{"id":72472,"date":"2024-02-29T23:49:10","date_gmt":"2024-02-29T22:49:10","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-107\/"},"modified":"2024-05-12T00:35:37","modified_gmt":"2024-05-11T22:35:37","slug":"data-protection-insider-issue-107","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-107\/","title":{"rendered":"Data Protection Insider, Issue 107"},"content":{"rendered":"
\n

– ECtHR Rules on Publication and Destruction of Information Obtained via Covert Surveillance –<\/span><\/strong><\/p>\n

On 22nd February, the ECtHR ruled in the case of Kaczmarek v. Poland.<\/a> In terms of the facts, the applicant is the wife of a Polish politician. In 2007, an anti-corruption investigation was launched in relation to the Ministry of Agriculture. The investigation failed, and the applicant\u2019s husband was implicated as having warned the Minister. An investigation was then launched into the hampering of the previous investigation. In the course of this later investigation, the applicant\u2019s husband was a subject of covert surveillance, and, as a result, the applicant\u2019s calls were monitored. In a subsequent press conference, hosted by Deputy Prosecutor Generals, information obtained using covert measures was made public \u2013 including information relating to the applicant. The applicant brought civil claims against one of the Deputy Prosecutor Generals before national courts about this disclosure, but these complaints were unsuccessful. Following this, in 2010, the applicant requested the covertly collected information concerning her be destroyed. Following a lengthy process, she was unsuccessful. Accordingly, the applicant complained to the ECtHR, relying on Article 8, that \u2018her personal data and material which had been gathered in the covert surveillance operation had been made public during a press conference and that the authorities\u2019 response had not been adequate\u2019 as well as about \u2018the retention of the material gathered during the surveillance operation.\u2019 The Court found a violation. In relation to the disclosure in the press conference, the Court highlighted \u2013 particularly in light of the fact the provisions on which disclosure was argued to be based did not obviously relate to publication of personal information \u2013 that \u2018a recording of a phone conversation of the person who was not subjected to the investigation went beyond the scope of the empowerment vested in the prosecuting authorities by\u2019 the relevant provisions. In relation to the destruction of information collected via covert surveillance, the Court highlighted \u2018the lack of sufficient clarity in the legal framework at the time of the events\u2026and the absence of procedural guarantees relating specifically to the destruction of the applicant\u2019s communications.<\/p>\n<\/div>\n

 <\/p>\n

\n

– ECtHR Rules on Surveillance and Encryption –<\/a><\/strong><\/span><\/p>\n

On 13th February, the ECtHR ruled in the case of Podchasov v. Russia.<\/a> In terms of the facts, the applicant was a user of the Telegram application. Under Russian law, Telegram is obliged to store information on communications for one year, and the content of communications for six months. Russian law also requires that, under certain conditions, this information must be provided to law enforcement authorities, as well as any supplemental information necessary to decrypt encrypted data. The Russian security services requested this information from Telegram in related to several users \u2018who were suspected of terrorism-related activities\u2019. Telegram refused, asserting that providing the required information would mean creating a backdoor to its encryption. The applicant, along with others, also \u2018challenged the disclosure order before\u2019 national courts, arguing that \u2018the provision of encryption keys as required by the’ security services \u2018would enable the decryption of the communications of all users\u2019 and that it \u2018would therefore breach their right to respect for their private life and for the privacy of their communications.\u2019 Challenges at national level, however, were unsuccessful. In light of the above, the applicant, relying on Article 8 of the Convention, complained to the ECtHR \u2018about the statutory requirement for\u2019 internet communications organisations \u2018to store the content of all Internet communications and related communications data, and to submit those data to law-enforcement authorities or security services at their request together with information necessary to decrypt electronic messages if they were encrypted\u2019. The Court found a violation, and concluded that: \u2018the contested legislation providing for the retention of all Internet communications of all users, the security services\u2019 direct access to the data stored without adequate safeguards against abuse and the requirement to decrypt encrypted communications, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society.\u2019 The Court went on to say that, in \u2018so far as this legislation permits the public authorities to have access, on a generalised basis and without sufficient safeguards, to the content of electronic communications, it impairs the very essence of the right to respect for private life under Article 8 of the Convention\u2019 and that Russia had overstepped its margin of appreciation. Whilst the whole case is interesting and worth reading \u2013 particularly for anyone following the data retention, and state-surveillance, discussions \u2013 it is the section on encryption, and the Court\u2019s strong stance, which is perhaps most eye-catching.<\/p>\n

 <\/p>\n<\/div>\n

\n

– AG Offers Opinion on the Sale of Databases of Personal Data –\u00a0<\/span><\/a><\/strong><\/span><\/p>\n

On 22nd February, AG Pikam\u00e4e delivered their Opinion in the case of I. sp. z o. o. v M.W.<\/a> In terms of the facts, the case concerns the member of a board of a company, which is in a debt relationship to another company. In the case the former company does not have assets with which to pay its debts, the latter company may be able to claim directly from the member of the board. In legal proceedings relating to this issue, the member of the board claims there are assets which might be sold: amongst which, databases of personal data. The referring Court, however, was uncertain as to the legality of transferring these databases \u2013 not least as the data subjects in the databases had not given their consent to the further transfer of their data. In this regard, the following question was referred to the CJEU: \u2018Should Article 5(1)(a) of\u2019 the GDPR \u2018in conjunction with Article 6(1)(a), (c) and (e)\u2019 and \u2018Article 6(3)\u2026be interpreted as precluding a provision of national law that permits the sale, in enforcement proceedings, of a database, within the meaning of Article 1(2) of Directive\u2019 96\/9 \u2013 Database Directive \u2013 \u2018which contains personal data, if the data subject did not consent to such a sale?\u2019 The AG came to the conclusion that: \u2018Point (e)\u2026of Article 6(1), Article 6(3) and the first sentence of Article 6(4)\u2026must be interpreted as meaning that it does not preclude a provision of national law that permits the sale, by a court enforcement officer, in enforcement proceedings, of a database which contains personal data, if the data subjects did not consent to such a sale, provided that the processing carried out by that court enforcement officer with regard to those data constitutes a necessary and proportionate measure in a democratic society to ensure the enforcement of a civil law claim.\u2019 There is much to mull over in this Opinion, including observations as to how the purpose limitation principle should be understood, how exceptions to the principle might be interpreted \u2013 including concerning Recital 50 \u2013 and regarding the possibility of the sale of personal data. As always, however, it remains to be seen whether, and to which extent, the Court will follow the Opinion.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

– ECtHR Rules on Publication and Destruction of Information Obtained via Covert Surveillance – On […]<\/p>\n","protected":false},"author":144,"featured_media":70985,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[],"class_list":["post-72472","dpi","type-dpi","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=72472"}],"version-history":[{"count":1,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72472\/revisions"}],"predecessor-version":[{"id":72495,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/72472\/revisions\/72495"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/70985"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=72472"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=72472"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=72472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}