{"id":72454,"date":"2023-11-23T23:42:07","date_gmt":"2023-11-23T22:42:07","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-102\/"},"modified":"2024-05-12T00:38:28","modified_gmt":"2024-05-11T22:38:28","slug":"data-protection-insider-issue-102","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-102\/","title":{"rendered":"Data Protection Insider, Issue 102"},"content":{"rendered":"
\n

– CJEU Strengthens the Role of DPAs in \u2018Indirect Access\u2019 Cases under the LED –<\/span><\/a><\/strong><\/p>\n

On 16th November, the CJEU delivered its judgment in Ligue des droits humains ASBL, BA v Organe de contr\u00f4le de l\u2019information polici\u00e8re, in which it boosted the decision-making powers of DPAs when evoked to exercise the rights of the data subjects against law enforcement authorities on their behalf, i.e. indirectly. <\/a>As we summarized the facts of the case on 22.06.2023: \u2018a Belgian individual applied for a security clearance before taking up a job. The Belgian National Security Authority refused to issue him this certificate on the grounds that he had participated previously in demonstrations. In order to challenge the refusal, the applicant in the main proceedings requested access to the information as to which authorities had entered the data in the respective police records and access to the personal data entered in these records. The access was refused under the Belgian law implementing the LED (\u2018LPD\u2019), because under this law individuals may not receive any access to the data processed by the law enforcement authorities and any additional information about the processing of their data. They may only request the supervisory authority to check the lawfulness of the processing and to receive only information that the necessary checks have been carried out. By contrast, under the LED individuals should have direct access to the data and only where it is restricted in individual cases, should the right of access be exercised via the supervisory authority which should provide \u2018at least\u2019 information that the necessary checks have been carried out (Article 17 (3) LED). During the legal proceedings in Belgium, the following two questions were sent for preliminary ruling: (1) may the answer by the supervisory authority that the necessary checks have been carried out be challenged in court? and (2) is Article 17 LED compatible with the requirement for independence of the data protection supervisory authorities and the fundamental right to effective judicial remedies under the Charter (Article 8(3) and Article 47 Charter respectively)?\u2019 In response to the first question, the Court held that when a DPA informs a data subject of the result of the verification of the legality of the data processing by the controller, it adopts a \u2018legally binding\u2019 decision which may be challenged in court, i.e. individuals enjoy the right to effective remedies against such decisions. As to the second question, the CJEU ruled that, in principle, the validity of Article 17 LED as such is not called into question when examined on the basis of Article 52(1) CFREU (restrictions on fundamental rights, including independent supervision under the fundamental right to data protection and the right to effective remedies). The CJEU also ruled, however, that national implementations of Article 17(3) LED should grant DPAs the discretion to communicate more information to data subjects, on a case-by-case basis and following a \u2018confidential dialogue\u2019 with the controller, than the information that the necessary verifications have taken place. We interpret the latter to suggest that the Belgian implementing provisions on Article 17 LED might be incompatible with EU law.<\/p>\n<\/div>\n

 <\/p>\n

\n

– CJEU Rules on Vehicle Identification Numbers –<\/strong><\/a><\/span><\/p>\n

On 9th November 2023, the CJEU ruled in the case of Gesamtverband Autoteile-Handel eV v Scania CV AB.<\/a> In terms of the facts, the case concerned the legal obligation of the defendant \u2013 a manufacturer of heavy goods vehicles \u2013 to provide information related to its vehicles, including Vehicle Identification Numbers (VINs), in an accessible form. The core of the case dealt with issues largely removed from data protection law. One question concerning data protection, however, was referred to the Court: \u2018Does Article 61(1) of Regulation [2018\/858] constitute, for vehicle manufacturers, a legal obligation within the meaning of Article 6(1)(c) of the GDPR which justifies the disclosure of VINs or information linked to VINs to independent operators as other controllers within the meaning of point 7 of Article 4 of the GDPR?\u2019 \u2013 for reference, Article 61(1) of Regulation 2018\/858 concerns the obligation on manufacturers to provide \u2018to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information\u2019 as well as the obligation to provide this information \u2018in an easily accessible manner in the form of machine-readable and electronically processable datasets\u2019. The Court eventually concluded that \u2018Article 61(1) of Regulation 2018\/858\u2026must be interpreted as meaning that it establishes a \u2018legal obligation\u2019, within the meaning of Article 6(1)(c) of\u2019 the GDPR \u2018on car manufacturers, to make the VINs of the vehicles which they manufacture available to independent operators, as \u2018controllers\u2019, within the meaning of Article 4(7) of that regulation\u2019. Perhaps more interesting than this final conclusion, however, are the Court\u2019s considerations of whether VINs constitute personal data. The Court decided that VINs need not constitute personal data, but could constitute personal data. The Court stated, in this regard: \u2018where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person, which it is for the referring court to determine, that VIN constitutes personal data for them\u2026and, indirectly, for the vehicle manufacturers making it available, even if the VIN is not, in itself, personal data for them, and is not personal data for them in particular where the vehicle to which the VIN has been assigned does not belong to a natural person\u2019. The Court thus seems to confirm previous case-law in recognising the possibility that data may be anonymous to one controller, whilst being personal data to another. The judgment, however, does not offer any further clarification.<\/p>\n<\/div>\n

 <\/p>\n

\n

– ECtHR Rules on Lawyer-Client Confidentiality –\u00a0<\/span><\/a><\/strong><\/span><\/p>\n

On 14th November, the ECtHR ruled in the case of Canavc\u0131 and Others v. T\u00fcrkiye. In terms of the facts, the case concerned individuals who had been arrested in connection with the attempted coup d\u2019\u00e9tat in Turkey in 2016. Following their arrest, decisions were made to monitor and record meetings with their lawyers. In two cases, decisions were made by Public Prosecutors\u2019 Offices, and in one case apparently by some other party. In each case, the legal justification offered was emergency legislation enacted after the coup. The applicants complained before national instances regarding infringements of their rights \u2013 including rights to privacy and to a fair trial. These applications were, however, largely unsuccessful. Accordingly, the defendants complained to the ECtHR: \u2018that the monitoring by an officer of their lawyers\u2019 visits and the recording of those meetings by means of technical devices had contravened their right to confidential communication with their lawyers, in breach of their right to respect for their private life under Article 8 of the Convention. Relying on Article 13 of the Convention, they also complained of a lack of an effective domestic remedy in that respect\u2019. In light of the law and the complaints, the ECtHR decided it would be \u2018appropriate to examine the facts complained of solely from the standpoint of Article 8\u2019. In this regard, the Court found a violation of Article 8. The Court highlighted \u2018that a person\u2019s communication with a lawyer in the context of legal assistance falls within the scope of private life since the purpose of such interaction is to allow an individual to make informed decisions about his or her life\u2019.<\/a> The Court thus also recognised an interference resulting from the monitoring of meetings between clients and lawyers. Regarding the case in which a decision to monitor was made without the involvement of the Public Prosecutor\u2019s Office, the Court found this lack of involvement already constituted grounds to find that \u2018the interference was not \u201cin accordance with the law\u201d\u2019. With regard to the cases in which Public Prosecutors\u2019 Offices had been involved, the Court considered: \u2018that the discretion enjoyed by the public prosecutors in imposing restrictions on the applicants\u2019 communication with their lawyers was not subject to any conditions, that the scope of that discretion and the manner of its exercise were not defined and that no other specific guarantees were provided in that regard. This being so\u2019 the Court \u2018considers that, in the circumstances of the present case, the adoption of the impugned measures against the applicants, which were enforced for a limited period during the state of emergency, was liable to be arbitrary and incompatible with the requirement of lawfulness\u2019. Whilst the Court recognised the need for leeway in relation to states facing public emergencies, it considered that, in this case, \u2018the absence of any safeguards against arbitrariness and abuse in\u2019 the relevant national emergency legislation \u2018cannot be regarded as having been justified by the respondent State\u2019s derogation of 21 July 2016 under Article 15 of the Convention\u2019.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

– CJEU Strengthens the Role of DPAs in \u2018Indirect Access\u2019 Cases under the LED – […]<\/p>\n","protected":false},"author":144,"featured_media":68928,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72454","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72454"}],"version-history":[{"count":1,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72454\/revisions"}],"predecessor-version":[{"id":72505,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72454\/revisions\/72505"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/68928"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72454"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72454"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}