Legal.digital (Page 21)

Sign in Subscribe

Collection and retention, by the French blood donation service (EFS), of personal data reflecting applicant’s presumed sexual orientation without proven factual basis: violation of Article 8 of the Convention

Collection and retention, by the French blood donation service (EFS), of personal data reflecting applicant’s presumed sexual orientation without proven factual basis: violation of Article 8 of the Convention

https://hudoc.echr.coe.int/eng-press

Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations

Supervisory Authorities

Irish Data Protection Commissioner Fines Instagram EUR 405M for Children Privacy Violations

The fine is the result of an investigation that began in 2020 and focused on the company’s processing of children’s personal data. Based on press reports, the investigation focused on children between the ages of 13 and 17 who were allowed to operate business or creator Instagram accounts.

UK data protection reform: How the UK's GDPR may change

UK data protection reform: How the UK's GDPR may change

The current version of the Bill seeks to maintain the majority of key principles that underpin the UK data protection law framework, while at the same time modifying certain key provisions in relation to accountability, lawful grounds for processing, data subject access requests and cookies, amongst others. A consolidated redline

Regulating the Risks of AI

Regulating the Risks of AI

This Article observes that constructing AI harms as risks is a choice with consequences. Risk regulation comes with its own policy baggage: a set of tools and troubles that have emerged in other fields. Moreover, there are at least four models for risk regulation, each with divergent goals and methods.

Belgian SA fined a medical laboratory EUR 20k due to a lack of security and a privacy policy

Supervisory Authorities

Belgian SA fined a medical laboratory EUR 20k due to a lack of security and a privacy policy

The Belgian SA fined a medical laboratory €20,000 for violating Articles 5(1)(f), 12, 13, 14, 24, 25, 32, 35(1), and 35(3) GDPR due to a lack of security and a privacy policy on its website as well as its nonexistent data protection impact assessment. https:

DLA Piper: Who’s who under the DMA, DSA, DGA and Data Act?

DLA Piper: Who’s who under the DMA, DSA, DGA and Data Act?

As part of its data strategy, the European Commission has presented a number of legislative instruments, including the Digital Markets Act (DMA), the Digital Services Act (DSA), the Data Governance Act (DGA) and the Data Act. Our article analysing these four new instruments in more detail https://blogs.dlapiper.com/

EU-Hof: gegevens waaruit indirect de seksuele geaardheid van een persoon kan worden afgeleid vormen gevoelige gegevens in de zin van de AVG

EU-Hof: gegevens waaruit indirect de seksuele geaardheid van een persoon kan worden afgeleid vormen gevoelige gegevens in de zin van de AVG

The processing of personal data that may indirectly reveal sensitive information about an individual, such as information about their sexual orientation, may qualify as processing of "special categories of personal data" within the meaning of the AVG. The processing of such sensitive data is prohibited in principle. This is the

CNIL Proposes 60 Million Euros Fine Against French AdTech Company For Non-Compliance with GDPR

Supervisory Authorities

CNIL Proposes 60 Million Euros Fine Against French AdTech Company For Non-Compliance with GDPR

The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo. […] Under the CNIL’s sanction procedure, Criteo has the right to respond to the report, both with respect to the alleged infringements and the proposed sanction. https://www.huntonprivacyblog.com/2022/08/17/cnil-proposes-60-million-euros-fine-against-french-adtech-company-for-non-compliance-with-gdpr/

CJEU: PNR Directive Valid if Limited to the “Strictly Necessary”

CJEU: PNR Directive Valid if Limited to the “Strictly Necessary”

In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line with the EU’s fundamental rights. In addition, indiscriminate processing of the data in cases of flights carried

CJEU Clarifies Exceptions to Data Retention in Irish Case

CJEU Clarifies Exceptions to Data Retention in Irish Case

On 5 April 2022, the CJEU added another chapter to the long history of the admissibility of data retention in the EU. In a case concerning the data retention law in Ireland, the CJEU confirmed that general and indiscriminate retention of traffic and location data relating to electronic communication is

EDPB & EDPS: Proposal to combat child sexual abuse online presents serious risks for fundamental rights

EDPB & EDPS: Proposal to combat child sexual abuse online presents serious risks for fundamental rights

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child sexual abuse. https://edps.europa.eu/press-publications/press-news/news/2022/combat-child-sexual-abuse-online-presents-serious-risks-fundamental-rights_en

Who Is Collecting Data from Your Car?Who Is Collecting Data from Your Car?

Who Is Collecting Data from Your Car?Who Is Collecting Data from Your Car?

A firehose of sensitive data from your vehicle is flowing to a group of companies you’ve probably never heard of https://themarkup.org/the-breakdown/2022/07/27/who-is-collecting-data-from-your-car

Exploring the Unprecedented Privacy Risks of the Metaverse

Exploring the Unprecedented Privacy Risks of the Metaverse

Thirty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Behind the scenes, an adversarial program had accurately inferred over 25 personal data attributes, from anthropometrics like height and wingspan to demographics like age and gender, within just a few minutes of gameplay. As notoriously data-hungry companies

European Commission sued for violating transfer rules by using Amazon Web Services

European Commission sued for violating transfer rules by using Amazon Web Services

The European Commission faces a lawsuit over allegations it is violating its own data protection rules by transferring citizens’ personal data on one of its websites to Amazon Web Services in the United States. https://www.euractiv.com/section/data-protection/news/european-commission-sued-for-violating-eus-data-protection-rules/

European Commission sued for violating EU’s data protection rules

European Commission sued for violating EU’s data protection rules

The European Commission is to face a lawsuit over allegations it is violating its own data protection rules when transferring citizens' personal data from one of its websites to the United States. https://www.euractiv.com/section/data-protection/news/european-commission-sued-for-violating-eus-data-protection-rules/

Versterkt mandaat voor Europol

Versterkt mandaat voor Europol

Europol has more possibilities to cooperate with third countries, including the possibility to exchange personal data with countries where sufficient guarantees exist. In addition, Europol should cooperate more closely with the European Public Prosecutor's Office. Furthermore, the Director of Europol can propose the initiation of national investigations into non-cross-border crimes

Cookies: closure of the injunction issued against FACEBOOK

Supervisory Authorities

Cookies: closure of the injunction issued against FACEBOOK

On 31 December 2021, in addition to imposing a fine of 60 million euros, the CNIL's restricted committee ordered FACEBOOK IRELAND LIMITED to allow users of the website " facebook.com" located in France to refuse the cookies placed on their terminal as easily as to accept them, within three months.

WODC: Rapport Bescherming gegeven Evaluatie UAVG meldplicht datalekken en de boetebevoegdheid

WODC: Rapport Bescherming gegeven Evaluatie UAVG meldplicht datalekken en de boetebevoegdheid

Het onderzoek laat zien dat de duidelijkheid en toegankelijkheid van de UAVG kritisch wordt beoordeeld. Mede de ‘beleidsneutrale’ invulling van de wet en de korte tijd waarin deze tot stand moest komen hebben daartoe geleid. Wanneer wordt bezien hoe AP en de jurisprudentie nader invulling hebben gegeven aan de normen

Italian SA bans use of Google Analytics. No adequate safeguards for data transfers to the USA

Supervisory Authorities

Italian SA bans use of Google Analytics. No adequate safeguards for data transfers to the USA

The Italian SA came to this conclusion after a complex fact-finding exercise it had started in close coordination with other EU data protection authorities following complaints it had received. https://www.garanteprivacy.it/garante/doc.jsp?ID=9782874

CJEU: The PNR is only for terrorist threat and the 5 year retion period only for targeted passengers

CJEU: The PNR is only for terrorist threat and the 5 year retion period only for targeted passengers

Thomas Wahl has a great analysis: […] in these situations restrictions to citizens’ rights are only proportional, if there is a genuine and present or foreseeable terrorist threat to which the Member State concerned is confronted or, in the absence of that, application is limited to certain routes or travel patterns

EU-wetgeving inzake datagovernance definitief vastgesteld

EU-wetgeving inzake datagovernance definitief vastgesteld

The new data governance regulation sets out the conditions for the reuse of certain government data. In addition, the regulation provides a notification and oversight framework for the provision of data mediation services. Furthermore, the regulation contains a framework for the voluntary registration of entities that collect and process data

GDPR Fines: A Graphic Calculation Guide – Part 1

GDPR Fines: A Graphic Calculation Guide – Part 1

European supervisory authorities’ varying practices of calculating GDPR administrative fines can be viewed, on the one hand, as inconsistent and in conflict with the principle of uniform interpretation and application of the GDPR in general and uniform sanction for GDPR infringements in particular, as enshrined in GDPR recital 10, 11

Regional Labour Court of Schleswig-Holstein: controller to pay €2,000 in non-material damages for publishing a promotional video with the data subject

Regional Labour Court of Schleswig-Holstein: controller to pay €2,000 in non-material damages for publishing a promotional video with the data subject

The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given verbal consent to the filming but had not received any further information about the purpose of the filming or their rights. https://gdprhub.

Europese Commissie presenteert nieuwe regels om seksueel misbruik van kinderen op internet te voorkomen en te bestrijden

Europese Commissie presenteert nieuwe regels om seksueel misbruik van kinderen op internet te voorkomen en te bestrijden

The proposed rules would require online service providers to detect, report and remove child sexual abuse material on their services. Those providers must also assess the risk of their services being used to distribute child sexual abuse material. A new European Center on Child Sexual Abuse will provide support to