{"id":72417,"date":"2023-05-22T19:18:08","date_gmt":"2023-05-22T17:18:08","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-92\/"},"modified":"2023-05-22T19:18:08","modified_gmt":"2023-05-22T17:18:08","slug":"data-protection-insider-issue-92","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-92\/","title":{"rendered":"Data Protection Insider, Issue 92"},"content":{"rendered":"

–\u00a0<\/strong>CJEU Rules on Data Processing in Judicial Proceedings –<\/strong><\/a><\/p>\n

 <\/p>\n

On 4th May, the CJEU ruled in the case of\u00a0UZ v Bundesrepublik Deutschland.<\/em><\/a>\u00a0In essence, the case revolves around a file on a data subject concerning international protection, compiled by the Federal Office, which was subsequently at issue in court proceedings. Issues were raised concerning whether the compilation of this file, as well as its subsequent transfer for use in court proceedings complied with data protection law \u2013 including issues concerning accountability obligations and obligations pertaining to joint controllership. This led to a series of questions as to how the data should then be treated before court. In this regard, the referring court posed the following key questions to the CJEU:<\/p>\n

 <\/p>\n

    \n
  1. \u2018Does the failure of a controller to discharge\u2026its obligation of accountability under Article 5\u2026for example due to the lack of a record\u2026of processing activities\u2026or the lack of an arrangement\u2026in accordance with Article 26\u2026result in the data processing in question being unlawful within the meaning of Article 17(1)(d)\u2026and Article 18(1)(b)\u2026so that the data subject has a right to erasure or restriction\u2019?<\/li>\n
  2. If the answer to the first question is no: \u2018does an infringement\u2026of Article 5, 30 or 26\u2019 mean \u2018that\u2026a national court may take the data into account only if the data subject expressly consents to that use?\u2019<\/li>\n<\/ol>\n

     <\/p>\n

    In summary, the Court concluded:<\/p>\n

     <\/p>\n

      \n
    1. \u2018Article 17(1)(d) and Article 18(1)(b)\u2019 mean \u2018that failure by the controller to comply with\u2026Articles 26 and 30\u2026which relate\u2026to the conclusion of an arrangement determining joint responsibility for processing and to the maintenance of a record of processing activities, does not constitute unlawful processing conferring on the data subject a right to erasure or restriction\u2026where such a failure does not, as such, entail an infringement by the controller of the principle of \u2018accountability\u2019 as set out in Article 5(2)\u2026read in conjunction with Article 5(1)(a) and\u2026Article 6(1)\u2019.<\/li>\n
    2. When \u2018the controller\u2026has failed to comply with its obligations under Articles 26 or 30\u2026the lawfulness of\u2026taking into account\u2026such data by a national court is not subject to the data subject\u2019s consent\u2019.<\/li>\n<\/ol>\n

       <\/p>\n

      The case is well worth reading, not only for its interesting subject matter \u2013 the issue of data processing in judicial procedures \u2013 but also for the reasoning and observations of the Court \u2013 for example concerning the relationship between violations of lawful processing provisions and more procedural obligations, as well as concerning the relationship between the infringement of the right to data protection and these procedural obligations.<\/p>\n

      Learn more<\/span><\/strong><\/span><\/a><\/p>\n

       <\/p>\n

      – CJEU Rules on Non-Material Damages<\/strong>\u00a0<\/strong>–<\/strong><\/a><\/p>\n

       <\/p>\n

      On 4th May, the CJEU ruled in the case of\u00a0UI v \u00d6sterreichische Post AG<\/em>.\u00a0<\/a>As to the facts of the case, the applicant complained that he had been profiled by the Austrian postal services as concerns his political affiliation. The applicant, however, \u2018had not consented to the processing of his personal data\u2019 and \u2018felt offended by the fact that an affinity with the party in question had been attributed to him\u2019. Further, he claimed that the \u2018fact that data relating to his supposed political opinions were retained within that company caused him great upset, a loss of confidence and a feeling of exposure\u2019. On that basis he claimed compensation of \u20ac1000 for non-material damages. His claim was turned down by the lower domestic courts, and eventually three preliminary ruling questions on the issue of whether a mere infringement of the GDPR suffices to award damages were filed with the CJEU. Specifically:<\/p>\n

       <\/p>\n

        \n
      1. \u2018Does the award of compensation under Article 82\u2026also require, in addition to infringement of provisions of the GDPR, that an applicant must have suffered harm, or is the infringement of provisions\u2026in itself sufficient for\u2026compensation?\u2019<\/li>\n
      2. \u2018Does the assessment of the compensation depend on further EU-law requirements in addition to the principles of effectiveness and equivalence?\u2019<\/li>\n
      3. \u2018Is it compatible with EU law\u2026that the award of compensation for non-material damage presupposes the existence of a consequence\u2026of the infringement of at least some weight that goes beyond the upset caused by that infringement?\u2019<\/li>\n<\/ol>\n

         <\/p>\n

        In this regard, the Court concluded:<\/p>\n

         <\/p>\n

          \n
        1. \u2018Article 82(1)\u2026must be interpreted as meaning that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation.\u2019<\/li>\n
        2. Article 82(1) precludes \u2018a national rule or practice which makes compensation for non-material damage\u2026subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness.\u2019<\/li>\n
        3. Article 82 means \u2018that for the purposes of determining the amount of damages payable\u2026national courts must apply\u2026domestic rules\u2026relating to the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with.\u2019<\/li>\n<\/ol>\n

           <\/p>\n

          This is a fascinating case and well worth closer reading. This is particularly the case as the Court goes into detail regarding the scope of critical, but little defined, concepts in the GDPR concerning non-material damages. We would highlight, however, that key questions concerning the scope of non-material damages \u2013 for example concerning the range of harms capable of resulting in non-material damages \u2013 remain unanswered in the case.<\/p>\n

          Learn\u00a0more<\/strong><\/span><\/a><\/p>\n

           <\/p>\n

          – CJEU Offers a Broad Interpretation of the Notion of a Copy of One\u2019s Data –\u00a0<\/a><\/strong><\/p>\n

          \u00a0<\/strong><\/p>\n

          On 4th May, the CJEU clarified the concept of a data copy under the right of access to one\u2019s data under Article 15 (3) GDPR in F.F. v \u00d6sterreichische Datenschutzbeh\u00f6rde. As to the facts of the case, the applicant in the main proceedings requested a copy of the personal data concerning him as processed by a credit rating agency (\u2018CRIF GmbH\u2019). The latter provided only a summary of these data. Following administrative and judicial battles on national level, the question on the interpretation on the notion of a copy reached the CJEU. The latter provided the following clarifications. First, the Court clarified that the notion of personal data, of which a copy is to be provided, should be interpreted broadly: \u2018the broad definition of the concept of \u2018personal data\u2019 covers not only data collected and stored by the controller, but also includes all information resulting from the processing of personal data relating to an identified or identifiable person, such as the assessment of that person\u2019s creditworthiness or his or her ability to pay.\u2019 Second, the Court recalled that one of the purposes of the right of access consists in the opportunity for the data subject to verify the lawfulness of the data processing and exercise their other rights, e.g. to rectification, and that Article 12 (1) GDPR anchors the requirement for understandable communication to the data subject.\u00a0On these premises, the Court concluded that the right to a copy \u2018means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain copies of extracts from documents or even entire documents or extracts from databases which contain, inter alia, those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on him or her by that regulation, bearing in mind that account must be taken, in that regard, of the rights and freedoms of others.<\/a>\u2019 Third, the Court clarified that the notion of \u2018information\u2019 contained in Article 15 (3) GDPR \u2018relates exclusively to the personal data of which the controller must provide a copy pursuant to the first sentence of that paragraph.\u2019 We note that this judgment forms part of a series of judgments which read the different provisions on the right of access to one\u2019s data broadly, ensuring greater transparency towards concerned data subjects.<\/p>\n

          Learn\u00a0more<\/strong><\/span><\/a><\/p>\n

           <\/p>\n

          – ECtHR Gives Green Light to Dutch Data Transmission Provisions between Law Enforcement Authorities –\u00a0<\/a><\/strong><\/p>\n

          \u00a0<\/strong><\/p>\n

          On 16th May, the ECtHR delivered three judgments concerning the Dutch legal provisions and practice on the transfer of companies\u2019 and their employees\u2019 personal data from the public prosecutor\u2019s office to the Dutch Competition Authority (\u2018NMA\u2019) and established that they do not violate Articles 8 and 13 ECHR.\u00a0<\/a>Although the three cases concern different companies, they raised similar claims under Article 8 ECHR, namely that \u2018the transmission to the NMA of data that were irrelevant to the criminal investigation\u2026constituted a violation of\u2026rights under Article 8 of the Convention\u2019. The Court\u2019s reasoning in the three cases is also similar. The Court first recalled that \u2018legal persons may, under certain circumstances, claim rights to respect of their business premises and correspondence under Article 8\u2019 and that \u2018the transmission of data obtained through the interception of telecommunications to and their use by other authorities may constitute a separate interference with rights protected by this provision\u2019. Then, the Court found that the interferences had legal basis under Dutch law which was accessible and foreseeable, that they pursued a legitimate aim and that they were proportionate. On the last point, the Court found that \u2018the domestic courts carefully examined the facts, assessed the lawfulness of the transmission\u2026and conducted an adequate balancing exercise under Article 8 of the Convention between the interests of the applicant company and the authorities\u2019 interests to protect the economic well-being of the country (\u2026). In that connection the Court also\u2019 observes the lack of arguments to the effect that interferences \u2018did not pursue a legitimate aim or as to why the balance struck by the domestic authorities was not fair in their particular case.\u2019 Thus, the interferences were deemed to be overall necessary and proportionate in order to enforce competition law.<\/p>\n

          https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-224732%22]}<\/a><\/p>\n

          https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-224733%22]}<\/a><\/p>\n

          https:\/\/hudoc.echr.coe.int\/eng#{%22itemid%22:[%22001-224734%22]}<\/a><\/p>\n

          Learn\u00a0more<\/strong><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

          CJEU Rules on Data Processing in Judicial Proceedings
          \nCJEU Rules on Non-Material Damages
          \nCJEU Offers a Broad Interpretation of the Notion of a Copy of One\u2019s Data
          \nECtHR Gives Green Light to Dutch Data Transmission Provisions between Law Enforcement Authorities<\/p>\n","protected":false},"author":144,"featured_media":65094,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72417","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72417"}],"version-history":[{"count":0,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72417\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/65094"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72417"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72417"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}