Digibeetle

🥇A first: a case where the Court is invited to interpret an important derogation from the data controller's obligation to provide information, namely when this topic is regulated in EU or national law (see: Article 14(5)(c) #GDPR). Advocate General Medina gives her opinion: 📂CJEU Másdi [C-169/23] case from 🇭🇺 🦠️So what happened: a person called "UC" received a COVID-19 certificate of immunity from the Budapest Office. Remember those? Such certificates confirmed vaccinations against COVID‑19. UC has GDPR related problems with this, most notably issues related to the information obligations of Article 14 GDPR. UC alleged that the Budapest Office did not publish a privacy notice where he could learn about the processing activities. 📋The Budapest Office said it was not required to provide information on processing. Still, according to the Office, it did publish a privacy notice on its website. The case goes to the Hungarian DPA (or "SA", as we have to call it), and the regulator agrees with the Budapest Office: Article 14(5)(c) of the GDPR applies, because this topic has sufficiently been covered by national law (so-called "Decree 60/2021"). 🏛The case goes to court, and the referring court has doubts how to interpret Article 14(5)(c) -- because certain data contained in the COVID‑19 certificates were not obtained by another organisation but were generated by the Budapest Office. The referring court is also unsure about the Hungarian DPA's powers (Article 77 GDPR) in this matter. 👩⚖️After a careful investigation of Article 14(5)(c) GDPR (and reminding us of the "Bara" case), the A-G comes to a sensible conclusion: this derogation applies to all data which the controller has not obtained from the data subject. According to Ms Medina, it is not relevant whether the data are expressly obtained from another entity or if the data are generated by the controller in its own procedure. ✅In our view, this makes sense. Otherwise it can become unclear which data will are covered by the derogation -- hindering the data subject's right to know what is going on with his data (our words). The Court will probably follow Medina's opinion. 💡Regarding Article 77 GDPR, the A-G opines in favour of the Supervisory Authorities (SA's) and the scope of their powers: 'in the context of a complaint procedure, the SA has the power to examine whether all the conditions laid down in Article 14(5)(c) GDPR are complied with. [It] has the power to examine the question whether Member State law, to which the controller is subject, provides appropriate measures to protect the data subject’s legitimate interests.' The Court will follow this as well, we predict, given the case-law trend that sides with SA and their wish to enforce the GDPR in a powerful manner. Be sure to check out our website 𝐃𝐢𝐠𝐢𝐛𝐞𝐞𝐭𝐥𝐞-𝐞𝐮 to learn about all CJEU case-law regarding Article 14 GDPR or SA's powers.   🔎You know what the link is :-)

German courts add their 9th pending data protection case to CJEU's registry: 📂CJEU NTH Haustechnik [C-484/24] Lodged on the 10th of July. What is it about, dear German data protection friends? 🇩🇪 Christopher Schmidt, FIP CIPP/E CIPM CIPT CDPO/BR Dr. Markus Wünschelbaum

Awesome! A case from 🇱🇻! But what is it about? 📂CJEU Čiekuri-Shishki [C-480/24] Lodged by the Augstākā tiesa (Senāts) on 9 July 2024. Perhaps one of our Latvian friends know? Liene L Martins Dambergs Dāvis Bludiņš? Thanks in advance! 🙏

A question for our Austrian friends. 🇦🇹 Do you have info on this data protection case from the Landesgericht St. Pölten? It's called "Netz Niederösterreicht". 📂 CJEU case number: C-468/24. Sounds like a telecom company, perhaps? Lodged with the CJEU at 3 July 2024, so the referring decision must be somewhere before that date. Adi Zemann Thomas Schweiger do you have an idea? 💡

Remember how the first GDPR and Sports case called "Nada and Others" ended with a dismissal? Time for Part 2! ✌️ It was such a shame, because the case raises interesting questions about the publication of athletes' personal data regarding their doping use. Is such publication allowed? Are these criminal offence data and/or health data? 🚴♀️🚴♀️🚴♀️🚴♀️🚴♀️🚴♀️ Luckily, the Austrian Bundesverwaltungsgericht is the entity that asks the questions *this* time, not the Sports Committee (which is not a "court" in the sense of EU law, and is therefore not allowed to ask preliminary questions to the CJEU). 🤽♂️🤽♂️🤽♂️🤽♂️🤽♂️🤽♂️ This means we will probably see answers on this important matter somewhere in 2 years! It will take some time, but this case is worth while following. We will do that for you! 📂Case C-474/24 - NADA Austria and Others 🇦🇹 Thanks to Adi Zemann and Thomas Schweiger for flagging us this case!

If you spot our CEO at #TILTing2024, please come and say hi! 👋

We can crack this code! 🇦🇹 What is this case about, dear Austrian friends? 📂CJEU DocFinder and Others [C-414/24] Referring court: Verwaltungsgericht 🏛 👩⚕️Our gut feeling says it has to do with negative reviews of doctors on DocFinder. What about you? cc Konstantin Peel Kubra Islamoglu Bayer, LL.M. Heidi Scheichenbauer Lisa Hoffelner Thomas Schweiger

🏆The judgments in cases number 7 and 8 about the Right to Compensation (article 82 #GDPR) saw the daylight today: ✅CJEU Scalable Capital [C-182/22 and C-189/22]       ✅CJEU PS - Incorrect address [C-590/22]      Still, we have 6 cases pending on this subject (including 1 General Court case). 🕵️ And... according to our intel a new right to compensation is coming up from The Netherlands 🇳🇱 Stay tuned! Cc Luis Alberto Montezuma

This morning, in Case C-383/23 ILVA, the 5th Chamber of the #CJEU will hear the parties in a case concerning the calculation of administrative fines imposed for breaches of the GDPR. In particular, the Danish court asks the following questions: (i) whether the term ‘undertaking’ in Article 83 GDPR has the same meaning as in EU competition law, so that it covers any entity engaged in an economic activity, regardless of its legal status and the way in which it is financed; (ii) in the affirmative, whether Article 83 GDPR requires the amount of the fine to calculated based on the total worldwide annual turnover of the undertaking of which the infringing legal person forms part, or based only on the annual turnover of that legal person. If you want to know more about the questions asked by the referring court, you can put the case number in the case law search form on https://curia.europa.eu and check the list of documents. #dataprivacy #ecpc #gdpr #dataprotection #privacy #personaldata

⚡️Done! This is what they call a "lightning visit": I just gave my presentation to the attendees of the #VPR-A Symposium in Leiden. Location: the Old Observatory in Leiden (beautiful, see photo!*) Now, I'm off by train to the Antwerp, where I will attend ECTA's #AI & Data Committee meeting with Delia Belciu Patrick Wheeler and others. I talked about: ✅ Some factoids about the EU Court of Justice (Germany is still the country that asks the most data protection related questions, followed by Bulgaria and Austria). ✅ The most important #GDPR judgments from June 2023 until now. See the Court's take on that subject here: https://lnkd.in/ez36GYHC ✅ Interesting GDPR pending cases, including the freshest case from Sweden about body cams and Article 13/14 GDPR ('information obligations'). See Andreea Lisievici's post: https://lnkd.in/eebSnd5Z ✅ Reading and watching tips, including the "How to read CJEU judgments" article of Frederik Zuiderveen Borgesius Jasper Krommendijk https://lnkd.in/ejcTVusz and the 2023 case-law overview from Gloria González Fuster and Bart v/d Sloot, and others. Link: https://lnkd.in/eBBvsZn6 Thank you all for listening, and have a great symposium day! 👋 Photo credits: AWossink, https://lnkd.in/e3yAFuZW