Jimmy Orucevic

News on the Right of Access under the GDPR The German Federal Court of Justice (#BGH) has addressed the issue of the right of access under #Article15 of the #GDPR in its judgment of 5 March 2024 (VI ZR 330/21). The case specifically concerned the scope of the right to a copy in relation to different categories of documents. The BGH held that letters drafted by the data subject himself or herself always constitute #personal #data in their entirety. Therefore, the controller must provide copies of such letters. In contrast, letters drafted by the #controller only have a personal reference if they contain "information about the data subject". Therefore, these documents are also not fully personal. Only the relevant part that contains information about the #datasubject has a personal reference. Consequently, there would be no right to a complete copy of these documents. However, if a copy of these documents is necessary in order to understand the data processing as a whole and thus to be able to assert data subject rights, a complete copy must be made available. However, the data subject must credibly justify this and the necessity must be clearly recognizable. This creates more clarity for the processing of access requests. Copies of documents created by data subjects must be made available. This is not necessarily the case for documents created by the controller. The processing of access requests remains a challenging issue that is regularly associated with high effort. The BGH's limitation regarding the creation of copies is very helpful. https://lnkd.in/eUhHHcXP #LEP

5

EDPB launches French and German versions of its Data Protection Guide for small business: The EDPB Data Protection Guide for small business is now available in French and German The Guide provides practical information to SMEs about GDPR compliance and benefits in an accessible and easily understandable language. The development of tools providing practical, easily understandable and accessible data protection guidance is key to reaching a non-expert audience and a strategic objective for the EDPB. The EDPB Data Protection Guide for small business covers various aspects of the GDPR, from data protection basics, to data subject rights and measures to secure personal data. It contains videos, infographics, interactive flowcharts, and other practical materials to help SMEs on their way to become GDPR compliant In the near future, the Guide will become available in 15 more European languages. #dataprotection #dataprivacy #privacy

2

📊 noyb.eu published a report regarding #Cookie #Banner “Overview of #EU and national guidelines on dark patterns”. The Consent Banner Report discusses the issue of the absence of a 'reject' button on the first layer of a consent banner. According to industry statistics, only 2.18% of users visit the second layer. Hence, refusing consent generally takes twice as many steps as granting consent. The report discusses the findings of the European Data Protection Board (#EDPB) Cookie Banner Taskforce, which considers banners without a reject option in any layer as an infringement of the #ePrivacy Directive. However, there are exceptions. The BayLDA has argued that a link named 'continue without accepting' can be a clear enough alternative to a 'reject' button. Similarly, BlnBDI has stated that it's more important that users recognise the options rather than the design of the buttons. The AEPD in Spain continued to accept banners without a 'reject' option on the first layer in its old 2020 Guidelines, which goes against the EDPB Taskforce Report on this issue. However, new guidelines applicable from January 2024 now require a reject option on the first layer of the banner. Here are a few more takeaways from the report from several countries: 1.      #Denmark's Datatilsynet agency asserts that it's unlawful to provide a consent mechanism where refusing consent is some way more difficult or less prominently displayed than the option to give consent. They argue this is against the principle of transparency. 2.      In #Finland, Traficom (the Transport and Communications Agency), also agrees that refusing to give consent should never be more complicated than granting it. They use cookies as an example, explaining that rejecting nonessential cookies should not be any more difficult than accepting them. 3.      #Germany's DSK states there is an "effect and information deficit" if one option (e.g., "accept all" buttton) is presented clearly and the other option is kept nebulous. They assert that effective consent can't be met unless users are offered equivalent options to give or refuse consent. 4.      The #Greek HDPA believes that a user should be able to accept or reject trackers with the same number of actions (clicks). 5.      According to #Ireland's DPC, you should not use a banner or pop-up that nudges a user towards accepting cookies over rejecting them. 6.      In #Luxembourg, the CNPD recommends that equivalent possibilities should be offered for giving and refusing consent. They argue that if consenting to a particular purpose requires several operations (clicks, etc.), rejecting it shouldn't require more. 7.      The Spanish #AEPD says that the first layer of information should detail how a user can accept, configure, and reject the use of cookies. These remarks from each of these data protection agencies emphasize the importance of equal and easy-to-use options for giving and refusing consent when it comes to managing personal data.

2

Key takeaways from noyb.eu Cookie Banner Report: ✅ Clear & Easy Choices: Users MUST have a "reject all" option at the same level as "accept cookies." ❌ Pre-ticked Boxes are a No-Go: Get user consent the right way. ⚠️ Not All Cookies Are Equal: Cookies that are not "strictly necessary" require your user's explicit consent.

2

Hot off the press The #BerlinGroup, chaired by the German Federal Commissioner for Data Protection and Freedom of Information (#BfDI) Ulrich Kelber, has adopted a working paper on #FacialRecognition Technology. In view of the increasing use or intended use of this technology, the latest example being the planned nationwide use by the Swedish police, it is important to have clear and universally recognized rules. In addition, we may be seeing the first instance of abstract legal norms of the #AIAct being filled with life! #LEP https://lnkd.in/eTP6Y2qu

8

1 Kommentar

NOYB has filed suit against ChatGPT for not adhering to privacy regulations [https://lnkd.in/diD4HN-r]. Within the GDPR, the right of access (Article 15), right to rectification (Article 16), and right to erasure (Article 17), do not appear to be within the capacity of this and most generative AI and LLMs due to how these systems are trained. This should also be a wake up call for users here in the U.S. - everyone is all hyped up about Generative AI (and don't get me wrong - I think it's a great tool) but as usual, they are blinded by the bling, until the dark, nasty underside of reality slaps them in the face...but who's information/data will be so horrifically exposed before we listen? Continue putting the pressure on...squeeze these applications and their coders until they scream 'uncle', forcing them to comply with regulations - even if it's 'security by compulsion'.

4

EDPB issues opinion casting doubt on legality of pay-or-consent models: The European Data Protection Board issued a nonbinding opinion on the legality of pay-or-consent models in the context of obtaining valid consent to process personal data. The EDPB ruled, "in most cases," large online platforms offering a binary choice between paying to prevent personal data from being processed for behavioral advertising or consenting to targeted advertising does not align with the EU General Data Protection Regulation. IAPP Staff Writer Alex LaCasse reports on the major takeaways from the ruling. Full story #dataprotection #dataprivacy #privacy

2

Statement of the DSK I am just reviewing the #DSK's statement for the draft of a first act to amend the Federal Data Protection Act (#BDSG): https://lnkd.in/eb-5qiYK #data #privacy

7

𝗜𝘀 𝘆𝗼𝘂𝗿 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝗽𝗿𝗲𝗽𝗮𝗿𝗲𝗱 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗻𝗲𝘄 𝗰𝘆𝗯𝗲𝗿-𝗮𝘁𝘁𝗮𝗰𝗸 𝗿𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀?   On 22 May 2024, the Swiss Federal Council released a draft ordinance to implement the reporting requirement for cyber-attacks as set out in the Information Security Act. The public consultation will last until 13 September 2024, with the new requirement expected to be effective from 1 January 2025. This ordinance mandates that certain financial institutions, including banks, insurance companies and financial market infrastructures, must report cyber-attacks to the Federal Office for Cyber Security (FOCS) within 24 hours.   Read more about this new development in the latest article by our partner Vaïk Müller: https://lnkd.in/dd8BqZaN   #CyberSecurity #FinancialRegulations #SwissFinance #InformationSecurity #CMSlaw

20

A fascinating read on AI risk classification. #AI #riskclassification #AI Act

24

2 Kommentare

Something more to add to the summer GDPR reading list 👇 Hamburg DPA article on LLMs and GDPR. The French DPA has also published their Q&A on AI Act: https://lnkd.in/dvYg_mYg I think it's wonderful that these DPAs are so proactive in contributing to the interpretation and debate on GDPR and LLMs. These are DPAs to keep an eye on - especially since they also publish English translations. #gdpr #AIAct #LLM

1

Differences between Data Privacy and Data Security 🔊 🔔 Range and Concentration: Data privacy is concerned with the rights and expectations of the individual with relation to the collection, use, sharing, and management of their personal data by organizations. Consent for data processing, openness in data practices, purpose limitation (using data only for designated purposes), data minimization (gathering only required data), and the ability to access, amend, or remove personal information are some of its components. Data Security is protecting data assets from risks such as cyberattacks, unauthorized access, and breaches is the main goal of data security. Ensuring the confidentiality, integrity, and availability of data entails putting in place technical, procedural, and administrative safeguards. This covers security policies, data backups, access controls, encryption, and authentication methods. 🔔 Regulatory Structures: Data privacy is regulated by rules and regulations that specify how personal information must be handled, processed, and safeguarded.  HIPAA (Health Insurance Portability and Accountability Act), the CCPA, GDPR, and other laws that require businesses to establish privacy policies, data protection procedures, and individual rights over their data are a few examples. Data security is more widely focused on protecting all forms of data, including personal data, and frequently overlaps with data privacy laws. As part of their compliance framework, regulations such as the GDPR also include data security standards, such as making sure personal data is confidential and intact by using the right security measures. 🔔 Application and Methods: Data privacy is the process of putting in place privacy policies, guidelines, and practices that comply with moral and legal obligations. This entails carrying out privacy effect analyses, getting legitimate consent for data processing, putting data protection by design and default into practice, and giving people clear information about their data rights and usage policies. Data security is the process of protecting data from threats, vulnerabilities, and unauthorized access by implementing organizational measures (such as incident response plans, security training, and firewalls), technical controls (such as encryption, intrusion detection systems, and firewalls), and compliance frameworks (such as ISO 27001, NIST Cybersecurity Framework). It also include ongoing security practice improvement, audits, and monitoring. #It # Network # Management # data privacy # data security Get Connect - https://lnkd.in/dgRH58_W

2

We are excited to share the release of “Ehmann / Selmayr General Data Protection Regulation: GDPR," co-authored by CMS Lawyer Anna Horváth, published by C.H.Beck. The new edition covers the extensive case law of the ECJ on the GDPR and addresses the perspective of upcoming decisions. The documents of the European Data Protection Board (EDPB) have been taken into account intensively. The commentary takes independent positions on the numerous controversial issues under European law on the basis of methods of interpretation under European law. Read more here: CMS CEE #cmslaw #GDPR #EDPB 

28

1 Kommentar

‘Europrivacy™/® – The first European Data Protection Seal’ by Alice Turley. 📘 This guide introduces the following key elements of Europrivacy: ✅Preparing for certification. ✅The certification criteria. ✅The GDPR core criteria. ✅Complementary contextual checks and controls. ✅Technical and organisational checks and controls . ✅National requirements. ✅The certification process. Find out more and purchase your copy today👇 https://ow.ly/J86z50SzByL #book #europrivacy #dataprotection

6

A DPA review in 5 minutes? 🤔 Data privacy lawyers often spend hours pouring over agreements such as DPAs. With SpringLaw Wizards, now you can create a DPA reviewer using #naturallanguage and your firm’s best practices, meaning your next DPA review will take just 5 minutes 🔎 𝐁𝐮𝐭 𝐡𝐞𝐫𝐞’𝐬 𝐭𝐡𝐞 𝐫𝐞𝐚𝐥 𝐠𝐚𝐦𝐞 𝐜𝐡𝐚𝐧𝐠𝐞𝐫: 𝐲𝐨𝐮 𝐜𝐚𝐧 𝐭𝐮𝐫𝐧 𝐭𝐡𝐢𝐬 𝐢𝐧𝐭𝐨 𝐚 𝐜𝐥𝐢𝐞𝐧𝐭 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧 🤯 Say you have ten clients, each with differing needs. Once you’ve built your initial DPA review assistant, you can clone it, configure them and make each one hyper-specific to each client ✅ 𝐀𝐧𝐝 𝐣𝐮𝐬𝐭 𝐥𝐢𝐤𝐞 𝐭𝐡𝐚𝐭: 𝐲𝐨𝐮’𝐯𝐞 𝐜𝐫𝐞𝐚𝐭𝐞𝐝 𝟏𝟎 𝐜𝐥𝐢𝐞𝐧𝐭-𝐬𝐩𝐞𝐜𝐢𝐟𝐢𝐜 𝐫𝐞𝐯𝐢𝐞𝐰 𝐭𝐨𝐨𝐥𝐬💥 Watch Ed build, clone and customise the DPA Review assistant below ⬇️ Did you know that you can create ANY specialised Agreement Reviewer with SpringLaw Wizards? 🧙 We’ll be sharing regular examples over the coming weeks, follow along to see more! 👉 Join our waitlist today and get your first Agreement Reviewer implemented for free: www.springbok.ai - 👋 𝐒𝐩𝐫𝐢𝐧𝐠𝐋𝐚𝐰 𝐞𝐧𝐚𝐛𝐥𝐞𝐬 𝐲𝐨𝐮𝐫 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐞𝐬 𝐭𝐨 𝐭𝐫𝐚𝐧𝐬𝐟𝐨𝐫𝐦 𝐲𝐨𝐮𝐫 𝐤𝐧𝐨𝐰𝐥𝐞𝐝𝐠𝐞 𝐢𝐧𝐭𝐨 𝐩𝐨𝐰𝐞𝐫𝐟𝐮𝐥 𝐭𝐨𝐨𝐥𝐬 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲𝐝𝐚𝐲 𝐰𝐨𝐫𝐤𝐟𝐥𝐨𝐰𝐬 𝐚𝐧𝐝 𝐜𝐥𝐢𝐞𝐧𝐭-𝐟𝐨𝐜𝐮𝐬𝐞𝐝 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 – 𝐰𝐢𝐭𝐡𝐨𝐮𝐭 𝐧𝐞𝐞𝐝𝐢𝐧𝐠 𝐭𝐨 𝐜𝐨𝐝𝐞. #LegalTech #ContractReview #MakeGenAIWorkForYou

16

8 Kommentare

SPOTLIGHT on... CJEU Decision Raises the Bar for GDPR Compensation Claims for Identity Theft. The Court of Justice of the European Union (“CJEU”) in joined cases C‑182/22 and C‑189/22, Scalable Capital, has provided some further clarification regarding compensation for non-material damage under Article 82(1) of the GDPR as a result of the theft by third parties of personal data. The decision reflects a high threshold for claiming non-material damages in respect of “identity theft”. According to the CJEU, compensation for non-material damage based on an allegation of “identity theft” requires that a third party has actually misused the identity of a person whose personal data has been compromised. The CJEU held that the theft of personal data does not, in itself, constitute compensable “identity theft”. However, the CJEU further ruled that compensation for non-material damage cannot be limited to cases where the theft of one’s data subsequently gave rise to “identify theft”. Rather a data subject is entitled to compensation for any loss of control or theft of their data (whether or not it is subsequently misused and constitutes “identity theft”), under Article 82(1) GDPR, if the three conditions laid down in that provision apply, namely the personal data is processed in breach of the GDPR, damage is suffered by the data subject, and there is a causal link between that unlawful processing and that damage (as per the CJEU decision in the Austrian Post case). #gdpr #dataprotection #caselaw #databreach #compensation https://lnkd.in/ezzFUVqt

1

1 Kommentar