Legal.digital (Page 20)

Sign in Subscribe

AEPD publishes GDPR Risk Assessment

AEPD publishes GDPR Risk Assessment

GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the processing, to make an initial assessment of the intrinsic risk, including the need to perform a DPIA, and to estimate the

Voorbeeldregistratie in het algoritmeregister

Voorbeeldregistratie in het algoritmeregister

In Algoritmeregister worden aspecten van algoritmische toepassingen op een begrijpelijke manier vastgelegd. Zo bieden wij transparantie en leggen we verantwoording af over de inzet van algoritmes. In het register vind je technische elementen terug, zoals de dataverwerking en broncode, maar bijvoorbeeld ook afspraken tussen overheden en leveranciers en een beschrijving

Self-Sovereignty for Refugees? The Contested Horizons of Digital Identity

Self-Sovereignty for Refugees? The Contested Horizons of Digital Identity

Self-sovereign identity is an embryonic technology with uncertain benefits for refugees. It may help to empower them, but it also risks reinforcing the power of states and corporations over them, according to this article. https://www.tandfonline.com/doi/full/10.1080/14650045.2020.1823836

Beyond Data Ownership

Beyond Data Ownership

Data ownership proposals are misguided and would be self-defeating if implemented. Instead, privacy law reform should focus on strengthening ongoing use restrictions over personal data, according to this article. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3564480

Manipulation by Algorithms. Exploring the Triangle of Unfair Commercial Practice, Data Protection, and Privacy Law

Manipulation by Algorithms. Exploring the Triangle of Unfair Commercial Practice, Data Protection, and Privacy Law

Machine learning can be used to optimize sales practices in consumer markets, but it also raises concerns about manipulation. According to this article, in order to mitigate these risks, we need to understand how unfair commercial practice, data protection, and privacy law interact. https://papers.ssrn.com/sol3/papers.cfm?

The right to lodge a data protection complaint: OK, but then what?

The right to lodge a data protection complaint: OK, but then what?

DPAs are independent authorities entrusted with the consistent application of the GDPR, and are obliged to facilitate the submission of complaints. However, according to this paper, current practices related to this obligation are lacking in clarity, and there is a need for DPAs to provide more information to data subjects

The EU-US Data Privacy Framework: A new era for data transfers?

The EU-US Data Privacy Framework: A new era for data transfers?

Legally, until an adequacy determination is granted, companies should continue to follow the European Data Protection Board’s recommendations on measures that supplement transfer tools. But, once the EU is named as a “qualifying state” (assuming it will be) and complaints can be summited, this should become less daunting. The

Civil Rights Organisations Criticise automated data exchange for police cooperation (Prüm II Proposal)

Civil Rights Organisations Criticise automated data exchange for police cooperation (Prüm II Proposal)

The European Digital Rights (EDRi) network published a position paper on the proposed Regulation on automated data exchange for police cooperation, known as “Prüm II”. This currently primarily consists of a data-sharing network (interlinking national DNA, fingerprint and vehicle registration databases). It foresees the expansion of the data-sharing network to

ICO finds multiple public, private entities 'repeatedly' failed to meet SAR deadlines

Supervisory Authorities

ICO finds multiple public, private entities 'repeatedly' failed to meet SAR deadlines

The U.K. Information Commissioner’s Office issued reprimands and practice recommendations for seven public and private entities for failure to respond to subject access requests. The entities included the Ministry of Defence, the Home Office, Kent police and Virgin Media. The ICO found the organizations “repeatedly failed" to meet

Analysis: DPC’s Meta fine heralds a new frontier in children’s privacy

Analysis: DPC’s Meta fine heralds a new frontier in children’s privacy

The Irish Data Protection Commission’s 405 million euro fine against Meta represents a “watershed moment” in EU General Data Protection Regulation enforcement, write Bird & Bird’s Head of Privacy and Data Protection, Ireland, Anna Morgan and Associate Heather Catchpole. Morgan and Catchpole said the penalty represents “a critical staging

CNIL publishes compliance checklist for health data warehouse controllers

CNIL publishes compliance checklist for health data warehouse controllers

France’s data protection authority, the Commission nationale de l'informatique et des libertés, created a compliance checklist for controllers operating health data warehouses. The checklist is intended to help data controllers corroborate their compliance against CNIL’s reference system. If an entity does not meet a criteria in the checklist,

European Commission introduces AI liability redress proposal

European Commission introduces AI liability redress proposal

The European Commission adopted a proposal for harmonizing rules around consumer redress in the Artificial Intelligence Liability Directive. The proposed rules will allow consumers to bring claims for damages "caused due to wrongful behaviour" with AI technologies. The Commission said the basis for claims could include "breaches of privacy, or

Quod erat demonstrandum? - Towards a typology of the concept of explanation for the design of explainable AI

Quod erat demonstrandum? - Towards a typology of the concept of explanation for the design of explainable AI

* We propose a framework for defining different types of explanations of AI systems. * We contextualize current XAI discourses within the proposed framework. * We highlight two broad perspectives for defining quality criteria for explainability. * We discuss the relevance of our framework in light of current and upcoming AI regulation. https://www.

What Happened to the Risk-Based Approach to Data Transfers?

What Happened to the Risk-Based Approach to Data Transfers?

The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute principles), the RBA of Article 24 therefore applies. Other than the DPAs assume, this is not contradicted by the ECJ in

Digital Privacy Rights and CLOUD Act Agreements between US and UK

Digital Privacy Rights and CLOUD Act Agreements between US and UK

The CLOUD Act agreements between the US and UK will likely improve the digital privacy rights of US and UK citizens, but they will further undermine these rights for Third Country Persons (eg from EU). The US and UK should voluntarily extend Fourth Amendment and Article 8 protections to these

How anyone can track your car using only your license plate

How anyone can track your car using only your license plate

Registering the target's license plate in parking apps and enabling license plate recognition (ANPR). I could add as many plates as I wanted. Doesn't matter if they already used parking apps: I could claim their plate as if it were my own https://twitter.com/intidc/status/1574263808607997953

TikTok faces potential 27M GBP fine from ICO

Supervisory Authorities

TikTok faces potential 27M GBP fine from ICO

The U.K. Information Commissioner's Office announced a notice of intent to fine TikTok 27 million GBP for alleged U.K. data protection violations. The ICO's investigation found potential violations concerning nonconsensual processing of minors' data, unlawful processing of special category data and insufficient transparency. https://iapp.org/news/a/

Berlin DPA imposes 525K euro fine over DPO violation

Supervisory Authorities

Berlin DPA imposes 525K euro fine over DPO violation

The Berlin Commissioner for Data Protection and Freedom of Information issued a 525,000 euro fine to a Berlin-based retailer for violation of data protection officer requirements under the [GDPR]. An investigation found an alleged conflict of interest concerning the DPO's employment status and decision-making responsibilities that violated Article 38(

Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures

Supervisory Authorities

Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures

The Danish Data Protection Agency has looked into the tool Google Analytics and its settings, and the terms under which the tool is provided. On the basis of this review, the Danish Data Protection Agency concludes that the tool cannot, without more, be used lawfully. Lawful use requires the implementation

AEPD-EDPS Joint Paper - 10 Misunderstandings about Machine Learning

AEPD-EDPS Joint Paper - 10 Misunderstandings about Machine Learning

The EU has identified artificial intelligence (AI) as one of the most relevant technologies of the 21st century and highlighted 1 its importance on the strategy for EU’s digital transformation. Having a wide range of applications, AI can contribute in areas as disparate as helping in the treatment of

UN report details threats to global digital privacy, human rights

UN report details threats to global digital privacy, human rights

The United Nations Office for the High Commissioner of Human Rights issued a report detailing how “modern networked digital technologies” threaten individuals’ privacy. The report examined three areas: * spyware abuse by world governments, * the role of encryption in protecting human rights online and * the impacts of digital surveillance of public

Record fine for Instagram following EDPB intervention

Supervisory Authorities

Record fine for Instagram following EDPB intervention

Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and has issued a record GDPR fine of €405 million. https://edpb.europa.eu/news/news/2022/record-fine-instagram-following-edpb-intervention_en

Europol told to hand over personal data to Dutch activist

Supervisory Authorities

Europol told to hand over personal data to Dutch activist

The European Data Protection Supervisor ordered Europol to hand over personal data to Dutch activist Frank van der Linde. The decision is the result of a two-year investigation into Europol's possession and storage of van der Linde's personal data. https://www.fairtrials.org/articles/news/fair-trials-welcomes-a-decision-by-the-european-data-protection-supervisor-edps-ordering-europol-to-hand-over-personal-data-to-dutch-activist-frank-van-der-linde/

EDPB adopts statement on European Police Cooperation Code & picks topic for next coordinated action

EDPB adopts statement on European Police Cooperation Code & picks topic for next coordinated action

The EDPB adopted a statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II

EDPB: Lack of resources puts enforcement of individuals’ data protection rights at risk

EDPB: Lack of resources puts enforcement of individuals’ data protection rights at risk

“We are deeply concerned that the 2023 budget, if not substantially increased, will be significantly too small to allow the EDPB and the EDPS to fulfil their tasks appropriately,” Andrea Jelinek, Chair of the European Data Protection Board (EDPB), and Wojciech Wiewiórowski, European Data Protection Supervisor (EDPS), write in an