Legal.digital (Page 19)

Sign in Subscribe

Legacy Switches: A Proposal to Protect Privacy, Security, Competition, and the Environment from the Internet of Things

Legacy Switches: A Proposal to Protect Privacy, Security, Competition, and the Environment from the Internet of Things

Georgetown University Law Center researchers propose that every IoT device manufacturer build a switch into their devices that disables any smart feature that contributes to security or privacy risks. This will render a smart thermostat just a thermostat and a smart doorbell just a doorbell, and will disable microphones, sensors,

ICO: How can Privacy Enhancing Technologies help with data protection compliance?

ICO: How can Privacy Enhancing Technologies help with data protection compliance?

How can PETs help with data protection compliance? At a glance • PETs can help you demonstrate a ‘data protection by design and by default’ approach to your processing. • PETs can help you to comply with the data minimisation principle by ensuring you only process the data you need for your

The SA of Lower Saxony fined a bank EUR 900k for profiling enriched with third-party data for advertising purposes based on legitimate interests

Supervisory Authorities

The SA of Lower Saxony fined a bank EUR 900k for profiling enriched with third-party data for advertising purposes based on legitimate interests

The DPA [SA] of Lower Saxony fined a bank €900,000 for creating customer profiles, enriched with third-party data, for advertising purposes, without consent. The DPA held that such processing cannot be based upon legitimate interest https://gdprhub.eu/index.php?title=LfD_(Lower_Saxony)_-_Fine_EUR_900,000_

The Icelandic SA held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer

Supervisory Authorities

The Icelandic SA held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer

The Icelandic DPA (SA) held that a there is a conflict of interest when a DPO is simultaneously also a company's senior lawyer, deputy CEO or board member. However, a DPO can hold the position of compliance officer. https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Iceland)_-_2020061979&

The Belgian SA held that a controller can rely on legitimate interest for direct marketing to former customers if the relationship ended 'not that long ago'

Supervisory Authorities

The Belgian SA held that a controller can rely on legitimate interest for direct marketing to former customers if the relationship ended 'not that long ago'

The Belgian DPA (SA) held that a controller can rely on legitimate interest as a legal basis to send former customers direct marketing if the relationship ended 'not that long ago' and the data subject did not object to this processing. https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)

Danish SA temporarily suspended its processing ban for Google Workspace ordered to change the data processing agreement with Google

Supervisory Authorities

Danish SA temporarily suspended its processing ban for Google Workspace ordered to change the data processing agreement with Google

Danish DPA temporarily suspended its processing ban against Helsingor municipality for the use of Google Chromebooks and Workspace for Education until 5 November 2022 and, amongst other things, ordered them to change their data processing agreement with Google. The SA ordered the same to the Aarhus municipality for using Google

The operation of the CLOUD Act in data storage in Europe

The operation of the CLOUD Act in data storage in Europe

GreenbergTraurig has assessed the scope of the US CLOUD Act on commission by the Dutch government. The CLOUD Act applies to EU entities that process data outside of the US, even if the EU entities are located outside of the US. To completely avoid being subject to the CLOUD Act,

Danish SA: fine of of approx. EUR 67k for a law firm hit by ransomware for its insufficient security safeguards

Supervisory Authorities

Danish SA: fine of of approx. EUR 67k for a law firm hit by ransomware for its insufficient security safeguards

The Danish DPA held that the law firm lacked basic security measures, especially considering the fact that its processing involved special categories of personal data. The DPA emphasized that in such cases a data breach would almost certainly entail a high risk to the data subjects' rights. Therefore, the controller

The Italian SA acted against a municipality due to the use of its video surveillance system and by appointing its DPO to defend it in court proceedings

Supervisory Authorities

The Italian SA acted against a municipality due to the use of its video surveillance system and by appointing its DPO to defend it in court proceedings

Lastly, the DPA held that the controller, by entrusting its DPO with its defence in court proceedings, placed the DPO in a position of conflict of interest in violation of Article 38(6) GDPR. This was especially because it led to the data subject feeling unable to contact the DPO

The Belgian SA held that discussing a data subject's health in a staff meeting where she was absent and documenting this in the minutes of the meeting does not have a legal basis

Supervisory Authorities

The Belgian SA held that discussing a data subject's health in a staff meeting where she was absent and documenting this in the minutes of the meeting does not have a legal basis

The Belgian DPA (SA) held that discussing a data subject's health-related personal data in a staff meeting where she was absent and consequently including the data in the minutes of the meeting was incompatible with the purpose of the original processing (personnel management) and did not have any other legal

This Surveillance Artist Knows How You Got That Perfect Instagram Photo

This Surveillance Artist Knows How You Got That Perfect Instagram Photo

Mr. Depoorter realized that he could come up with an automated way to combine these publicly available cameras with the photos that people had posted on Instagram. So, over a two-week period, he collected EarthCam footage broadcast online from Times Square in New York, Wrigley Field in Chicago and the

AP is zeer kritisch op de nieuwe voorgenomen FSV-verwerking door de Belastingdienst

Supervisory Authorities

AP is zeer kritisch op de nieuwe voorgenomen FSV-verwerking door de Belastingdienst

https://www.tweedekamer.nl/downloads/document?id=2022D33681

Directly Discriminatory Algorithms

Directly Discriminatory Algorithms

There is a broad consensus that algorithmic systems should be approached principally through the lens of indirect discrimination and their impact, but researchers argue that this approach is both normatively undesirable and legally flawed. In some cases, algorithmic bias may constitute direct discrimination, and the law should be better equipped

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

In 'Vyriausioji Tarnybinės Etikos Komisija' the CJEU held that the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions (indirectly sexual orientation) are special categories of personal data. The Court relies on the broad definition of "data concerning health" in article 4(15) GDPR

On dark patterns and manipulation of website publishers by CMPs

On dark patterns and manipulation of website publishers by CMPs

This paper studies the installation and configuration process of consent pop-ups and their potential effects on website publishers' decision making. It finds that Consent Management Providers often violate the law, and that configuration options may lead to non-compliance. https://petsymposium.org/popets/2022/popets-2022-0082.pdf

Dirkzwager: ABRvS geeft uitleg aan het AVG-begrip "de instelling, uitoefening of onderbouwing van een rechtsvordering"

Dirkzwager: ABRvS geeft uitleg aan het AVG-begrip "de instelling, uitoefening of onderbouwing van een rechtsvordering"

Privacybescherming is niet absoluut. Dat staat zelfs letterlijk zo in de privacywetgeving. De AVG bevat daarom ook allerlei uitzonderingen. Een van de uitzonderingen die enkele keren terugkomt in de AVG ziet op de verwerking van persoonsgegevens in het kader van "de instelling, uitoefening of onderbouwing van een rechtsvordering". Tot op

Recommenders you can rely on: A legal and empirical perspective on the transparency and control individuals require to trust news personalisation

Recommenders you can rely on: A legal and empirical perspective on the transparency and control individuals require to trust news personalisation

Law can play an important role in safeguarding trust in organisations that use news personalisation. Control and transparency measures are crucial to enabling individuals to trust these organisations. The law’s current focus on informing individuals about and empowering them to stop personalisation does not account for the importance of

The Spanish SA fined an individual EUR 10k for doxing a person on an online blog

Supervisory Authorities

The Spanish SA fined an individual EUR 10k for doxing a person on an online blog

The Spanish DPA (SA) fined an individual 10,000€ for publishing personal data of a third person without their consent on an online blog. https://www.aepd.es/es/documento/ps-00134-2022.pdf https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00134-2022&mtc=today

Greek SA fines Clearview AI for EUR 20M

Supervisory Authorities

Greek SA fines Clearview AI for EUR 20M

A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings https://iapp.org/news/a/greek-dpa-imposes-20m-euro-fine-on-clearview-ai-for-unlawful-processing-of-personal-data

Paper vs. practice: How legal and ethical frameworks influence public sector data professionals in the Netherlands

Paper vs. practice: How legal and ethical frameworks influence public sector data professionals in the Netherlands

There is a wide gap between legal and ethical governance rules and the everyday practices of public sector data professionals. Frameworks are integrated implicitly, subtly influencing decision making. According to this article, mainstreaming literacy, rather than specialization, is a necessary consequence. https://www.cell.com/patterns/fulltext/S2666-3899(22)00229-X

Hunton summarises two articles from the new SCCs: the 'local laws and government access' section

Hunton summarises two articles from the new SCCs: the 'local laws and government access' section

Under Clause 14 of the Data Transfer SCCs, the data importer must carry out a transfer risk assessment to verify whether the laws and practices of the receiving third country could prevent the data importer from complying with the Data Transfer SCCs. If the risk assessment shows that the Data

ICO Publishes Draft Employee Monitoring Guidance for Consultation

ICO Publishes Draft Employee Monitoring Guidance for Consultation

On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on commercial surveillance and lax data security practices. https://www.huntonprivacyblog.com/2022/10/18/uk-ico-publishes-draft-employee-monitoring-guidance-for-consultation/

EU-US Privacy Framework needs a long hard look

EU-US Privacy Framework needs a long hard look

The Commission has endorsed enthusiastically a recent US order to implement a new framework to protect the privacy of personal data shared between the US and Europe. Dick Roche begs to differ. https://iapp.org/news/a/the-redress-mechanism-in-the-privacy-shield-successor-on-the-independence-and-effective-powers-of-the-dprc/ https://www.euractiv.com/section/data-protection/opinion/eu-us-privacy-framework-needs-a-long-hard-look/

On proportionality in the data protection jurisprudence of the CJEU

On proportionality in the data protection jurisprudence of the CJEU

The concept of proportionality is at the very core of the modern understanding of human rights. Proportionality is, first and foremost, a condition for the limitation of a qualified fundamental right. https://academic.oup.com/idpl/advance-article-abstract/doi/10.1093/idpl/ipac014/6647961?redirectedFrom=fulltext

Privacy activists warn against removing compensation for data protection breaches

Privacy activists warn against removing compensation for data protection breaches

The Advocate General of the Court of Justice of the European Union (CJEU) issued a non-binding opinion, which privacy advocates fear could further limit users’ possibilities to enforce their privacy rights under the GDPR. According to the opinion delivered last week, Europeans would hardly get compensated if their rights are