{"id":72141,"date":"2020-05-28T21:13:00","date_gmt":"2020-05-28T19:13:00","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-24\/"},"modified":"2024-05-12T00:20:04","modified_gmt":"2024-05-11T22:20:04","slug":"data-protection-insider-issue-24","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-24\/","title":{"rendered":"Data Protection Insider, Issue 24"},"content":{"rendered":"<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211;\u00a0<\/strong><strong>ECtHR Rules on the Balance between Privacy and Freedom of Expression &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">On 14<sup>th<\/sup> May the ECtHR issued its ruling in <em>Rodina v Latvia<\/em> on an Article 8 ECHR complaint. The case concerned the media attention given to a familial conflict. The applicant\u2019s mother and sister made claims that the applicant sold her mother\u2019s apartment after the applicant\u2019s mother was admitted to a psychiatric clinic. Reportedly, following the release from the clinic, the applicant\u2019s mother did not have a place to live and the applicant did not wish to take care of her. A newspaper published an article about the situation which contained enough information to identify the applicant \u2013 including a photograph, published without consent or forewarning. The applicant complained that the newspaper article, subsequent coverage on television as well as domestic courts\u2019 failure to balance her right to privacy with her relatives\u2019 and the media\u2019s rights to freedom of expression constituted breaches of her right to privacy. <a style=\"text-decoration: underline;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{\" target=\"_blank\" rel=\"noopener\">The ECtHR ruled that the domestic courts had failed to strike a balance between the right to privacy and the right to freedom of expression and that there was a violation of Article 8 ECHR.<\/a> The Court argued that a violation was found because the applicant could not be considered to be a public figure, the story did not contribute to a debate of public interest, the applicant had clearly expressed her disagreement with the publication and the journalists working on the story did not seem to have followed the necessary professional standards in reporting \u2013 for example, they focused on presenting only one side of the conflict. The Court further argued that these factors were not adequately considered by the domestic courts. This case demonstrates again the fine balance between the rights to privacy and freedom of expression. The case is not particularly noteworthy in terms of content or argumentation. The case is noteworthy, however, for the fact it needed to be heard in front of the ECtHR at all. Given the comprehensive ECtHR jurisprudence on the issue, it remains surprising that domestic courts regularly fail to perform proper balancing exercises between the two rights.<\/span><\/p>\n<p>&nbsp;<\/p>\n<\/div>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/www.bundesverfassungsgericht.de\/SharedDocs\/Pressemitteilungen\/EN\/2020\/bvg20-037.html \" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211;\u00a0<\/strong><\/span><span style=\"font-size: 14px; line-height: 21px;\"><strong>Constitutional Protection of Telecommunications Privacy for Intelligence Abroad &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"word-break: break-word; line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">On 19<sup>th<\/sup> May the German Constitutional Court issued a ruling on the constitutional compatibility of three main aspects of the German Federal Intelligence Service (BND) Act. The challenged aspects concern the BND\u2019s powers to collect and analyse the telecommunications data of non-German citizens living abroad, to transmit it to other German and foreign authorities and to cooperate with foreign intelligence services. In its ruling, the Court set out the following three significant considerations. <a style=\"text-decoration: underline;\" href=\"https:\/\/www.bundesverfassungsgericht.de\/SharedDocs\/Pressemitteilungen\/EN\/2020\/bvg20-037.html \" target=\"_blank\" rel=\"noopener\">First, the Court established that the BND is bound by the German Constitution even when its actions concern non-Germans living abroad.<\/a> Second, the Court ruled that, whereas surveillance of telecommunications data abroad is not, per se, unconstitutional, the current provisions of the BND Act breach the fundamental rights to privacy of telecommunications and of freedom of the press \u2013 Articles 10(1) and 5(1) of the Constitution. The Court put forward five reasons supporting this position: i) by not treating the contested powers as subject to the Constitution, the German government did not comply with the procedural requirement to specify affected fundamental rights in a law under Article 10(1) of the Constitution; ii) with regards to the collection and analysis of telecommunications data, the contested Act does not satisfy relevant procedural requirements \u2013 such as having a clearly stated purpose, breaking down surveillance measures into clear-cut categories to enable oversight, respecting proportionate data storage principles etc; iii) the law cannot be regarded as proportionate, because the Constitution does not allow \u201cglobal and general\u201d surveillance even for the purpose of foreign intelligence; iv) concerning the transfer of data to other German authorities and to other foreign intelligence services, the Court ruled that these were not sufficiently restricted by law to be proportionate \u2013 for example, the law did not set out requirements obliging recipient authorities to process data in accordance with the rule of law; and v) concerning the cooperation with other foreign intelligence agencies, the Court set out the requirement that such cooperation should not permit German authorities to circumvent the requirements of the Constitution. Finally, the Court generally set out detailed requirements for the independent oversight of the actions of foreign surveillance. Despite the constitutional incompatibility of the contested Act, the Court granted the government a grace period until 31<sup>st<\/sup> December 2021 to amend the Act. The ruling is particularly welcome for the fact the Court set out clear (constitutional) standards for the operation of intelligence services. Whilst intelligence activities fall outside the scope of EU law, it is notable that the standards adopted by the Court resemble those set out by the CJEU in telecommunication surveillance cases for law enforcement purposes \u2013 for example <em>Digital Rights Ireland<\/em>.<\/span><\/p>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\">\u00a0<a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/news\/news_en\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211;\u00a0<\/strong><\/span><span style=\"font-size: 14px; line-height: 21px;\"><strong>EDPB Holds 28<sup>th<\/sup> Plenary Session &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">On the 19<sup>th<\/sup> May, the EDPB held its 28<sup>th<\/sup> Plenary Session. In the session, <a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/news\/news_en\" target=\"_blank\" rel=\"noopener\">the EDPB adopted one document and made one significant decision<\/a>: <\/span><\/p>\n<ul>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">The EDPB adopted an \u2018opinion on the draft Standard Contractual Clauses (SCCs) for controller-processor contracts submitted to the Board by the Slovenian Supervisory Authority\u2019.<\/span><\/li>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">The EDPB decided to \u2018publish a register containing decisions taken by national supervisory authorities following the One-Stop-Shop cooperation procedure (Art. 60 GDPR) on its website\u2019.<\/span><\/li>\n<\/ul>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">The outcomes of this Plenary Session differ from those of Plenary Sessions held over the past two months. This is the first session which has not focused overwhelmingly on issues related to the COVID-19 emergency. Whether this change in focus represents a conscious shift in EDPB practice remains to be seen. Documents which are not yet available on the EDBP\u2019s website should be made available shortly, following internal checks.<\/span><\/p>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\">\u00a0<a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_annual_report_2019_en.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211;\u00a0<\/strong><\/span><span style=\"font-size: 14px; line-height: 21px;\"><strong>EDPB Publish 2019 Report &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">In May 2020, the EDPB adopted its 2019 Annual Report. The report is useful reading for all those involved in EU data protection discussions. This is true for two reasons in particular. <a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_annual_report_2019_en.pdf\" target=\"_blank\" rel=\"noopener\">First, the Report offers the expected, yet highly valuable, summary of substantive EDPB activities over the course of 2019 \u2013 including of all published documents as well as of other significant activities.<\/a> Whilst most of the work discussed will be familiar to the data protection community, other aspects of EPDB work outlined in the Report have not been so publicised. For example, in the Report, the EDPB discuss its Survey on SA Budget and Staff. Interestingly \u2013 and echoing observations from other organisations covered in the previous issue of Data Protection Insider \u2013 the EDPB highlight that: \u2018Most of SAs stated that resources made available to them are insufficient\u2019. Second, the Report offers an overview of the structure and procedures of the EDPB. Whilst information on these topics is not hidden or secret, it is often overlooked as individuals and organisations focus on the EDPB\u2019s more substantive output. Yet, this information provides vital background to the function of the Board and to the constraints under which it operates. For example, the Report offers an overview of: the EDPB\u2019s perspective on their mission; the EDPB\u2019s guiding principles, the EDPB\u2019s rules of procedure \u2013 including changes to their rules of procedure; the EDPB\u2019s technical infrastructure; and the EDPB\u2019s expert subgroups and their mandates.<\/span><\/p>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/key-data-protection-themes\/explaining-decisions-made-with-artificial-intelligence\/ \" target=\"_blank\" rel=\"noopener\"><span style=\"color: #123256; font-size: 14px; line-height: 21px;\"><strong>&#8211; ICO Issues Guidelines on Explainability in AI &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"text-align: justify; font-size: 14px; margin: 0px; direction: ltr; line-height: 21px; word-break: break-word;\">The ICO and the Alan Turing Institute have issued practical guidelines to help organisations explain to concerned persons decisions, processes and services taken with the help of AI technologies. The guidelines are split into three parts: i) \u2018The Basics of Explaining AI\u2019 (aimed mostly at DPOs and Compliance Teams); ii) \u2018Explaining AI in Practice\u2019 (aimed mostly at technical staff); and iii) \u2018What Explaining AI Means for Your Organisation\u2019 (aimed mostly at senior management). The guidelines are noteworthy for three reasons in particular. <a style=\"text-decoration: underline;\" href=\"https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/key-data-protection-themes\/explaining-decisions-made-with-artificial-intelligence\/ \" target=\"_blank\" rel=\"noopener\">First, the guidelines explicitly highlight that an explanation of a fully automated decision, after it has been taken, should be given to individuals<\/a>. This position is derived from several articles in the GDPR, including Articles 15 and 22, as interpreted in light of Recital 71 \u2013 the latter of which explicitly states that individual decisions should be explained to affected individuals. This clarification is particularly welcome given the protracted academic arguments concerning the issue. Second, the guidelines highlight that explanation obligations could also arise for AI assisted decisions which are not fully automated. This obligation is derived from the data protection principles of fairness, transparency and accountability. Finally, the guidelines state that the advice contained therein could be relevant to other legal instruments alongside the GDPR \u2013 for example the e-Privacy Directive and the Law Enforcement Directive. Explainability of AI decisions in these instruments is barely discussed and the guidelines could thus provide a useful reference point for interpreting relevant provisions.<\/p>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/www.dataguidance.com\/news\/france-cnil-issues-guidance-anonymisation-personal-data\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #123256; font-size: 14px; line-height: 21px;\"><strong>&#8211; CNIL Issues Guidance on Anonymisation &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"text-align: justify; font-size: 14px; margin: 0px; direction: ltr; line-height: 21px; word-break: break-word;\">On 19<sup>th<\/sup> May, the CNIL issued guidance on anonymisation. The guidance is short and provides a cursory overview of the CNIL\u2019s perspective on the following issues: the concept of anonymisation and its difference to pseudonymisation; the reasons one might anonymise personal data; how to anonymise personal data whilst preserving the utility of a dataset; how to verify the effectiveness of an anonymisation procedure; how to guard against the risks of re-identification. Given its length, the guidance is relatively superficial and contains little of substantive novelty. The guidance also fails to address several open questions concerning anonymisation. In particular, the guidance avoids the question of the degree to which, as suggested in the CJEU <em>Breyer<\/em> case, legal limitations on re-identification can render personal data anonymous. <a style=\"text-decoration: underline;\" href=\"https:\/\/www.dataguidance.com\/news\/france-cnil-issues-guidance-anonymisation-personal-data\" target=\"_blank\" rel=\"noopener\">The guidance is, however, noteworthy in one key respect: the guidance marks key normative assumptions underpinning the CNIL\u2019s perspective on anonymity.<\/a> This facet of the guidance gains further in significance as these assumptions do not seem to chime with those of other DPAs. In particular, the guidance suggests the CNIL takes a strict, \u2018old school\u2019, approach to anonymisation. The guidance suggests, for example, that personal data are only anonymous if reidentification is practically impossible and highlights, as one of its key reference points, the 2014 Article 29 Working Party Opinion on Anonymisation Techniques \u2013 in which a strict approach was also taken. This approach differs from that of the ICO, for example \u2013 in their document \u2018Anonymisation: managing data protection risk\u2019 \u2013 which suggests that, in certain instances in which re-identification is technically possible, data may still be regarded as anonymous.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>&#8211;\u00a0ECtHR Rules on the Balance between Privacy and Freedom of Expression &#8211; On 14th May [&hellip;]<\/p>\n","protected":false},"author":144,"featured_media":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72141","dpi","type-dpi","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72141"}],"version-history":[{"count":1,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72141\/revisions"}],"predecessor-version":[{"id":72489,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72141\/revisions\/72489"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72141"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72141"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}