Case law

Damages: Abstract or concrete in light of the General Data Protection Regulation and anticipatory application of Art. 22(7) Rv?

Compensation law. Substitute damages. Estimate of damages. Abstract or concrete? Appeal to the General Data Protection Regulation. Art. 22 Rv. Anticipatory application Art. 22 (7) Rv from Bill on simplification and modernization of law of evidence? (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:PHR:2023:935

Guidance

EDPB Publishes Guidelines to Clarify Scope of EU “Cookie” Notice and Consent Requirements

On November 16, 2023, the European Data Protection Board published its Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive. Continue Reading https://www.huntonprivacyblog.com/2023/11/20/edpb-publishes-guidelines-to-clarify-scope-of-eu-cookie-notice-and-consent-requirements/

Guidance

Meta’s new paywall model for ad-free contents under the radar of privacy authorities?

The response from Meta to privacy concerns was to introduce a paywall model with an ad-free subscription option for Facebook and Instagram, following significant legal scrutiny over personal data usage. After an announcement last August 2023, Meta has finally changed the legal basis used for processing its users’ data to

Media

Probe of school surveillance software finds privacy abuses, inaccurate results

An investigation into the educational technology company GoGuardian revealed the surveillance software used by schools across the country has routinely invaded students’ privacy and incorrectly flagged non-explicit content as harmful, according to an investigation by the Electronic Frontier Foundation. GoGuardian is used to surveil about 27 million students in 11,

Case law

EU Court rules on GDPR right to obtain a first copy of personal data processed free of charge

Under the General Data Protection Regulation (AVG), any person has the right to ask a processor of personal data to provide access to the personal data relating to him that are being processed. To this end, the data subject may submit a request to the processor. The data subject has

Grindr sues Norway DPA over GDPR interpretations

The dating application Grindr sued the Norwegian data protection authority, Datatilsynet, after it was fined NOK65 million for sharing user locations and advertiser information with marketing partners, NRK reports. The company alleges the authority misinterpreted the EU General Data Protection Regulation in a way that would make it difficult for

Literature

CyberEurope: The regulatory evolution of cybersecurity in Europe

We trace the regulatory evolution of cybersecurity in Europe, from the first NIS Directive to the most recent legislative proposals on the subject as part of our series of articles named CyberEurope. “Cybersecurity,” in its most common meaning, means the activity of analyzing and detecting cyber threats, and taking appropriate

Literature

EU’s policies to AI: are there blindspots regarding accountability and democratic governance?

Maria Inês Costa (PhD Candidate at the School of Law of the University of Minho. FCT research scholarship holder – UI/BD/154522/2023) ▪            In her recent State of the Union (SOTEU) 2023 speech, the President of the European Commission Ursula von der Leyen addressed several pressing issues, including artificial intelligence

Guidance

French DPA Issues Guidelines on Data Protection and AI

On October 11, 2023, the French Data Protection Authority (the “CNIL”) published a new set of guidelines addressing the research and development of AI systems from a data protection perspective.   Continue Reading https://www.huntonprivacyblog.com/2023/10/23/french-dpa-issues-guidelines-on-data-protection-and-ai/