{"id":72289,"date":"2021-10-25T22:30:41","date_gmt":"2021-10-25T20:30:41","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-57\/"},"modified":"2021-10-25T22:30:41","modified_gmt":"2021-10-25T20:30:41","slug":"data-protection-insider-issue-57","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-57\/","title":{"rendered":"Data Protection Insider, Issue 57"},"content":{"rendered":"<div class=\"txtTinyMce-wrapper\" style=\"font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: 12px; line-height: 18px; text-align: justify;\">\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px; text-align: justify;\"><a style=\"text-decoration: none;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-212150%22]}\" target=\"_blank\" rel=\"noopener\"><strong>&#8211;\u00a0 <em>M<\/em><\/strong><span style=\"font-size: 14px; line-height: 21px;\"><strong><em>L. v Slovakia<\/em><\/strong><strong>: Post-Mortem Privacy Protection <\/strong><\/span><strong><em>&#8211;<\/em><\/strong><\/a><\/p>\n<p style=\"line-height: 18px; word-break: break-word;\">\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">On 14th October, the ECtHR examined the balance between the freedom of speech interests of the Slovak newspapers which had been publishing articles about the sexual abuse convictions by a deceased priest and the private life interests of the priest and his mother in <em>M.L. v Slovakia<\/em>. As to the facts of the case, the priest had been convicted two times \u2013 of sexual abuse and of disorderly behaviour &#8211; and had spent the said convictions. Two years after his death, local newspapers published articles about the sexual behaviour of the priest and made allegations about his death. The mother of the priest sought unsuccessfully remedies on national level against the newspapers. In her complaint to the ECtHR, she complained that the dismissal of her case in Slovakia breached her private life interests as protected by Article 8 ECHR. <a style=\"text-decoration: underline;\" href=\"https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-212150%22]}\" target=\"_blank\" rel=\"noopener\"><u>The ECtHR ruled that the domestic courts had not struck a fair balance between the two competing human rights for the following three reasons.<\/u><\/a> First, the Court reminded that individuals do not lose entirely the protection provided by Article 8 ECHR, even if they have been criminally convicted. <em>In casu<\/em>, the contested articles had been published after imposing the criminal convictions and after they had been spent by the priest. Second, the articles contained not only facts drawn from the criminal files, but contained unverified, sensational statements. These \u2018distorted facts and the expressions used must have been upsetting for the applicant and (\u2026) they were of such a nature as to be capable of considerably and directly affecting her feelings as a mother of a deceased son as well as her private life and identity, the reputation of her deceased son being a part and parcel thereof\u2019. Third, building on the above, the Court concluded that \u2018as well as being rather provocative and sensationalist, the articles in question could hardly be considered as having made a contribution to a debate of general interest.\u2019 We note that the case is interesting from many perspectives, including because it concerns the question of the right to post-mortem private life protection and because it demonstrates the link between the protection of private life and personal data of one individual and the private life protection of their relatives.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-size: 12px; line-height: 18px; text-align: justify; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;\">\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\"><a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/news\/news\/2021\/edpb-adopts-guidelines-restrictions-data-subject-rights-under-article-23-gdpr_en\" target=\"_blank\" rel=\"noopener\"><strong>&#8211;\u00a0<\/strong><strong>EDPB Adopts Revised Guidelines on Restrictions under Article 23 &#8211;<\/strong><\/a><\/p>\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\">\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/news\/news\/2021\/edpb-adopts-guidelines-restrictions-data-subject-rights-under-article-23-gdpr_en\" target=\"_blank\" rel=\"noopener\"><u>On 13th October, the EDPB adopted \u2018Guidelines 10\/2020 on restrictions under Article 23 GDPR: Version 2.0\u2019.<\/u><\/a> The Guidelines were adopted at the 56th Plenary session following a public consultation concerning the original version of the Guidelines, which were adopted in December 2020. According to the EDPS: \u2018The guidelines aim to recall the conditions surrounding the use of such restrictions by Member States or the EU legislator in light of the Charter of Fundamental Rights and the GDPR. They provide a thorough analysis of the criteria to apply restrictions, the assessments that need to be observed, how data subjects can exercise their rights after the restrictions are lifted, and the consequences of infringements of Art. 23 GDPR. Additionally, the guidelines analyse how the legislative measures setting out the restrictions need to meet the foreseeability requirement and examine the grounds for the restrictions listed by Art. 23(1) GDPR, and the obligations and rights which may be restricted.\u2019 There is apparently no easy way to see how the consultation proceeded, its outcomes, or what has been changed from the original Guidelines in consequence. This information would be welcome. Such information might, for example, provide insight as to which forms of arguments were taken on board, and which were not.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-size: 12px; line-height: 18px; text-align: justify; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;\">\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\"><a style=\"text-decoration: none;\" href=\"https:\/\/edpb.europa.eu\/system\/files\/2021-10\/20211013plen1.2agenda_public.pdf\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211;\u00a0<\/strong><\/span><span style=\"font-size: 14px; line-height: 21px;\"><strong>EDPB Agenda for 56th Plenary &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\">\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/edpb.europa.eu\/system\/files\/2021-10\/20211013plen1.2agenda_public.pdf\" target=\"_blank\" rel=\"noopener\"><u>On 13th October, the EDPB held its 56th Plenary.<\/u><\/a> In particular, the EDPB considered:<\/span><\/p>\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\">\n<ul>\n<li style=\"font-size: 14px; line-height: 21px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Consistency mechanism and Guidelines\u2019<\/span><\/li>\n<\/ul>\n<ul style=\"list-style-type: circle;\">\n<li style=\"line-height: 18px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Guidelines on Restrictions under Art. 23 GDPR (following public consultation)\u2019<\/span><\/li>\n<li style=\"font-size: 14px; line-height: 21px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Guidelines on children\u2019s data \u2013 request for mandate\u2019<\/span><\/li>\n<\/ul>\n<p style=\"line-height: 18px; word-break: break-word;\">\n<ul>\n<li style=\"font-size: 14px; line-height: 21px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Current Focus of the EDPB Members\u2019<\/span><\/li>\n<\/ul>\n<ul style=\"list-style-type: circle;\">\n<li style=\"font-size: 14px; line-height: 21px;\"><span style=\"font-size: 14px; line-height: 21px;\">\u2018Proposal on coordinated action of the EDPB\u2019<\/span><\/li>\n<\/ul>\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\">\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">The agenda is available online. Further detailed information about the outcomes of the meeting is still \u2013 at the time of writing \u2013 forthcoming.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-size: 12px; line-height: 18px; text-align: justify; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;\">\n<p style=\"line-height: 18px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/www.computerweekly.com\/news\/252508544\/MEPs-vote-to-expand-Europol-data-mandate\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211; European Parliament Uncritical of Europol\u2019s Mandate Expansion &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\">\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\"><a style=\"text-decoration: underline;\" href=\"https:\/\/www.computerweekly.com\/news\/252508544\/MEPs-vote-to-expand-Europol-data-mandate\" target=\"_blank\" rel=\"noopener\"><u>On 21 October, the European Parliament<\/u><\/a><a style=\"text-decoration: underline;\" href=\"https:\/\/www.europarl.europa.eu\/news\/en\/press-room\/20211021IPR15502\/parliament-ready-to-start-talks-on-new-mandate-for-europol\" target=\"_blank\" rel=\"noopener\"><u>voted<\/u><\/a><a style=\"text-decoration: underline;\" href=\"https:\/\/www.computerweekly.com\/news\/252508544\/MEPs-vote-to-expand-Europol-data-mandate\" target=\"_blank\" rel=\"noopener\"><u>to support the extension of Europol\u2019s mandate in order to allow it to exchange personal data with private actors, gather and analyse large quantities of data and to develop AI tools for fighting serious crime, including in the framework of R&amp;D projects.<\/u><\/a> With this vote the Parliament adopted its position on two proposals by the Commission which seek to update the Europol Regulation and the Schengen Information System (SIS) legal basis, allowing Europol to enter law enforcement related alerts directly into SIS. <em>Computerweekly<\/em> reports that this development has been criticized by NGOs, because it essentially contradicts a vote by the European Parliament earlier this month which called for banning mass biometric surveillance and predicting criminal behaviour. They criticize the EP\u2019s position on the proposed changes to Europol\u2019s mandate, because the adopted position does not guarantee enough accountability and oversight over Europol\u2019s increased technical capabilities. With the Parliament\u2019s mandate now adopted, it can now proceed to the negotiations with the Council on the finalisation of the update of Europol\u2019s Regulation and the SIS legal basis.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p><a style=\"text-decoration: none;\" href=\"https:\/\/www.euractiv.com\/section\/justice-home-affairs\/news\/eu-accused-of-disregarding-human-rights-when-supporting-law-enforcement-abroad\/\" target=\"_blank\" rel=\"noopener\"><strong>&#8211; Does the EU Disregard Human Rights Abroad? &#8211;<\/strong><\/a><\/p>\n<div class=\"txtTinyMce-wrapper\" style=\"font-size: 12px; line-height: 18px; text-align: justify; font-family: Arial, 'Helvetica Neue', Helvetica, sans-serif;\">\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\">\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">According to <em>Euractiv<\/em>, a number of NGOs, amongst which Privacy International, have filed a complaint with the European Ombudsman against several EU agencies and bodies, amongst which Frontex, for <a style=\"text-decoration: underline;\" href=\"https:\/\/www.euractiv.com\/section\/justice-home-affairs\/news\/eu-accused-of-disregarding-human-rights-when-supporting-law-enforcement-abroad\/\" target=\"_blank\" rel=\"noopener\"><u>\u2018contributing to the development of \u2018surveillance\u2019 capacities in third countries without considering fundamental rights and data protection\u2019.<\/u><\/a> The NGOs claim that these capacities were developed as a result of projects aiming at the training, financing and provision of technologies to law enforcement authorities in a number of Third Countries. The surveillance capacities include the establishment of biometric identification techniques and \u2018gathering intelligence online, wiretapping techniques, and decrypting intercepted messages.\u2019 The NGOs are concerned that according to the Commission, for EU Trust Fund Projects it is not obliged to carry out a data protection impact assessment.<\/span><\/p>\n<p style=\"font-size: 14px; line-height: 21px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">From Privacy International\u2019s website it becomes clear that on 19th October they have also sent a letter to the <a style=\"text-decoration: underline;\" href=\"https:\/\/privacyinternational.org\/sites\/default\/files\/2021-10\/2021.10.19%20EDPS%20-%20Letter%20-%20Impact%20assessments%20-%20PI_final.pdf\" target=\"_blank\" rel=\"noopener\">EDPS,<\/a> in which they inform the EDPS of the complaint submitted to the Ombudsman, asking the EDPS to examine on his own initiative the compliance of the offered trainings with the data protection obligations of the EU agencies and bodies under the applicable data protection rules (Regulation 2018\/1725), including on carrying out a data protection impact assessment.<\/span><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<p style=\"line-height: 18px; word-break: break-word;\"><a style=\"text-decoration: none;\" href=\"https:\/\/www.politico.eu\/article\/ireland-facebook-decision-triggers-argument-over-limits-gdpr\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-size: 14px; line-height: 21px;\"><strong>&#8211; Controversy following Irish DPA\u2019s Facebook Decision &#8211;<\/strong><\/span><\/a><\/p>\n<p style=\"line-height: 21px; word-break: break-word; font-size: 14px;\">\n<p style=\"line-height: 18px; word-break: break-word;\"><span style=\"font-size: 14px; line-height: 21px;\">The Irish DPC recently announced its decision to fine Facebook between 28 and 36 million EUR for violations of the GDPR connected with transparency. <a style=\"text-decoration: underline;\" href=\"https:\/\/www.politico.eu\/article\/ireland-facebook-decision-triggers-argument-over-limits-gdpr\/\" target=\"_blank\" rel=\"noopener\"><u>According to Politico, however, this decision has been received with some concern by privacy advocates and other DPAs.<\/u><\/a> Concerns emerge, in particular, around the assertion of the Irish DPC that it was not in the position to judge Facebook\u2019s argument that its data processing is legitimated, under the GDPR, on the basis of a contract with users, as opposed to on the basis of users\u2019 consent. Other DPAs now have the possibility to provide input in relation to the DPC\u2019s decision. It is too early to say what will come from this process. It will, however, certainly be interesting to follow how DPAs formally respond to the decision and how the decision concerning Facebook\u2019s practices, and the resulting fine, changes as a result.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8211;\u00a0 ML. v Slovakia: Post-Mortem Privacy Protection &#8211; On 14th October, the ECtHR examined the [&hellip;]<\/p>\n","protected":false},"author":144,"featured_media":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72289","dpi","type-dpi","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72289"}],"version-history":[{"count":0,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72289\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72289"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72289"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}