Legal.digital (Page 15)

Sign in Subscribe

“Social media profiles and phone contacts” used as proof of identity for deportations

Thirteen non-EU countries sometimes accept “social media profiles and phone contacts” as evidence of identity for the purpose of deportations, according to an internal European Commission assessment of third country cooperation on readmission. https://edri.org/our-work/social-media-profiles-and-phone-contacts-used-as-proof-of-identity-for-deportations/

ECtHR finds violation of the right to fair trial when national court does not seek preliminary ruling from the CJEU

Blogpost 15/2023 The obligation of national courts to seek preliminary reference from the Court of Justice of the EU (CJEU) is a long-debated topic. In EU law, it is framed as an issue with two players: a national court and Luxembourg. In recent case law, the European Court of

Can the roles of DPO and whistleblowing officer be merged?

Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than they seem, especially for practical reasons. Both data protection governance and whistleblowing systems are often exercised by the same unit — the compliance department — or even by

EU member states reach agreement on Data Act

EU member states reached a common position on the proposed Data Act, enabling negotiations on the final version of the proposed legislation to begin among the Council of the European Union and European Parliament. Swedish Minister for Public Administration Erik Slottner said the Data Act "will contribute to creating a

Majority of credit bureau "CRIF" database illegal

Majority of credit bureau "CRIF" database illegal

Majority of credit bureau "CRIF" database illegal Decision by Austrian DPA in noyb case: Data of millions of Austrians have to be deleted https://noyb.eu/en/majority-credit-bureau-crif-database-illegal

OLG Celle Overturns Lower Court's Decision on Excessiveness of Data Subject's Access Request

OLG Celle Overturns Lower Court's Decision on Excessiveness of Data Subject's Access Request

The Higher Regional Court of Celle overturned the decision of a lower court, holding that the motivation of a data subject's Article 15 GDPR access request is irrelevant to the legitimacy of the request. https://gdprhub.eu/index.php?title=OLG_Celle_-_8_U_165/22

"Rotterdam Court Orders Tax Authority to Conduct More Extensive Search in Access Request Case"

"Rotterdam Court Orders Tax Authority to Conduct More Extensive Search in Access Request Case"

When the Dutch Tax Administration answers a data subject's access request, it should search beyond the general system it uses and provide specific information as to the purpose of the processing, the potential recipients and the source of the data. https://gdprhub.eu/index.php?title=Rb._Rotterdam_-_ROT_

Data protection meets civil procedure – the ECJ decision in Norra Stockholm Bygg

Data protection meets civil procedure – the ECJ decision in Norra Stockholm Bygg

Blogpost 14/2023 The recent case of Norra Stockholm Bygg represents another important data protection decision from the ECJ. The decision addresses the application of the General Data Protection Regulation (‘GDPR’) to Member State courts when they are handling personal data, and therefore has important practical significance for civil procedure

ENISA Report on Cybersecurity of Artificial Intelligence warns on the lack of standardization on AI

ENISA Report on Cybersecurity of Artificial Intelligence warns on the lack of standardization on AI

ENISA published a report that addresses standards of cybersecurity for artificial intelligence, and their relevance to ensure compliance with the upcoming EU AI Act. The increasing prominence of artificial intelligence (AI) in various industries has necessitated the establishment of comprehensive standards for cybersecurity. In this context, ENISA published a report

Is the new ICT vendor liable for loss of data from old ICT environment?

Is the new ICT vendor liable for loss of data from old ICT environment?

District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT supplier is liable for damages resulting from the loss of data from its client's old ICT environment. The

FPF Releases Infographic to Explore Implications of Open Banking Data Flows and Security for Individuals

FPF Releases Infographic to Explore Implications of Open Banking Data Flows and Security for Individuals

Today, the Future of Privacy Forum (FPF), a global non-profit focused on privacy and data protection, is pleased to release an infographic, “Open Banking And The Customer Experience,” visualizing the US open banking ecosystem. FPF’s open banking infographic is supported by over a year of meetings and outreach with

Norway's DPA fines medical device company for breach notification violation

Supervisory Authorities

Norway's DPA fines medical device company for breach notification violation

Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour deadline required by the EU General Data Protection Regulation. "This case is an important reminder that data controllers — including those established

NOYB alleges German political parties 'microtargeted' voters on Facebook

NOYB alleges German political parties 'microtargeted' voters on Facebook

European privacy rights group NOYB lodged a complaint with the Berlin Commissioner for Data Protection and Freedom of Information alleging multiple German political parties engaged in microtargeting of voters on Facebook during the 2021 campaign, Euractiv reports. While the EU General Data Protection Regulation does not expressly ban "microtargeting," it

Google seeks dismissal of UK lawsuit alleging it mishandled 1.6M patient records

Google seeks dismissal of UK lawsuit alleging it mishandled 1.6M patient records

Google seeks the dismissal of a U.K. lawsuit in London's High Court alleging it mishandled the medical records of 1.6 million patients, Reuters reports. In 2015, the Royal Free London National Health Service Trust transferred patient records to Google-owned artificial intelligence firm DeepMind Technologies, which was developing an

Political microtargeting on Facebook: an election promise just for you!

Political microtargeting on Facebook: an election promise just for you!

Political microtargeting on Facebook: an election promise just for you! noyb filed a series of complaints against several German political parties. The parties had used microtargeting on Facebook during the 2021 federal election and targeted potential voters. https://noyb.eu/en/political-microtargeting-facebook-election-promise-just-you

France: the CNIL has released its annual dawn raid Program for 2023: four national priorities and one priority coming from the EDPB!

Supervisory Authorities

France: the CNIL has released its annual dawn raid Program for 2023: four national priorities and one priority coming from the EDPB!

On 15 March 2023, the French Supervisory Authority (the “CNIL”) unveiled in a post its four key priorities regarding its upcoming investigations for 2023 targeting specific sectors (I), to which it added another topic related to DPO in line with the coordinated enforcement framework of the European Data Protection Board

Cell phone not personal enough for GDPR protection?!

Cell phone not personal enough for GDPR protection?!

Cell phone not personal enough for GDPR protection?! Contradictory Decision: Traffic and location data are particularly sensitive data that require additional protection, at the same time they are not personal data at all?! https://noyb.eu/en/cell-phone-not-personal-enough-gdpr-protection

Answered questions on Woo decision algorithms at Tax Office and Surcharges

Answered questions on Woo decision algorithms at Tax Office and Surcharges

State Secretary Van Rij (Tax and Customs Administration) and State Secretary De Vries (Surcharges and Customs) answer questions on the letter sent on October 31, 2022, regarding the Woo decision on algorithms at Tax and Customs Administration and Surcharges and undertaking inventory of models of Surcharges. https://www.rijksoverheid.nl/

Germany's BfDI releases 2022 activity report

Germany's BfDI releases 2022 activity report

Germany's Federal Commissioner for Data Protection and Freedom of Information published its 2022 activity report. The BfDI highlighted its enforcement work and the various data protection topics tackled, but noted its work showed "room for improvement in many laws and projects." Commissioner Ulrich Kelber said, "data protection can be adapted

Automated loan processing called 'profiling' by CJEU advocate general

Automated loan processing called 'profiling' by CJEU advocate general

Advocate General of the Court of Justice of the European Union Priit Pikamäe ruled automated processing to determine an individual's probability of obtaining a loan constitutes profiling under the EU General Data Protection Regulation. Pikamäe's decision states the "GDPR establishes a 'right' for the person concerned not to be subject

Guide for political parties: privacy in election campaigns

Guide for political parties: privacy in election campaigns

On March 15, 2023, the Provincial Council elections will be held. Political parties that campaign - for example through microtargeting - must comply with privacy rules in doing so. Political parties are increasingly using personal data - or hiring companies to do so - to reach their members and potential

Austrian DSB: Meta Tracking Tools Illegal

Austrian DSB: Meta Tracking Tools Illegal

Austrian DSB: Meta Tracking Tools Illegal Austrian Data Protection Authority (DSB) decided that the use of Facebook’s tracking pixel directly violates the GDPR and the so-called “Schrems II” decision on transatlantic data flows. https://noyb.eu/en/austrian-dsb-meta-tracking-tools-illegal

Facial recognition tool allegedly scraped images of deceased persons to identify living relatives

Facial recognition tool allegedly scraped images of deceased persons to identify living relatives

PimEyes, a tool purporting to help people track their web presence, is accused of scraping images of deceased persons to populate its database, Wired reports. A user, whose nonconsensual images were previously scraped into PimEyes' facial recognition database, found images of her deceased relatives, which she claimed were used to

Amsterdam court, Austrian DPA rule on Facebook data use, tracking

Amsterdam court, Austrian DPA rule on Facebook data use, tracking

The Amsterdam District Court ruled Facebook Ireland processed Dutch users' personal data for advertising purposes without a legal basis and provided users' data to third parties without proper notification from 2010-2020. The court said "no compensation could be claimed in these proceedings." In response to a complaint by privacy advocacy

International Data Transfers: Time to Rethink Binding Corporate Rules

International Data Transfers: Time to Rethink Binding Corporate Rules

This is an excerpt from CIPL President Bojana Bellamy’s recently published piece in the IAPP “Privacy Perspectives” blog. This piece discusses binding corporate rules as important transfer mechanism. Continue Reading https://www.huntonprivacyblog.com/2023/03/15/international-data-transfers-time-to-rethink-binding-corporate-rules/