{"id":72236,"date":"2021-04-22T22:06:29","date_gmt":"2021-04-22T20:06:29","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-45\/"},"modified":"2021-04-22T22:06:29","modified_gmt":"2021-04-22T20:06:29","slug":"data-protection-insider-issue-45","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-45\/","title":{"rendered":"Data Protection Insider, Issue 45"},"content":{"rendered":"<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><em><a style=\"text-decoration: none;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-209035%22]}\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><span style=\"line-height: 18px;\">&#8211; Liebscher v Austria: Publication of Divorce Settlement as a Breach of the Right to Privacy<\/span><\/span><\/strong><\/a><\/em><span style=\"font-size: 14px; line-height: 21px;\"><strong><em><a style=\"text-decoration: none;\" href=\"https:\/\/edps.europa.eu\/system\/files\/2021-03\/21-03-08_opinion_europol_reform_en.pdf\" target=\"_blank\" rel=\"noopener\">&#8211;<\/a><\/em><br \/>\n<\/strong><\/span><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">On 6th April the ECtHR decided in the case of Liebscher v Austria that Austria had not fulfilled its positive obligations to protect the personal data of the applicant under Article 8 ECHR. As to the facts of the case, the applicant had divorced his wife and wanted to transfer his share of the house to her. In order to register this transfer, the local land register court requested, per law, that the full divorce settlement be presented in order to be published in the land register. The applicant objected by arguing that the full divorce settlement contains much more personal data than necessary for the purposes of the public land register. It included even data concerning their minor children and his salary. The local courts rejected his suggestion that only the relevant excerpts be made accessible to the public by arguing that the national laws required the publication of the full divorce settlement. When he filed an Article 8 ECHR complaint with the domestic courts, which included references to the Austrian data protection legislation, the domestic courts merely noted that the interference with his data protection rights had a legal basis in national law. They also rejected his request for a preliminary ruling reference to the CJEU that Article 52 (1) CFREU has been breached. <a style=\"text-decoration: underline;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-209035%22]}\" target=\"_blank\" rel=\"noopener\">Taking all this into account, the ECtHR ruled that there has been a violation of Article 8 ECHR on account of the fact that the domestic courts had failed to balance the competing interests into account and thus to protect his personal data<\/a>. The Court reasoned that it \u2018\u2026 therefore cannot but conclude that the domestic courts never actually examined the core of the applicant\u2019s claim because of the lack of a comprehensive examination of the question whether the legal obligation to produce the full original divorce settlement \u2013 which could serve as basis for the entry in the land register and subsequently be published in the document archive \u2013 was compatible with the effective enjoyment, by the applicant, of his right to protection of his personal data. The domestic courts therefore have failed to comply with their procedural obligation under Article 8 of the Convention to conduct a comprehensive assessment of a matter affecting the applicant\u2019s privacy rights \u2026\u2019.We note that this is one of the ECtHR cases which clearly has at its core a purely data protection dispute. It is also interesting to note that it seems like the Austrian law on data protection was automatically \u2018trumped\u2019 by pre-existing laws. It remains to be seen whether this will continue being the case in the future with the growing of importance of the GDPR.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-size: 12px; line-height: 18px; text-align: justify; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/hudoc.echr.coe.int\/Eng#{%22article%22:[%228%22],%22itemid%22:[%22001-208763%22]}\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><span style=\"line-height: 18px;\">&#8211; <\/span><\/span><\/strong><\/a><strong><span style=\"font-size: 14px; line-height: 21px;\">EDPB Holds 48th Plenary Session<\/span><\/strong><a style=\"text-decoration: none;\" href=\"https:\/\/hudoc.echr.coe.int\/Eng#{%22article%22:[%228%22],%22itemid%22:[%22001-208763%22]}\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><span style=\"line-height: 18px;\"> &#8211;<\/span><\/span><\/strong><\/a><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/news\/news\/2021\/european-data-protection-board-48th-plenary-session_en\" target=\"_blank\" rel=\"noopener\">On 13th April the EDPB held its 48th Plenary Session. During the session, the following documents were adopted<\/a>:<\/span><\/p>\n<ul>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">Two Opinions on the Draft UK Adequacy Decisions, one under the GDPR and one \u2013 under the LED;<\/span><\/li>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Guidelines on the application of Article 65(1)(a) GDPR\u2019;<\/span><\/li>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Guidelines on the targeting of social media users\u2019;<\/span><\/li>\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Statement on international agreements including transfers\u2019.<\/span><\/li>\n<\/ul>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">The documents are already published, with the exception of the Guidelines on targeting social media users.<\/span><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\">\n<\/div>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_edps_joint_opinion_dgc_en.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"line-height: 18px;\">&#8211; <\/span><\/a><a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_opinion142021_ukadequacy_gdpr.pdf_en.pdf\" target=\"_blank\" rel=\"noopener\">EDPB Opinions on UK Adequacy Decisions<\/a><\/span><a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_edps_joint_opinion_dgc_en.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"line-height: 18px;\">&#8211;<\/span><\/a><\/strong><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/sites\/edpb\/files\/files\/file1\/edpb_opinion142021_ukadequacy_gdpr.pdf_en.pdf\" target=\"_blank\" rel=\"noopener\">The EDPB has published two Opinions on the Commission\u2019s draft UK Adequacy Decisions<\/a>. The first EDPB Opinion concerns the Commission\u2019s draft Decision on UK Adequacy and the GDPR \u2013 Opinion 14\/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016\/679 on the adequate protection of personal data in the United Kingdom. In the Opinion, the EDPS highlight the significant overlaps and confluences which exist between the UK\u2019s data protection framework and that of the EU. However, the EDPB also highlight several challenges. These include, amongst others, for example: the potential for divergence pursuant to future changes in the UK approach to data protection, and the scope and use of the \u2018immigration exemption\u2019 in UK law. The second EDPB Opinion concerns the Commission\u2019s draft Decision on UK Adequacy and the Law Enforcement Directive \u2013 Opinion 15\/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016\/680 on the adequate protection of personal data in the United Kingdom. Again, the EDPB observe the significant overlap between the UK data protection framework and that of the EU. Again, however, the EDPB observe challenges. These include, for example, amongst others: potential future UK Adequacy Decisions and how these relate to legitimate onward transfers under EU law; and the interplay between UK data protection law and the UK\u2019s international commitments relevant to personal data processing \u2013 for example the US-UK CLOUD Act Agreement.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; color: inherit; line-height: 18px; font-size: 12px; word-break: break-word;\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: none;\" href=\"https:\/\/edps.europa.eu\/system\/files\/2021-03\/21-03-05_edps_formal_comments_on_serious_cross-border_threats_to_health_en_0.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"line-height: 18px;\">&#8211; <\/span><\/a><a style=\"text-decoration: none;\" href=\"https:\/\/techcrunch.com\/2021\/04\/14\/eu-plan-for-risk-based-ai-rules-to-set-fines-as-high-as-4-of-global-turnover-per-leaked-draft\/\" target=\"_blank\" rel=\"noopener\">The Leaked Proposal on Regulating AI: The Main Novelties<\/a><\/span><a style=\"text-decoration: none;\" href=\"https:\/\/edps.europa.eu\/system\/files\/2021-03\/21-03-05_edps_formal_comments_on_serious_cross-border_threats_to_health_en_0.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"line-height: 18px;\"> &#8211;<\/span><\/a><\/strong><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">TLast week news sources started circulating the leaked proposal on Regulating AI, which is supposed to be formally published these days. While the leaked document seems to be work in progress, its substance is quite indicative of the intention of the legislator. In our short story, we note the following five points. First, with regards to the scope of the proposal, it focuses on high risk AI applications. It seeks to mitigate the risks posed by these, but also to encourage their uptake in the internal market. Except for biometric identification technologies, the proposal does not list the AI applications it considers to pose a high risk. It does provide the criteria for these applications in an Annex, though. These could include law enforcement technologies, e.g. crime prevention ones, and non-law enforcement ones, such as creditworthiness assessment tools. <a style=\"text-decoration: underline;\" href=\"https:\/\/techcrunch.com\/2021\/04\/14\/eu-plan-for-risk-based-ai-rules-to-set-fines-as-high-as-4-of-global-turnover-per-leaked-draft\/\" target=\"_blank\" rel=\"noopener\">Second, the Commission does not intend to ban such technologies. In its proposal it has taken the approach of mitigating the risk by subjecting these technologies both to pre-deployment assessment of conformity with the requirements of the proposed Regulation, as well as assessments after such technologies have reached the market or after they have been modified<\/a>. The conformity assessment requirements are provided for in the proposal. They range from high level fundamental rights compliance requirements to more precise requirements, e.g. transparency and documentation about how the given technology works and what impacts it has. Third, the proposal seeks to boost innovation by creating sandboxes for developing and testing AI technologies. Fourth, the proposed Regulation takes also account of the imported AI technologies from outside the EU and the need for these to comply with the conformity requirements in the proposal. Fifth, the proposal sets up supervisory and enforcement mechanisms. These seem to be envisaged to be set up and work in parallel with the data protection supervisory authorities set up under the GDPR and the LED. One of their tasks would be to \u2018approve\u2019 the high-risk AI applications, which would be then registered by the Commission. In addition, a European Artificial Intelligence Board which ensures the coordination between the Member States on regulating AI would be set up. We note that we are looking forward to the formal proposal and the more in-depth discussion on it.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; line-height: 18px; font-size: 12px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/datenschutz-hamburg.de\/pressemitteilungen\/2021\/04\/2021-04-13-facebook\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"font-size: 14px; line-height: 21px;\"><span style=\"line-height: 18px;\"><span style=\"color: #123256; line-height: 18px;\">&#8211; DPA of Hamburg Starts Urgency Procedure against Facebook<\/span><\/span>\u00a0<span style=\"line-height: 18px;\"><span style=\"color: #123256; line-height: 18px;\">&#8211;<\/span><\/span><\/span><\/strong><\/a><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/datenschutz-hamburg.de\/pressemitteilungen\/2021\/04\/2021-04-13-facebook\" target=\"_blank\" rel=\"noopener\">The DPA of Hamburg \u2013 the Hamburgische Beauftragte f\u00fcr Datenschutz und Informationsfreiheit (HmbBfDI) \u2013 has opened an urgency procedure against Facebook Ireland Ltd.<\/a> The procedure concerns WhatsApp\u2019s recently updated user conditions and data protection policy. At the start of the year, WhatsApp users were requested to agree to the new conditions by mid-May or risk being restricted in their use of the service. The conditions themselves contained several paragraphs in which Facebook Ireland claimed rights to use WhatsApp user data across its various services. The DPA is concerned that the extent of use of WhatsApp \u2013 over sixty million users in Germany \u2013 means that careful attention should be paid to ensure that no illegitimate exploitation of power occurs. The DPA considers that, in this case, there are grounds to believe that the new conditions may not be based on truly freely given and informed user consent. The reported goal of the procedure is an order that no more personal data be collected from WhatsApp users for use for Facebook \u2018s own purposes. The DPA is responsible for Facebook in Germany, as the company\u2019s German offices are located in Hamburg. The DPA perceives the existence of unusual circumstances, which permit the DPA to open proceedings, under Article 66 GDPR, against Facebook in Ireland \u2013 although any measures are then subsequently limited to three months duration pending extension or expansion by the EDPB. The DPA aims to come to a decision in the urgency procedure before the 15th of May.<\/span><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\">\n<\/div>\n<div class=\"txtTinyMce-wrapper\" style=\"font-family: inherit; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"text-align: justify; margin: 0px; direction: ltr; line-height: 18px; font-size: 12px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: none;\" href=\"https:\/\/ec.europa.eu\/commission\/presscorner\/detail\/en\/statement_21_1506\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"line-height: 18px;\"><span style=\"color: #123256; line-height: 18px;\">&#8211; <\/span><\/span><\/strong><\/a><strong><a style=\"text-decoration: none;\" href=\"https:\/\/techcrunch.com\/2021\/04\/16\/facebook-faces-mass-action-lawsuit-in-europe-over-2019-breach\/\" target=\"_blank\" rel=\"noopener\">\u2018Mass Action\u2019 against Facebook<\/a><\/strong><strong><span style=\"line-height: 18px;\">\u00a0<\/span><\/strong><a style=\"text-decoration: none;\" href=\"https:\/\/ec.europa.eu\/commission\/presscorner\/detail\/en\/statement_21_1506\" target=\"_blank\" rel=\"noopener\"><strong><span style=\"line-height: 18px;\">&#8211;<\/span><\/strong><\/a><\/span><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/techcrunch.com\/2021\/04\/16\/facebook-faces-mass-action-lawsuit-in-europe-over-2019-breach\/\" target=\"_blank\" rel=\"noopener\">As TechCrunch reports, the NGO Digital Rights Ireland has announced it is instigating a \u2018mass action\u2019 against the social media giant Facebook aiming at securing monetary compensation<\/a>. The \u2018mass action\u2019 concerns a leak of Facebook user data which initially happened in 2019, but which only recently came to light as the personal data of over five hundred million Facebook users was discovered as freely available for download online. The leak involved various types of personal data, including, for example, mobile phone numbers and relationship status. The NGO suggests that EU- or EEA-based Facebook users should check to see if their personal data was impacted by the leak and is requesting those users who have been impacted to join the case. The \u2018mass action\u2019 initiative will run concurrently with an investigation by the Irish Data Protection Commission. Whilst the initiative is interesting and its development is worth keeping an eye on, it should be recalled that the initiative is still in its formative stages and that the eventual outcome remains unclear.<\/span><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>&#8211; Liebscher v Austria: Publication of Divorce Settlement as a Breach of the Right to [&hellip;]<\/p>\n","protected":false},"author":144,"featured_media":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72236","dpi","type-dpi","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72236"}],"version-history":[{"count":0,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72236\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72236"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72236"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}