Lmst

Presumably now there is no DPDI Bill, the Information Commissioner's Office can continue with its anonymisation guidance and 'unpause' it? https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-call-for-views-anonymisation-pseudonymisation-and-privacy-enhancing-technologies-guidance/ #eudp

A screenshot of the text on the linked webpage

New #EDPB opinion says that companies can't just establish a #GDPR main establishment with a plaque on a door — it has to be where decisions on processing are taken, and if decisions are taken overseas, *there can be no main establishment* and thus the one-stop-shop does not apply. https://edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-042024-notion-main-establishment_en #eudp #dataprotection @ggf

Interesting that #Google has choosen to disable image generation in their multi-modal #Gemini image model in countries with strong #dataProtection law. Concerned it might be full of identifiable imagery? #eudp

Generated images

Important:

« Image generation in Gemini Apps is available in most countries, except in the European Economic Area (EEA), Switzerland, and the UK. It’s only available for English prompts.

'Database Retrieval Technology and Subject Access Principles' by Graham Greenleaf and Roger Clarke in 1984 is one of the most precient and under-referenced pieces in the data protection literature and is and more more relevant by the day. https://rogerclarke.com/DV/DRT-84.pdf #GDPR #DataProtection #eudp

Unsurprising but the #CJEU clarify that you can't retain communications data under the limited #dataRetention powers associated with serious crime and then decide to use it to prosecute something else. fedi post: https://social.network.europa.eu/@Curia/111022918723074019 press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-09/cp230135en.pdf #eudp

Screenshot of PDF in linked press release page 1

Screenshot of PDF in linked press release page 2

Dutch DPA publishes damning advice about the government’s attempt to require skin perspiration alcohol meters for those subject to an alcohol ban. Objects to data being transferred to the United States and the high-level of false positives in the system. https://autoriteitpersoonsgegevens.nl/uploads/2023-08/Advies%20alcoholmeter.pdf #eudp #gdpr #LawEnforcementDirective

The #CNIL fines an e-scooter firm for tracking the #geolocation of its #escooters every 30 seconds without purpose limitation. Challenges also on informing them or establishing a legal basis for tracking. Even if in a separate database as easily cross referenced to users. While not special category data, CNIL calls location ‘highly personal’. Company could also not demonstrate effectiveness of this geolocation for finding lost scooters. https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047346903?isSuggest=true #GDPR #RGPD #eudp #dataprotection

at least #Microsoft’s reported integration of #GPT4 into #Bing saves regulators the back and forth of ‘is a large language model processing personal data’ (spoiler: often) because now they can just look at the Google Spain case.

Yet how will Microsoft comply with right to be forgotten requests? https://medium.com/@owenyin/scoop-oh-the-things-youll-do-with-bing-s-chatgpt-62b42d8d7198 #LLMs #chatGPT #eudp #rtbf

Incredible to see Dutch privacy legend @sjoera Nas profiled in the New York Times for her and colleagues' groundbreaking work on public sector #dataProtection, slowly transforming giants like Microsoft, Zoom and Google and forcing significant changes. #edTech #eudp #gdpr https://www.nytimes.com/2023/01/18/technology/dutch-school-privacy-google-microsoft-zoom.html

The New York Times: How the Netherlands Is Taming Big Tech, Dutch privacy negotiators have spurred major changes at Google, Microsoft and Zoom, using a landmark European data protection law as a lever.

Full judgment to come, but @Curia CJEU rules today that controllers cannot get away with providing just "categories" of data recipients when they hold the actual data on who they transferred to. Important for strengthening the #RightOfAccess to ensure forward provenance is as a strong as backward provenance, to track complex data chains. Ruling in C-154/21 Österreichische Post (Informations relatives aux destinataires de données personnelles), press release https://curia.europa.eu/jcms/jcms/p1_3869656/en/ #GDPR #eudp

In today’s judgment, the Court replies that where personal data have been or will be disclosed to recipients, there is an obligation on the part of the controller to provide the data subject, on request, with the actual identity of those recipients. It is only where it is not (yet) possible to identify those recipients that the controller may indicate only the categories of recipient in question. That is also the case where the controller demonstrates that the request is manifestly unfounded or excessive.

The incredible Orla Lynskey (LSE) is giving a #CurrentLegalProblems lecture at UCL Laws in-person on 2 February. It's entitled "Effective or Complete Data Protection" — can it really be both? Register https://www.ucl.ac.uk/laws/events/2023/feb/person-effective-or-complete-data-protection #dataProtection #GDPR #eudp

Data protection law acts as the first line of defence for our fundamental rights in digital society. As our daily interactions generate more data, implicating and jeopardising our rights further, the response of the law has been to cast the net of data protection law wider. In the EU, the Court of Justice has interpreted key data protection concepts expansively to promote the “effective and complete protection” of individuals. The result is a legal framework where everything is personal data and everyone responsible for its application. Regulators struggle to enforce the law while regulates are often unaware of their compliance obligations or unable to meet them, calling into question the administrability and legitimacy of the law. Judicial attempts to smooth the cracks of this expansive reach have further exacerbated the problem. The conclusion is that data protection law can be effective or complete, but not both. This requires us to think afresh about the way in which the law responds to the fundamental rights challenges posed by digital data processing.

I'd missed this pending judgment on #LectureCapture and #DataProtection in employment context, with its AG Opinion already out @lilianedwards @tnhh (Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer) https://curia.europa.eu/juris/document/document.jsf?text=&docid=266121&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5802 #eudp #gdpr #workersrights

The hearing for the first ever CJEU @Curia #Article22 #GDPR case, SCHUFA Holdings, on whether the upstream creation of profile for #CreditScoring that will be influential downstream will be a significant, automated decision, is scheduled for the 26 January 2023.

@RDBinns and I wrote about the underlying conceptual quandaries the Article 22 definition creates in IDPL here. Not clear how the court will deal with them. https://doi.org/10.1093/idpl/ipab020 #eudp #privacy #algorithms

Questions referred

Is Article 22(1) of Regulation (EU) 2016/679 ' to be interpreted as meaning that the automated establishment of a probability value concerning the ability of a data subject to service a loan in the future already constitutes a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her, where that value, determined by means of personal data of the data subject, is transmitted by the controller to a third-party controller and the latter draws strongly on that value for its decision on the establishment, implementation or termination of a contractual relationship with the data subject?

If Question 1 is answered in the negative, are Articles 6(1) and 22 of Regulation (EU) 2016/679 to be interpreted as precluding national legislation under which the use of a probability value - in casu, in relation to a natural person's ability and willingness to pay, in the case where information about claims against that person is taken into account - regarding specific future behaviour of a natural person for the purpose of deciding on the establishment, implementation or termination of a contractual relationship with that person (scoring) is permissible only if certain further conditions, which are set out in more detail in the grounds of the request for a preliminary ruling, are met?

Amazing work by @EDPS setting up a #PeerTube account for #eudp videos in the fediverse! You can follow other fediverse applications as if they were on Mastodon: just put your username (without the first @) in 'Subscribe' at the video link https://tube.network.europa.eu/w/4unihHaPLjejmxHoz4Xm6t, and you'll be following @edps_tv. And if you either reply to the video within Mastoson (paste the URL into search), or use the comment feature on the page with your Mastodon username, your post will appear below the video!

#eudp

Client Info