{"id":72078,"date":"2022-10-27T19:18:09","date_gmt":"2022-10-27T17:18:09","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-81\/"},"modified":"2024-05-11T19:29:08","modified_gmt":"2024-05-11T17:29:08","slug":"data-protection-insider-issue-81","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-81\/","title":{"rendered":"Data Protection Insider, Issue 81"},"content":{"rendered":"

– <\/strong>CJEU Rules on Purpose Limitation and Storage Limitation<\/strong>\u00a0<\/strong>–<\/strong><\/em><\/a><\/p>\n

 <\/p>\n

On 20th October, the CJEU delivered its judgment in the case of <\/a>Digi T\u00e1vk\u00f6zl\u00e9si \u00e9s Szolg\u00e1ltat\u00f3 Kft. v Nemzeti Adatv\u00e9delmi \u00e9s Inform\u00e1ci\u00f3szabads\u00e1g Hat\u00f3s\u00e1g<\/a>.<\/em> As to the facts of the case, Digi is a provider of internet and TV services. Following a technical problem, in April 2018 Digi created a separate database containing about one third of the customer data it possesses for testing purposes. In September 2019, an ethical hacker hacked this test database and informed Digi of the hacking. Digi promptly notified the Hungarian DPA of the breach, which fined Digi for having violated the purpose limitation and storage limitation principles in Articles 5(1)(b) and (e) GDPR. Digi challenged the decision in front of a Hungarian court which asked the following two questions concerning the principles to the CJEU:<\/p>\n

 <\/p>\n

    \n
  1. \u2018Must the concept of \u201cpurpose limitation\u201d as defined in Article 5(1)(b) (mean) that\u2026(storing personal data) which were otherwise collected and stored for a limited legitimate purpose [in a parallel database) is consistent with that concept or (not)?\u2019<\/li>\n
  2. \u2018(If) the answer to the first question (is negative) is the fact that the controller stores\u2026personal data which were otherwise collected and stored for a limited legitimate purpose (in a parallel database) compatible with\u2026\u201cstorage limitation?\u2019<\/li>\n<\/ol>\n

     <\/p>\n

    In this regard, the Court concluded that:<\/p>\n

     <\/p>\n

      \n
    1. \u2018'(P)urpose limitation’\u2026does not preclude the controller from collecting and storing (personal data) in a (parallel) database set up for testing and error correction purposes\u2026if that further processing is compatible with the specific purposes for which the personal data were originally collected, which must be assessed in the light of the criteria set out in Art. 6(4)\u2026and\u2026the circumstances of the\u2026case.<\/li>\n
    2. \u2018'(S)torage limitation’\u2026precludes the controller from storing (personal data) in a (parallel) database set up for the purposes of testing and rectifying errors…for longer than\u2026necessary for the performance of\u2026tests and\u2026rectification of\u2026errors.\u2019<\/li>\n<\/ol>\n

       <\/p>\n

      The conclusions of the Court will likely be unsurprising for many in the data protection community and, unfortunately, the Court did not take the opportunity to address certain of the more pressing questions relating to the interpretation of purpose limitation and storage limitation \u2013 i.e. as to the nature of the legal ground necessary to legitimate secondary use. Nevertheless, the judgment is welcome in offering further clarification on two key principles in data protection law and is interesting in certain of the observations made \u2013 for example concerning the scope of the concept of \u2018purpose\u2019 and as to the rationale behind the provisions on compatibility. Unfortunately, at the time of writing, the judgment was not available in English. The author has thus relied on another language version. The author cannot, however, rule out the possibility that errors were made in translation. Accordingly, the author urges all readers interested in the decision to consult the primary materials themselves.<\/em><\/p>\n

      Learn more<\/strong><\/a><\/p>\n

       <\/p>\n

      – <\/strong><\/em>CJEU Rules on Elections and Video Recordings <\/strong>–<\/strong><\/em><\/a><\/p>\n

       <\/p>\n

      On 20th October, the CJEU ruled in the case of <\/a>Komisia za zashtita na lichnite danni, Tsentralna izbiratelna komisia v Koalitsia \u201eDemokratichna Bulgaria \u2013 Obedinenie\u201c<\/a>.<\/em> In essence, the case concerned the legitimacy of guidelines, adopted by the Bulgarian DPA, concerning video recording in the context of elections, which were then challenged before the national courts. In this regard, the referring national court asked posed six questions to the CJEU, which the CJEU bundled into two sets of considerations:<\/p>\n

       <\/p>\n

        \n
      1. \u2018(W)hether Article 2(2)(a) of the GDPR must be interpreted as meaning that the processing of personal data in connection with the implementation of elections in a Member State are excluded from the scope of the GDPR(?)\u2019<\/li>\n
      2. \u2018(W)hether Article 6(1)(e) and Article 58 of the GDPR\u2026preclude the adoption by the competent authorities of a Member State of an administrative measure of general application restricting or, where appropriate, prohibiting videotaping of the counting of votes at polling stations during elections(?)\u2019<\/li>\n<\/ol>\n

         <\/p>\n

        In this regard, the CJEU concluded:<\/p>\n

         <\/p>\n

          \n
        1. \u2018Article 2(2)(a) of the GDPR must be interpreted as meaning that the processing of personal data in connection with the organization of elections in a Member State does not fall outside the scope of the Regulation.\u2019<\/li>\n
        2. \u2018Article 6(1)(e) and Article 58 of the GDPR\u2026do not preclude the adoption of an administrative act of general application by the competent authorities of a Member State concerning videotaping of vote counting at polling stations during elections.\u2019<\/li>\n<\/ol>\n

           <\/p>\n

          This is an interesting case both as concerns subject matter \u2013 elections, democratic process etc. \u2013 but also as concerns certain of the more specific technical deliberations of the Court \u2013 e.g. regarding the use of Directive 95\/46 in interpreting the GDPR, and regarding the powers of national DPAs. The case is thus well worth reading. Unfortunately, at the time of writing, the judgment was not available in English. The author has thus relied on another language version. The author cannot, however, rule out the possibility that errors were made in translation. Accordingly, the author urges all readers interested in the decision to consult the primary materials themselves.<\/em><\/p>\n

          Learn more<\/strong><\/a><\/p>\n

           <\/p>\n

          –\u00a0<\/strong><\/em>ECtHR Rules on Racial Profiling during Police Identity Checks –<\/strong><\/a><\/p>\n

          \u00a0<\/strong><\/p>\n

          On 18th October, the ECtHR rendered two judgements concerning the question of discrimination against individuals who were subject to a police identity check on a train in Germany (Basu v. Germany<\/em>) and on the street in Spain (Muhammad v. Spain<\/em>)<\/a>. Both applicants complained that \u2018the identity check had been carried out because of\u2026dark skin colour, and thus in a discriminatory manner, and that the authorities had failed to investigate sufficiently\u2026allegations of racial profiling.\u2019 They had both submitted complaints with the local courts, reaching up to the respective constitutional courts, which were not successful, and thus each filed a complaint with the ECtHR. The Court noted that the applicants had an \u2018arguable claim that he or she may have been targeted on account of specific physical or ethnic characteristics\u2019, which was enough to trigger the applicability of Article 8 ECHR. This was enough to also trigger the applicability of Article 14 ECHR. It follows from this that \u2018the authorities\u2019 duty to investigate the existence of a possible link between racist attitudes and a State agent\u2019s act is to be considered as implicit in their responsibilities under Article 14 of the Convention also when examined in conjunction with Article 8.\u2019 In Basu v Germany<\/em>, the Court ruled that there had been a violation of Article 14 ECHR, taken together with Article 8 ECHR, because the domestic authorities \u2013 both the police authority where the controlling police officers were employed and the courts \u2013 had failed to effectively investigate the applicant\u2019s claim for racial profiling. Because of this failure, \u2018the Court [was] unable to make a finding as to whether the applicant was subjected to the identity check on account of his ethnic origin.\u2019 In Muhammad v. Spain<\/em>, the Court ruled that the respondent State had taken the necessary steps to investigate the applicant\u2019s complaint and that there was therefore no violation of the Convention in this respect. As to \u2018the complaint concerning the allegedly discriminatory grounds for the police check and the arrest of the applicant<\/em>\u2019, the Court found no violation of the Convention on that ground, either. This is, because, amongst others, \u2018[t]he Court sees no reason to depart from the domestic courts\u2019 conclusion that the applicant\u2019s attitude, and not his ethnicity, was what caused the police officers to stop him and to identify him. It was only his refusal to show proof of his identity that caused his detention in order to be identified at the police premises, as provided by the applicable law.\u2019 We would like to bring these two cases to our readers\u2019 attention, because, in the words of Judge Pavli who issued a Partly Dissenting Opinion in Basu v. Germany<\/em>, \u2018of the ground-breaking nature\u2019 of the two judgments, as \u2018these are the first cases in which the Court has considered allegations of racial profiling in police identity checks in a public space.\u2019 He regretfully points out that neither of the two judgments answers the question \u2018what exactly is it that Article 14 prohibits when it comes to profiling by State agents?\u2019 There are also concurring and dissenting opinions Muhammad v. Spain.<\/em> We also note that the rulings might have implications for discussions on AI profiling based on personal data.<\/p>\n

          Learn more<\/strong><\/a><\/p>\n

          Learn more<\/strong><\/a><\/p>\n

           <\/p>\n

          –<\/a>\u00a0<\/a><\/strong><\/em>AG Delivers Opinion on Covert Surveillance Measures<\/a> –\u00a0<\/strong><\/p>\n

           <\/p>\n

          On 13th October 2022, AG Collins delivered their Opinion in the case of HYA and Others.<\/em><\/a> The case essentially concerns the authorisation of surveillance by a national court, in criminal proceedings, by using a generic template which did \u2018not include an individualised statement of\u2026reasons for\u2026issue\u2019. In this regard, the referring court asked the following questions:<\/p>\n

           <\/p>\n

            \n
          1. \u2018Is a practice of national courts in criminal proceedings [authorising monitoring] of telephone conversations\u2026[via] a pre-drafted, generic text template\u2026which [states], without any individualisation, that\u2026statutory provisions have been complied with compatible with Article 15(1) of Directive 2002\/58\u2026Article 5(1) and recital 11?\u2019<\/li>\n
          2. \u2018If not, is it contrary to EU law if\u2026national law is interpreted as meaning that information obtained\u2026is used to prove the charges brought?\u2019<\/li>\n<\/ol>\n

             <\/p>\n

            With regard to the questions, the AG considered that:<\/p>\n

             <\/p>\n

              \n
            1. \u2018Article 47 of the Charter\u2026and Article 15(1) of Directive 2002\/58\/EC\u2026Article 5(1) and recital 11\u2026do not preclude the practice [in question]\u2026provided that the reasons for the authorisation can be\u2026ascertained and\u2026challenged\u2026by reading the authorisation and the application\u2026side by side\u2019.<\/li>\n
            2. \u2018Article 47 of the Charter and Article 15(1) of Directive 2002\/58\u2026Article 5(1) and recital 11\u2026 [mean] a national court:\u2019 i) in relation to unlawfully obtained evidence \u2018cannot\u2026remedy that irregularity by [adducing] reasons retrospectively, save in duly justified cases of urgency\u2019; ii) \u2018must determine the admissibility of [such] evidence\u2026in accordance with\u2026national law\u2026to respect\u2026the general principles of EU law\u2026and\u2026the right to a fair hearing\u2026in\u2026the Charter\u2026and\u2026the [ECtHR]\u2019; and iii) \u2018must exclude evidence obtained in breach of those provisions\u2026where a party\u2026is not in a position to comment\u2026on that evidence, the evidence pertains to a technical field\u2026the judges have no knowledge [of] and that evidence is likely to [significantly] influence\u2026findings of fact.\u2019<\/li>\n<\/ol>\n

              As always, it remains to be seen whether the Court follows the AG\u2019s position. The Opinion will doubtless be of interest for all those engaged with questions of surveillance.<\/p>\n

              Learn more<\/strong><\/a><\/p>\n

               <\/p>\n

              –\u00a0<\/a><\/strong><\/em>EDPS Issues Opinion on the Council of Europe\u2019s Convention on AI<\/a> –<\/strong><\/p>\n

              \u00a0<\/strong><\/p>\n

              On 13th October, the EDPS published \u2018Opinion 20\/2022 on the Recommendation for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence, human rights, democracy and the rule of law\u2019.<\/a> The EDPS stresses that he \u2018supports the opening of negotiations on behalf of the Union for a future convention on AI, and welcomes the Union\u2019s role in promoting trustworthy AI that is consistent with the Union\u2019s values, through the first legally binding international instrument on AI, based on shared values and principles, notably on human dignity, democracy and the rule of law.\u2019 The EDPS puts forward the following six key recommendations for the EU negotiation mandate. First, he recommends strengthening the protection of rights and interests of the affected (groups of) individuals as one of the general objectives of the proposed EU negotiation mandate, next to the single market objective. Second, the EDPS recommends that the negotiations should aim at ensuring better consistency with EU primary and secondary law. Third, the EDPS emphasizes the need to include more \u2018procedural safeguards and rights for \u201cAI subjects\u201d<\/strong>\u2019, complementing the existing safeguards in EU law. Fourth, the EDPS advocates for a risk-based approach and calls for a prohibition on AI systems which pose \u2018unacceptable risk\u2019 to fundamental rights, e.g. human dignity. Fifth, the EDPS \u2018recommends including a negotiating directive according to which the convention should promote the adoption of a data protection by design and by default approach<\/strong> at every step of AI systems\u2019 lifecycle, allowing the effective implementation of data protection principles by means of state-of-the-art technologies.\u2019 Sixth and finally, the EDPS recommends a strong oversight system, under which the supervisory authorities have effective powers to investigate and enforce the Convention and also to cooperate with each other, including across borders.<\/p>\n

              Learn more<\/strong><\/a><\/p>\n

               <\/p>\n

              –<\/a><\/strong><\/em>\u00a0<\/a><\/strong>EDPB Adopts Five Documents<\/a> –\u00a0<\/strong><\/p>\n

              \u00a0<\/strong><\/p>\n

              During its October plenary meeting, the EDPB adopted the following five documents<\/a>:<\/p>\n

               <\/p>\n