{"id":72410,"date":"2023-03-23T19:18:08","date_gmt":"2023-03-23T18:18:08","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-89\/"},"modified":"2023-03-23T19:18:08","modified_gmt":"2023-03-23T18:18:08","slug":"data-protection-insider-issue-89","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-89\/","title":{"rendered":"Data Protection Insider, Issue 89"},"content":{"rendered":"

\u00a0–<\/a>\u00a0CJEU Decides on Personal Data Processing in Civil Proceedings<\/a>\u00a0<\/strong>–\u00a0<\/strong><\/a><\/p>\n

 <\/p>\n

On 2nd March, the CJEU passed down its verdict in the case of\u00a0<\/a>Norra Stockholm Bygg AB v Per Nycander AB, other party: Entral AB<\/a>.<\/em>\u00a0<\/em>In terms of the facts, the case concerned the construction of a building by the appellant for the respondent. The register of employee activity on the project was held by\u00a0Entral AB<\/em>. With regard to the project, the respondent challenged the request for payment, claiming the requested amount was too high. In this regard, in order to prove this claim before court, the respondent requested the disclosure of employee activity records from Entral AB. The request was opposed by the appellant, who suggested that the disclosure would breach the GDPR \u2013 given requested data were collected for another purpose and cannot be used as evidence. National courts initially ordered the production of the records, a decision which the appellant appealed. In this regard, the referring court submitted two questions to the CJEU:<\/p>\n

 <\/p>\n

1. \u2018Does Article 6(3) and (4) of the\u2019 GDPR \u2018also impose a requirement on national procedural legislation relating to\u2019 the requirement to produce documents?<\/p>\n

2. Does the \u2018GDPR mean that regard must also be had to the interests of the data subjects when a decision on\u2019 production \u2018must be made which involves the processing of personal data? In such circumstances, does EU law establish any requirements concerning how, in detail, that decision should be made?\u2019<\/p>\n

 <\/p>\n

In relation to these questions, the Court decided:<\/p>\n

 <\/p>\n

\u2018Article 6 (3) and (4) of the GDPR\u2019 mean \u2018that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection\u2019.<\/p>\n

\u2018Articles 5 and 6 of the GDPR\u2019 mean that, when considering the necessity of ordering a document, a national court must consider \u2018the interests of the data subjects concerned\u2019 and balance these \u2018according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation\u2026in Article 5(1)(c).\u2019<\/p>\n

 <\/p>\n

This is an interesting case worthy of attention. This is not only because it with a special, and important, processing sector \u2013 judicial proceedings \u2013 but also as the judgment contains a range of interesting discussions and statements on, for example, the relationship between data protection and the right to effective judicial protection, and on the concept of pseudonymisation.<\/p>\n

Learn more<\/span><\/strong><\/span><\/a><\/p>\n

 <\/p>\n

–\u00a0ECtHR Rules on Publication of Personal Data on Tax Authority Website<\/a><\/strong>\u00a0<\/strong><\/a>–<\/strong><\/a><\/p>\n

 <\/p>\n

On 9th March, the ECtHR passed down its verdict in the case of\u00a0L.B. v. Hungary<\/em><\/a>. In terms of the facts, the plaintiff was found, in domestic procedures, to owe significant sums in unpaid taxes. In 2014, the tax authority then \u2018published the applicant\u2019s personal data, including his name and home address, on the list of major tax defaulters on its website\u2019 \u2013 a measure which was provided for in national law. \u2018The applicant\u2019s name and home address were\u2019 also \u2018published on the list\u2019. Subsequently, in 2016, \u2018an online media outlet produced an interactive map called \u201cthe national map of tax debtors\u201d. The applicant\u2019s home address, along with the addresses of other tax debtors\u2026was indicated with a red dot, and if a person clicked on the dot the applicant\u2019s personal information\u2026appeared, thus making the data available to all readers\u2019. The applicant\u2019s entry was removed in 2019, \u2018when his tax arrears became time-barred\u2019. Finally, following \u2018the entry into force of the amendments to the 2017 Tax Administration Act on 1 January 2020\u2026the applicant\u2019s personal data, together with information on which fiscal years his tax debts related to, became accessible through the search interface on the Tax Authority\u2019s website\u2019. Appealing to the ECtHR, the \u2018applicant alleged that the publication infringed his right to respect for private life as protected by Article 8 of the Convention\u2019. In this regard, the Court eventually \u2013 after deliberating centrally on whether the national legislative measures in question had been enacted by Parliament after an adequate consideration of all the interests involved \u2013 concluded that: \u2018given the systematic publication of taxpayer data, which included taxpayers\u2019 home addresses, the Court is not satisfied, notwithstanding the margin of appreciation of the respondent State, that the reasons relied on by the Hungarian legislature in enacting the section 55(5) publication scheme, although relevant, were sufficient to show that the interference complained of was \u201cnecessary in a democratic society\u201d and that the authorities of the respondent State struck a fair balance between the competing interests at stake\u2019. This is an interesting case, not only for the subject-matter, but also for certain of the details of the Court\u2019s discussions, for example, in relation to the degree of sensitivity of financial data, as well as in relation to the operation of national legislatures concerning data protection principles.<\/p>\n

Learn\u00a0more<\/strong><\/span><\/a><\/p>\n

 <\/p>\n

–\u00a0<\/strong><\/a>EDPB Adopts Opinion on EU-US Data Privacy Framework\u00a0<\/strong><\/a>–<\/strong>\u00a0<\/strong><\/a><\/p>\n

\u00a0<\/strong><\/p>\n

On 28th February, the EDPB adopted \u2018Opinion 5\/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework\u2019.\u00a0<\/a>The Opinion does identify a number of positive developments in the Framework in relation to its predecessors. The EDPB also, however, highlight a number of outstanding concerns and considers these should be addressed by the Commission. In terms of substantive content, the Opinion is split into three parts: i) \u2018General Data Protection Aspects\u2019 \u2013 including, for example, a discussion of issues concerning onward transfers and a discussion of automated decision-making; ii) \u2018Access and Use of Personal Data Transferred from the European Union by Public Authorities in the US\u2019 \u2013 including, for example, a discussion of issues related to EO 14086, which provides new rules regarding security processing; and iii) \u2018Implementation and Monitoring of the Draft Decision\u2019 \u2013 including, for example, a discussion of the modalities of the review procedure the EDPB consider important. The fact that the EDPB has raised concerns is perhaps not surprising. Nevertheless \u2013 as with the recent Parliament debate on the issue \u2013 the expression of these concerns in the Opinion is yet another sign the US-adequacy saga is still far from over.<\/p>\n

Learn\u00a0more<\/strong><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\u00a0–\u00a0CJEU Decides on Personal Data Processing in Civil Proceedings\u00a0–\u00a0   On 2nd March, the CJEU […]<\/p>\n","protected":false},"author":144,"featured_media":64464,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72410","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72410"}],"version-history":[{"count":0,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72410\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/64464"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72410"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72410"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}