Niels Westerlaken

Supervisory Authorities

Open letter from the AP to OpenAI

The Personal Data Authority ("the AP") contacted OpenAI, the developer of ChatGPT, because the AP is concerned about the way the chatbot is trained. Indeed, the large quantities of data fed to the self-learning algorithm may contain personal data. The AP is tasked with enforcing the General Data Processing Regulation

Case law

"Arnhem-Leeuwarden Court of Appeal rules: BKR must remove registered credits under GDPR"

General Data Protection Regulation. BKR must delete the credits it registers in the Central Credit Information System (hereafter CKI) at the request of the credit providers, or at least at the request of the credit providers, the particularity codes it registers (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:

Guidance

In scope or not? An EU AI Act decision tree and obligations

As with a colorblindness hue test, if you stare at the new version of the EU Artificial Intelligence Act for long enough, some patterns form (or maybe you are just losing your vision or your mind). Below is a decision tree to help assess whether you fall in scope. Is

Media

Europol data deals with violent police forces need “strong data protection safeguards”

Proposed data-sharing deals between Europol and five states in Central and South America needs explicit safeguards if they are to uphold fundamental rights, the European Data Protection Supervisor said at the beginning of May. Police forces in those states have brutal records of violence and torture. https://edri.org/our-work/

Media

EU Parliament calls for ban of public facial recognition, but leaves human rights gaps in final position on AI Act

The final EU Parliament position upholds all of the fundamental rights demands which were added at committee level. Despite efforts to overturn it, the final position also maintains the committees' strong stance against biometric mass surveillance practices. But it is disappointing that the plenary missed the opportunity to increase protections

Media

The Belgian government is failing to consider human rights in CSA Regulation

Despite the clear warnings, Belgium has taken a position calling on the EU to adopt the CSA regulation as quickly as possible, dismissing the technical problems, and without addressing the serious legal concerns that have been raised. https://edri.org/our-work/the-belgian-government-is-failing-to-consider-human-rights-in-csa-regulation/

Supervisory Authorities

Sweden's DPA issues SEK58M GDPR fine to Spotify

Sweden's data protection authority, the Integritetsskyddsmyndigheten, fined Spotify SEK58 million for alleged EU General Data Protection Regulation violations related to transparency. The IMY found Spotify responds to data access requests but "does not inform clearly enough about how this data is used by the company." The regulator added Spotify needs

Media

European Commission to seek Google adtech breakup

The Wall Street Journal reports the European Commission plans to file an antitrust complaint aimed at breaking up Google's advertising technology business. The complaint will call for Google to sell off some of its adtech tools, some of which are driven by data collection and profiling that help generate targeted

Media

EU rollout of Google's Bard paused over privacy concerns

Google's generative artificial intelligence tool Bard will not debut in the EU until the company satisfies privacy concerns raised by Ireland's Data Protection Commission, Politico reports. Deputy Commissioner Graham Doyle said the regulator "had not had any detailed briefing nor sight of a data protection impact assessment" from Google ahead

Guidance

What Does the Irish DPC’s 1.2 Billion Euro Data Transfer Fine Mean For EU-US Transfers?

On 22 May 2023, the Irish Data Protection Commission (“DPC”) fined Facebook parent Meta EUR 1.2 billion for transferring personal data to the U.S. in violation of GDPR. The DPC also ordered Meta to suspend further transfers unless it can bring such transfers into compliance within 5 months.

Supervisory Authorities

Garante probes TikTok's alleged Chinese data access

Italy's data protection authority, the Garante, called on TikTok to explain reports of its personal data being accessed by the Communist Party of China. The Garante gave the company 15 days to produce a response to the reports and outline how Italian and EU users' data is protected from alleged

Media

From “Heavy Purchasers” of Pregnancy Tests to the Depression-Prone: We Found 650,000 Ways Advertisers Label You

A spreadsheet on ad platform Xandr’s website revealed a massive collection of “audience segments” used to target consumers based on highly specific, sometimes intimate information and inferences https://themarkup.org/privacy/2023/06/08/from-heavy-purchasers-of-pregnancy-tests-to-the-depression-prone-we-found-650000-ways-advertisers-label-you

Supervisory Authorities

EDPB adopts final version of Guidelines on the calculation of administrative fines following public consultation

During its latest plenary, the EDPB adopted a final version of the Guidelines on the calculation of administrative fines following public consultation. These guidelines aim to harmonise the methodology data protection authorities (DPAs) use to calculate fines and include harmonised ‘starting points’. Hereby, three elements are considered: the categorisation of

Government

Supervisory Annual Report 2022 Data Protection Officer Ministry of Defense NL

1.1 Recommendations The privacy developments call for skilled GDPR coordinators, who are multidisciplinary. It also calls for structural cooperation with operational and legal lines, and for a clear privacy policy with and frameworks and tools to support operations. Based on the current state of the privacy organization, the DPO

Case law

Cell phone provider liability limitation in simswap fraud.

Consumer sues cell phone provider for misappropriation of crypto after simswap fraud. Can phone provider successfully invoke limitation of liability in its terms and conditions? (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBDHA:2023:5430

Case law

"Inadmissibility of GDPR access request due to late filing - Amsterdam District Court"

GDPR access request of personal data. Inadmissible petition filed late. (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBAMS:2023:2523

Tools

VISCHER Privacy Score

Why VISCHER Privacy Score? For finding out and documenting your gaps in your data protection compliance For getting recommendations on how to improve your compliance For reporting to the management and the board (helps protecting them from personal fines) Only three steps. Select assessment program and applicable law (Swiss DPA,

Government

Caught in procedures

A schematic representation of problems and causes in unnecessary litigation between citizens and government and government litigation behavior. (Machine translated) https://www.rijksoverheid.nl/documenten/rapporten/2023/06/05/gevangen-in-procedures

Media

Professor of Digital Surveillance: "We need to talk about the relationship of digital surveillance with power structures"

'Rotterdam is at the forefront of digital surveillance,' says Marc Schuilenburg in the sun-drenched garden of his home in De Esch, sipping a mug of filter coffee. 'The idea of a smart city, in which algorithms and data-driven surveillance play an important role, resonates here - just look at

Guidance

Explainable Artificial Intelligence needs Human Intelligence

What is XAI? How does it work in practice? What are its benefits, risks, impact on data protection? Read Blogpost by EDPS Director EDPS Wojciech Wiewiórowski attended ENISA's Annual Privacy Forum where he delivered a keynote speech on Artificial Intelligence and Data Protection. Read Speech.Read Closing Remarks of the

Supervisory Authorities

Keynote Speech - Annual Privacy Forum 2023

EDPS Wojciech Wiewiórowski attended ENISA's Annual Privacy Forum where he delivered a keynote speech on Artificial Intelligence and Data Protection. Read Speech.Read Closing Remarks of the CPDP Conference 2023.The EDPS and the German BfDI, and the Bavarian BayLDA organise the high-level event: “5th Anniversary of the GDPR: Still

Guidance

The first GDPR fine of the Garante against dark patterns: the importance of legal design

The Italian Privacy Authority, the Garante, has sanctioned the use of dark patterns to collect personal data for the first time under the terms of the GDPR. On February. 23, 2023, the first ruling of the Italian data protection authority sanctioning the use of dark patterns for personal data collection

Case law

"Aruba Court of First Instance rules that mandatory biometric time clock is not an impermissible invasion of privacy"

Labor. The requirement imposed by ANSA on employees to use its biometric time clock is not unlawful in the sense of an impermissible invasion of their right to privacy. ANSA has not unilaterally changed the terms and conditions of employment of air traffic controllers in the sense of requiring air

Case law

GDPR request by courts inhouse lawyer to the board and Council for the Judiciary (The Hague Court of Appeal)

GDPR requests from lawyer of a court to the board of the court and the Judicial Council in connection with an employment dispute (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHDHA:2023:875

Supervisory Authorities

Berlin DPA fines bank over automated decision-making

The Berlin Commissioner for Data Protection and Freedom of Information fined an unnamed bank 300,000 euros for violating transparency obligations under the EU General Data Protection Regulation in an automated decision rejecting a credit card application. "When companies make automated decisions, they are obliged to justify them in a