{"id":72366,"date":"2022-08-04T23:00:49","date_gmt":"2022-08-04T21:00:49","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-74\/"},"modified":"2022-08-04T23:00:49","modified_gmt":"2022-08-04T21:00:49","slug":"data-protection-insider-issue-74","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-74\/","title":{"rendered":"Data Protection Insider, Issue 74"},"content":{"rendered":"
\n

– <\/a><\/strong>EDPB EDPS Joint Opinion concerning Proposal on Preventing and Combatting Child Sexual Abuse<\/a><\/strong>–<\/a><\/strong><\/em><\/span><\/p>\n

\n

On 28th July, the EDPB and EDPS adopted their \u2018Joint Opinion 04\/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse\u2019<\/a>. The EDPB and EDPS begin by offering general comments. Whilst the EDPB and EDPS recognise the legitimacy of the purposes of the proposal, they also express concerns regarding potential interferences with fundamental rights \u2013 including concerns related to the essence of rights \u2018in the area of privacy of electronic communications\u2019. The EDPB and EDPS then go into detail and make a series of specific comments under the following headings: i) \u2018Relationship with existing legislation\u2019 \u2013 including highlighting concerns relating to Article 15(1) of the ePrivacy Directive; ii) \u2018Lawful basis under the GDPR\u2019 \u2013 including the observation that any legal basis will need to respect the \u2018conditions set out in Article 52(1) of the Charter\u2019; iii) \u2018Risk assessment and mitigation obligations\u2019 \u2013 including stressing \u2018the need of a high level of legal <\/span>certainty, clarity and foreseeability of the legislation in order to ensure that the proposed measures are genuinely effective in achieving the objective they pursue and at the same time are the least detrimental to the fundamental rights at stake\u2019; iv) \u2018Conditions for the issuance of detection orders\u2019 \u2013 including noting that \u2018the conditions for the issuance of a detection order are dominated by vague legal terms, such as \u2018appreciable extent\u2019, \u2018significant number\u2019, and are in part repetitive, as evidence of former abuse will often contribute to establishing the likelihood of future abuse\u2019; v) \u2018Analysis of the necessity and proportionality of the envisaged measures\u2019 \u2013 including highlighting concerns that the procedural safeguards in the regulation may not always be adequate to address risks; vi) \u2018Reporting obligations\u2019 \u2013 including recommending complementing \u2018the list of specific reporting requirements in Article 13 of the Proposal with a requirement to include in the report information on the specific technology that enabled the provider to become aware of the relevant abusive content, in case the provider became aware of the potential child sexual abuse following measures taken to execute a detection order issued in accordance with Article 7 of the Proposal\u2019; vii) \u2018Removal and blocking obligations\u2019 \u2013 including considering the need to clarify \u2018the powers of Coordinating Authorities with respect to the issuance of blocking orders\u2019; viii) \u2018Relevant technologies and safeguards\u2019 \u2013 including recommending \u2018that the proposed Regulation be amended to expressly allow providers to rely on parental control mechanisms in addition or as an alternative to age verification\u2019; ix) \u2018Preservation of information\u2019 \u2013 including considering \u2018that only those providers that use their own detection technologies <\/span>should be allowed to retain data for improving the effectiveness and accuracy of the technologies\u2019; x) \u2018Impact on encryption\u2019 \u2013 including highlighting that in order to \u2018ensure that the proposed Regulation does not undermine the security or confidentiality of electronic communications of European citizens\u2026the enacting terms of the Proposal should clearly state that nothing in the proposed Regulation should be interpreted as prohibiting or weakening encryption\u2019; and xi) \u2018Supervision, enforcement and cooperation\u2019 \u2013 including observing the need for further consideration concerning the role of the EDPB in the legislative framework. There is a great deal of relevant information in the Opinion \u2013 not only concerning the specifics of the proposal \u2013 and the Opinion should make interesting reading for much of the data protection community.<\/span><\/p>\n<\/div>\n

 <\/p>\n

\n

\n

– <\/span><\/a><\/strong>EDPS Adopts Opinion on Proposal on Asset Recovery and Confiscation<\/a><\/strong>–<\/span><\/a><\/strong><\/em><\/p>\n

\n

On 19th July, the EDPS adopted \u2018Opinion 16\/2022 on the Proposal for a Directive of the European Parliament and of the Council on asset recovery and confiscation\u2019.<\/a> The EDPS begins with a series of general comments, including welcoming the emphasis on the significance of data protection in the proposal. The EDPS then goes on to make a series of more specific comments under the following headings: i) \u2018Access to information by asset recovery offices\u2019 \u2013 including making a number of positive observations concerning the limitations and safeguards foreseen in the proposal; ii) \u2018Exchange of information between asset recovery offices\u2019 \u2013 including recommending that certain listed \u2018categories of sensitive personal data [be removed] from the scope of the Proposal, unless convincing objective arguments in support of their necessity and proportionality in the specific context of the Proposal can be presented to the co-legislator\u2019; iii) \u2018Establishment of centralised registries of frozen and confiscated property\u2019 \u2013 including considering \u2018that the national legislation transposing the Directive should designate the competent authority(ies) which will be responsible for the management of the registry and thus will take the role of data controller in accordance with Article 3(8) of the LED\u2019; and iv) \u2018Cooperation between asset recovery offices and EU agencies\u2019 \u2013 including highlighting “that any exchange and further processing of personal data in the context of the envisaged cooperation must take place in strict compliance with the provisions of Chapter IX of the EUDPR and the specific data protection rules in the legal acts establishing the Union agencies”. The Opinion will most likely be of interest to those following developments in the area covered.<\/p>\n<\/div>\n

\n

\n

– <\/strong><\/span><\/em><\/a>EDPB Adopts Letters and Article 65 Decision<\/a><\/strong><\/em>–<\/strong><\/span><\/em><\/a><\/p>\n

\n

On 29th July, the EDPB announced it had adopted the following letters and the following decision:<\/span><\/a><\/p>\n

\n