{"id":72364,"date":"2022-07-21T22:59:36","date_gmt":"2022-07-21T20:59:36","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-73\/"},"modified":"2022-07-21T22:59:36","modified_gmt":"2022-07-21T20:59:36","slug":"data-protection-insider-issue-73","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-73\/","title":{"rendered":"Data Protection Insider, Issue 73"},"content":{"rendered":"
\n

– <\/a><\/strong>ECtHR Rules on Production and Publication of Police Information<\/a><\/strong> –<\/a><\/strong><\/em><\/p>\n

\n

On 28th June, the ECtHR ruled in the case of M.D. and Others v. Spain<\/em>.<\/a> In essence, the case concerned a manifesto, signed in 2014 by the applicants \u2013 amongst others \u2013 who were serving judges, \u2018in which they set out their legal opinion in favour of the possibility of exercising the Catalan people\u2019s so-called \u201cright to decide\u201d, within the framework of the Spanish Constitution and international law.\u2019 An article on the manifesto was then published by a national newspaper in which photos and other personal data on the applicants was published, which \u2018in the applicants\u2019 opinion, had been extracted from their respective entries in the database of the Spanish police\u2019. It then came to light that a police report on the manifesto, including the applicants\u2019 personal data, had also been produced. The applicants launched a series of proceedings concerning the manifesto and their personal data in front of national judicial bodies. None of these were successful. In this regard: \u2018The applicants complained [to the ECtHR] that Article 8 of the Convention had been violated, firstly given that the police, without any legal justification, had created a report on each applicant (as signatories to the above-mentioned manifesto) using photographs taken from the police ID database, and secondly, since that report had been leaked to the press; lastly, they complained about the publication of their photographs in the newspaper\u2019. The Court found a violation of Article 8. In relation to the police report, the Court found that: \u2018there is no domestic legal provision that would justify the drawing by police of a report on citizens when there were no indications that they could have committed a crime or were involved in the preparatory steps necessary for the commission of a crime\u2026[and accordingly] since the interference with the applicants\u2019 private life was not in accordance with any domestic law, and the public authorities have used the personal data for a purpose other than that which justified their collection, the Court concludes that the mere existence of the police report in issue, which was drafted in respect of individuals whose behaviour did not imply any criminal activity, amounts to a violation of Article 8.\u2019 In relation to the leak to the press, the Court found that there was an insufficient investigation carried out as: \u2018for a sufficient investigation to be carried out, it was necessary for the investigators to have obtained a statement from the person who had been the direct addressee of the report and who had been responsible for the persons who had accessed the police ID database and collected the data and photographs of the applicants since, regardless of his criminal or disciplinary responsibility, his testimony would have aided the identification of those responsible for the criminal acts in question.\u2019 In this regard, the Court concluded that: \u2018the failure of the judicial bodies involved to carry out certain investigative measures which would most likely have been useful for the investigation into the facts of the case and which were susceptible of remedying the interference with the applicants\u2019 rights must be considered to constitute a failure by the respondent State to comply with its positive obligations under Article 8 of the Convention\u2019.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

\n

– <\/strong>EDPB EDPS Joint Opinion on EHDS Proposal<\/strong> –<\/strong><\/em><\/span><\/a><\/p>\n

\n

On 12th July, the EDPB and EDPS published their \u2018EDPB-EDPS Joint Opinion 03\/2022 on the Proposal for a Regulation on the European Health Data Space\u2019<\/a>. The Opinion starts by offering general comments \u2013 including concerning the relationship between the proposal and data protection law. The Opinion then goes into more detail on the proposal and includes section specific comments. These encompass comments on: \u2018General provisions (Chapter I)\u2019 \u2013 including the concern that many definitions are \u2018very broad and open to interpretation, which in turn may lead to legal uncertainty\u2019; \u2018Primary use of electronic health data (Chapter II)\u2019 \u2013 including suggesting \u2018introducing a mandatory consultation of and a duty of cooperation with DPAs with regard to the assessment of complaints as well as the implementation of the Proposal whenever data protection aspects are involved\u2019; \u2018Ehr systems and wellness applications (Chapter III)\u2019 \u2013 including proposing \u2018excluding from the scope of Chapter IV of Proposal wellness applications and other digital applications\u2019; \u2018Secondary use of electronic health data (Chapter IV)\u2019 \u2013 including highlighting \u2018the lack of clarity as to what step in the procedure foreseen in the Proposal with regards to secondary use of electronic health data may the health data access bodies disregard [certain] requirements [concerning consent] set out in national law\u2019; \u2018Additional actions (Chapter V)\u2019 \u2013\u00a0 including observing that \u2018Article 63 of the Proposal should impose on controllers and processors established in the EU processing personal electronic health data within the scope of the Proposal an obligation to store this data in the EU\u2019; \u2018European governance and coordination (Chapter VI)\u2019 \u2013 including considering that \u2018their representatives should be permanent members of the EHDS Board (thus not only potentially invited) and should participate to all discussions on personal data protection issues\u2019; \u2018Delegation and Committee (Chapter VII)\u2019 \u2013 including noting that \u2018the criteria envisaged by Article 5(2)(b) of the Proposal to guide the Commission in deciding the priority categories of electronic health data to be added to the list established in Article 5(1) of the Proposal seem vague and should be further delimited\u2019; and \u2018Miscellaneous (Chapter VIII)\u2019 \u2013 including considering that \u2018in line with previous comments on the self-certification of EHR systems, the periods for evaluation and review established under Article 70 of the Proposal are too long to ensure the proper implementation in time\u2019. The Opinion is detailed and will be highly interesting to all concerned with, or tracking the process of, the EHDS.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

\n

– <\/strong><\/span>EDPB Intensifies Cooperation on Cross-Border Cases of \u2018Strategic Importance\u2019 <\/span><\/strong>–<\/strong><\/span><\/em><\/a><\/p>\n

\n

On 14th July, presented its next steps towards enhanced cooperation on strategic cross-border cases.<\/a> First, \u2018the EDPB adopted a set of criteria to assess whether a cross-border case may qualify as a case of \u201cstrategic importance\u201d for closer cooperation\u2019, referring to the Vienna Statement of Enforcement Cooperation adopted in April 2022. Second and third, the EDPB detailed the steps to be followed when a case of \u2018strategic importance\u2019, i.e. a one-stop-shop case, is identified and picked its first three cases to pilot this new approach. The new initiative should result in a better enforcement of the GDPR. A case of strategic importance should meet one or more of the following criteria:<\/span><\/p>\n

\u2018a structural or recurring problem in several Member States, in particular where the case concerns a general legal issue with regards to the interpretation, application or enforcement of the GDPR;<\/span><\/p>\n

a case related to the intersection of data protection and other legal fields;<\/span><\/p>\n

and a case which affects a large number of data subjects in several Member States;<\/span><\/p>\n

a case involving a large number of complaints in several Member States;<\/span><\/p>\n

a case concerning a fundamental issue falling within the scope of the EDPB strategy;<\/span><\/p>\n

a case where the GDPR implies that a high risk can be assumed, such as:<\/span><\/p>\n

the processing of special categories of data;<\/span><\/p>\n

processing regarding vulnerable people such as minors;<\/span><\/p>\n

Situations where a data protection impact assessment (DPIA) is required.\u2019<\/span><\/p>\n

Any DPA may propose a case of strategic importance, but the cases will be selected by the EDPB. The cooperation on the cases will comply with Chapter VII GDPR.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

\n

– <\/em><\/a>EDPS Publishes Opinion on Financial Rules Concerning the EU Budget and Data Protection<\/a><\/em> –<\/em><\/a><\/strong><\/p>\n

\n

On 7th July, the EDPS published his \u2018Opinion 14\/2022 on the Proposal for a Regulation of the European Parliament and of the Council on the financial rules applicable to the general budget of the Union (recast)\u2019.<\/a> The Proposal concerns the better monitoring of the direct or indirect recipients of EU funds, including through more digitalisation and personal data processing. The EDPS expresses caution with respect to data protection in relation to the following three main aspects, which the EDPS invites the legislator to address. First, the envisaged data-mining and risk-scoring activities risk undermining the definition of the categories and sources of data, as well as their quality, while in addition, the roles of the entities which will access the data for (risk) analysis purposes need to be more clearly defined. Second, the Proposal needs to clarify what IT System is going to be used and what safeguards will be embedded into this system. Third, the Proposal should define how long personal data may be stored in the system and processed through data-mining and risk-scoring techniques.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

– <\/em><\/a>EDPB Publishes Coordinated Supervision Committee Working Programme 2022-2024<\/a><\/em>\u00a0 –<\/em><\/a><\/strong><\/p>\n

\n

On 6th July, the EDPB published its 2022-2024 Working Programme for the Coordinated Supervision Committee (CSC)<\/a>. The CSC is responsible for supervising the EU large-scale migration and law enforcement databases and EU bodies such as Europol, Eurojust and the European Public Prosecutor\u2019s Office. The CSC is composed of the national DPAs and the EDPS. The document is split into two parts: the working methods of the CSC; and its planned activities. As to the working methods, the CSC elects a coordinator and a deputy coordinator. It will convene \u2018al least twice a year\u2019. It has a dedicated mailbox and seeks exchanges with relevant stakeholders. As to the planned activities, \u2018[t]his work programme has selected the data subjects\u2019 rights as a key-area of activity.\u2019 Furthermore, it will work towards coordinated audits and inspections between the DPAs and the EDPS. It will focus also on establishing \u2018a common understanding between its participating authorities on their respective scope of<\/span><\/p>\n

supervision, applicable legal basis, and the areas where they need to cooperate and coordinate\u2019 and on drafting the CSC\u2019s work on the supervision of the databases and bodies which it is supposed to supervise. Ad hoc activities may be added to its work.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

– <\/em><\/a>67th EDPB Plenary Agenda<\/a><\/em> –<\/em><\/a><\/strong><\/p>\n

\n

On 12th July, the EDPB held its 67th Plenary meeting.<\/a> In the course of the meeting, the following significant issues were discussed:<\/span><\/p>\n

\u2018Consistency mechanism, Guidelines and EDPB RoP\u2019: \u2018EDPB-EDPS Joint Opinion on the Proposal for a Regulation on the European Health Data Space\u2019 \u2013 see also above.<\/span><\/p>\n

\u2018Current Focus of the EDPB Members\u2019: \u2018The EU House of Data Protection \u2013 request for mandate\u2019.<\/span><\/p>\n

\u2018BTLE ESG\u2019: \u2018Police Cooperation Code \u2013 request for mandate\u2019.<\/span><\/p>\n

\u2018ENF ESG\u2019: \u2018Substantive questions from the CEF members and possible approaches\u2019.<\/span><\/p>\n

\u2018ENF ESG\u2019: \u2018Strategic cases \u2013 criteria, process and selection of pilot cases\u2019.<\/span><\/p>\n

\u2018ITS ESG\u2019: \u2018Statement on personal data transfers to the Russian Federation\u2019.<\/span><\/p>\n

\u2018Coordinated Supervision Committee\u2019: \u2018Update on the work of the Coordinated Supervision Committee \u2013 information\u2019 \u2013 see also above.<\/span><\/p>\n

\u2018Secretariat\u2019: \u2018Engagement with NGOs\u2019.<\/span><\/p>\n

\n

At the time of writing, certain adopted documents are already available on the EDPB website. We would presume that an announcement concerning all adopted documents will be made shortly. We would also presume that any adopted documents not yet published \u2013 should there be any \u2013 will be made available on the EDPB website in due course.<\/span><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

– ECtHR Rules on Production and Publication of Police Information – On 28th June, the […]<\/p>\n","protected":false},"author":144,"featured_media":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72364","dpi","type-dpi","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72364"}],"version-history":[{"count":0,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72364\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72364"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72364"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}