{"id":73271,"date":"2024-07-01T15:42:07","date_gmt":"2024-07-01T13:42:07","guid":{"rendered":"https:\/\/www.lexxion.eu\/dpi\/data-protection-insider-issue-114\/"},"modified":"2024-07-01T15:42:07","modified_gmt":"2024-07-01T13:42:07","slug":"data-protection-insider-issue-114","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-114\/","title":{"rendered":"Data Protection Insider, Issue 114"},"content":{"rendered":"

– ECtHR: Monaco in Breach of Article 8 ECHR for Extracting Too Much Data from a Lawyer\u2019s Phone-\u00a0<\/a><\/h3>\n

On 6th June, the ECtHR ruled that Monaco had infringed Article 8 ECHR for failing to adequately protect the data on a lawyer\u2019s phone when seeking to extract a certain recording from it in the case of Bersheda and Rybolovlev v. Monaco.<\/a> As to the facts of the case, Ms Bersheda, a lawyer registered with the Swiss bar, was charged in Monaco with having secretly recorded a conversation of under 10 minutes with T.R. In the course of her defence, Ms Bersheda handed over her phone so that the recording in question could be examined. She had deleted other data from her phone with the help of an IT expert. The investigating judge in Monaco, however, overstepped his remit and ordered the examination of all the data that could be retrieved from the phone, including the deleted data (\u2018a \u201cfishing expedition\u201d\u2019). On that basis, and bearing also in mind breach of professional secrecy, Ms Bersheda complained that the indiscriminate retrieval of data from her phone, and the fact that her complaint was rejected by the Monegasque courts breached her Article 8 ECHR rights. The Court first, confirmed that the above facts constituted an interference with Article 8 ECHR. Then, it ruled that the said interference had a legal basis in domestic law. However, the Court was not satisfied regarding how the law was implemented in the present case. It noted that \u2018the investigating judge had not, from the outset, deployed a framework to protect legal professional privilege in the present case, especially when domestic law required guarantees for measures that were admittedly different but had comparable consequences, like searches and seizures.\u2019 It also deplored the fact that the judicial authorities failed to adequately remedy the shortcomings of the investigations. Thus, it concluded that there had been an interference with Article 8 ECHR, because the interference was not \u2018necessary in a democratic society\u2019. Editorial note: The above summary is based on the English language version of the Press Release as the judgment is available only in French. The summary also does not cover the inadmissibility discussion in relation to one of the two applicants \u2013 Mr Rybolovlev.<\/p>\n

– AG Medina Advises on Exceptions to Transparency in the GDPR –<\/a><\/h3>\n

On 6th June, AG Medina clarified the exception on transparency under Article 14(5)(c) GDPR in the case of Masdi. As to the facts of the case, the applicant in the main proceedings, UC, was issued with a vaccination certificate for COVID-19 by the Budapest Office.<\/a> He complained that the Office did not provide him with the necessary information about the processing of his data, as required under the GDPR. The Office evoked the exception to transparency under Article 14(5)(c) GDPR and argued that the processing of the data was based on domestic law (Article 6(1)(e) and Article 9(2)(i) GDPR). The questions referred for preliminary ruling refer to the scope of the exception in Article 14(5)(c) GDPR and the powers of the national DPA when examining compliance with the exception in Article 14(5)(c) GDPR. AG Medina advised the CJEU to rule as follows. First, he argued that, as to the material scope of the exception, \u2018the derogation from the obligation on the data controller to provide information to the data subject applies to all data which the controller has not<\/p>\n

obtained from the data subject. It is not relevant, in that regard, whether the data are expressly obtained from another entity or if the data are generated by the controller in its own procedure\u2019. As to the supervisory powers of DPAs, especially to examine the quality of the national law on which the processing is based, AG Medina distinguished the present case from Schrems, where the question arose as to whether DPAs may examine the validity of EU instruments. AG Medina concluded that \u2018Article 77(1) of the GDPR must be interpreted as meaning that, in the context of a complaint procedure, the supervisory authority has the power to examine whether all the conditions laid down in Article 14(5)(c) of that regulation are complied with. More particularly, it has the power to examine the question whether Member State law, to which the controller is subject, provides appropriate measures to protect the data subject\u2019s legitimate interests\u2019. Considering whether national law must transpose security measures in order to be compliant with Article 14(5)(c) GDPR, AG Medina advised the Court that \u2018Article 14(5)(c) of the GDPR must be interpreted as meaning that the \u2018appropriate measures\u2019 referred to in that provision do not require the national legislature to transpose the measures relating to the security of the data laid down in Article 32 of that regulation\u2019.<\/p>\n

– AG Opinion on Collection of Biometric and Genetic Data –<\/a><\/h3>\n

On 13th June, AG De La Tour published their Opinion on the case of V.S..<\/a> As to the facts of the case, the police wanted to record the photographic, dactyloscopic and genetic data of a suspect in a crime (V.S.), who, however, refused to provide the data. Following the refusal, the law enforcement authorities sought judicial authorisation in order to forcefully collect the biometric and genetic data. The national court, uncertain as regarded certain aspects of the law, submitted a set of questions to the CJEU, which the CJEU then dealt with in 2023 \u2013 Case C\u2011205\/21. The national court, remaining uncertain regarding aspects of the relevant law following the CJEU\u2019s decision \u2013 in particular concerning whether the Court should have access to the full case file in conducting its review, and as to the extent of review of the file necessary \u2013 thus submitted a second round of questions to the CJEU. The following questions were referred, in this second round, to the Court:<\/p>\n