-ECtHR Reiterates That Police Processing of Personal Data Has to Follow Strict Conditions for Legality-
On 27th May, the ECtHR repeated its case law on the processing of personal data by the police and the strict conditions for this in Selishcheva and Others v Russia. As to the facts of the case, the applicants were individuals who were members of associations which were connected to Navalnyy. In June 2021 a new electoral law entered into force, which banned individuals, who are members of extremist organisations, from standing in elections. Subsequently, the applicants were banned from running for elected posts as the associations of which they were members were declared as extremist. The electoral committee relied on information gathered by the police about the political participation of the applicants in activities such as protests, e.g. against Navalnyy’s arrest in January 2021. The applicants claimed that ‘the collection by the police of their personal data revealing their political opinions, the disclosure of this data to the electoral commission, and the use of such data as grounds for refusing to register them as candidates in municipal elections’, violated their Article 8 ECHR rights. The Court ruled as follows. First, it repeated that the ‘mere retention’ of the applicants’ data by the police, and the subsequent transmission to the electoral committee, constitutes an interference with the applicants’ rights to private life. Second, it ruled that the interference was ‘not in accordance with the law’ as required by Article 8(2) ECHR. The Court noted that this was mainly due to the fact that the data processing was not clearly defined in law (e.g. legal basis, scope of data to be gathered and retention periods) and that the processing was not transparent to the applicants. Although the violation of Article 8 ECHR was already established, the Court decided to go on and examine whether the processing in question pursued a legitimate aim and was ‘necessary in a democratic society’. The Court established that the Government had presented no legitimate aim to be pursued by the data processing in question. Then, it ruled that the sensitivity of the personal data (political opinions) and the context (peaceful protest, also protected by Article 11 ECHR) and the lack of regulation on the scope of the data processing (personal data to be processed, and safeguards such as proportionate data retention periods) meant that the processing was also ‘not necessary in a democratic society’. Hence, the Court concluded that there had been violation of Article 8 ECHR.
-Updates from the EDPB-
In the past weeks, the EDPB published, amongst others, the following significant documents:
- 16th May: ‘EDPB Letter to MEP Körner regarding in-car video cameras and dashcams’;
- 8th May: ‘EDPB-EDPS Letter on European Commission draft proposal on simplification of record-keeping under the GDPR’;
- 7th May: ‘Letter to Bosnia and Herzegovina DPA from the Chair of EDPB’;
- 6th May: ‘Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation’;
- 6th May: ‘Opinion 06/2025 regarding the extension of the European Commission Implementing Decisions under the GDPR and the LED on the adequate protection of personal data in the United Kingdom’;
- 23rd April: ‘EDPB Annual Report 2024’.
-Irish DPC Issues Huge Fine to TikTok-
On 2nd May, the Irish DPC announced ‘its final decision following an Inquiry into TikTok Technology Limited (“TikTok”)’. The Irish DPC was the lead supervisory authority in the inquiry, which sought ‘to examine the lawfulness of TikTok’s transfers of personal data of users of the TikTok platform in the EEA to the People’s Republic of China (“China”)’ and ‘whether the provision of information to users in relation to such transfers met TikTok’s transparency requirements as required by the GDPR’. The decision ‘finds that TikTok infringed the GDPR regarding its transfers of EEA User Data to China and its transparency requirements’. In this regard, it ‘includes administrative fines totalling €530 million and an order requiring TikTok to bring its processing into compliance within 6 months’. Beyond this, ‘the decision also includes an order suspending TikTok’s transfers to China if processing is not brought into compliance within this timeframe’. We appreciate the decision falls outside our usual reporting period. Unfortunately, due to time and space limitations, we were not able to cover the decision upon its release. Owing to the size of the fine, and the prominence of the actors involved, however, we nevertheless thought the decision would be of interest to readers, and thus decided to cover it in this issue.