Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestEuropean Data Protection Day on 28 January commemorates the signing of the first pan-European data protection framework (Convention108) in 1981. Today, 42 years later, the GDPR is…
The Spanish Courts annulled a past decision by the Spanish DPA (AEPD). The AEPD had previously argued that Virgin telco, a telecommunications provider, had lawfully denied its…
Cookie Banners A task force within the European Data Protection Board (EDPB) issued a draft report in reaction to noyb's 700+ cookie banner complaints. The European Data…
WhatsApp faces € 5.5 million fine, as DPC limits the scope of the case against WhatsApp and rejects the EDPB request to investigate matters like data sharing within Meta. As…
Forced Consent & Consent Bypass Irish Data Protection Authority gives € 3.97 billion present to Meta? Authority allegedly unable to take financial benefit from Meta's GDPR…
Forced Consent & Consent Bypass The Irish DPC issued its final decision on Meta's illegal processing of user data for personal advertising. Here is a download link and a first…
Forced Consent & Consent Bypass BREAKING: Meta (Facebook and Instagram) prohibited from using personal data for advertisement. Major blow to Meta's business model in Europe,…
Data Transfers Statement on US Adequacy Decision by the European Commission Today, the European Commission issued a new adequacy decision replacing the"Privacy Shield" decision,…
Forced Consent & Consent Bypass noyb complaints: Meta's business model declared illegal in the EU according to WSJ. Facebook, Instagram and WhatsApp can no longer run personalized…
Since May 2018, the GDPR has been directly applicable in the European Economic Area, including the member states of the European Union, Liechtenstein, Norway, and Iceland. Four…
Forced Consent & Consent Bypass GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have…
The Spanish data protection authority, the Agencia Española de Protección de Datos, has developed a tool to help organizations determine whether they need to notify a data…
> Spain’s data protection authority, the Agencia Española de Protección de Datos, created a tool designed to help organizations determine whether to notify a data protection…
The purpose limitation principle does not preclude a controller from capturing and storing in a test database established for testing and error correction purposes personal data…
Algorithmic decision-making is having an increasing impact on people’s daily lives. Since such autonomous systems can cause serious harm to individuals and social groups, concerns…
> Algorithmic decision-making increasingly shapes people's daily lives. Given that such autonomous systems can cause severe harm to individuals and social groups, fairness…
In the case 'Vyriausioji Tarnybinės Etikos Komisija', the Court of Justice of the European Union (CJEU) established that the name of the spouse, life partner, or partner of a…
In 'Vyriausioji Tarnybinės Etikos Komisija' the CJEU held that the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions (indirectly…
The Danish Data Protection Authority (DPA) found that the law firm did not have the necessary security measures in place, especially given that the firm handled special categories…
The Digital Services Act was published in the Official Journal of the European Union on October 27. The DSA, which harmonizes the conditions for the provision of intermediary…
> The Digital Services Act was published in the Official Journal of the European Union Oct. 27. The DSA, which harmonizes conditions for the provision of intermediary services and…
Automated personalization in consumer insurance contracts is not yet a reality in Europe, but mass customization and robotization of insurance contracts are a growing problem,…
This article discusses the importance of privacy in the context of the recent Supreme Court ruling on abortion in the United States. The ruling has led to the potential for…
Automated personalization in consumer insurance contracts is not yet a reality in Europe, but the mass customization and automation of insurance contracts are becoming an…
Cookie Banners Where did all the “reject” buttons come from?! More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where…
GreenbergTraurig has assessed the scope of the US CLOUD Act on commission by the Dutch government. The CLOUD Act applies to EU entities that process data outside of the US, even…
There is a broad consensus that algorithmic systems should primarily be approached from the perspective of indirect discrimination and their impact, but researchers argue that…
There is a broad consensus that algorithmic systems should be approached principally through the lens of indirect discrimination and their impact, but researchers argue that this…
At the request of the Dutch government, GreenbergTraurig assessed the scope of the U.S. CLOUD Act. The CLOUD Act applies to EU organizations that process data outside the United…
> The Garante notes that the European legislation on the protection of personal data does not in principle preclude the owner of a site from making access to content by users…
The law can play an important role in ensuring trust in organizations that use news personalization. Measures for oversight and transparency are crucial to ensuring that…
Law can play an important role in safeguarding trust in organisations that use news personalisation. Control and transparency measures are crucial to enabling individuals to trust…
The Garante (the Italian Data Protection Authority) notes that European data protection legislation does not, in principle, prevent a website owner from making access to content…
An overview of the fine imposed on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings
Cookie Banners Two are better than one?! Profil.at strikes back with forced banner, when users make the "wrong" choice. Today, noyb.eu filed a GDPR complaint against the Austrian…
A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings
> On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on…
There is a significant discrepancy between the legal and ethical rules for governance and the daily practice of professionals in the public sector working with data. These…
There is a wide gap between legal and ethical governance rules and the everyday practices of public sector data professionals. Frameworks are integrated implicitly, subtly…
According to Article 14 of the Standard Contractual Clauses (SCCs) for data exchange, the party importing the data must conduct a risk assessment to verify whether the laws,…
Under Clause 14 of the Data Transfer SCCs, the data importer must carry out a transfer risk assessment to verify whether the laws and practices of the receiving third country…
On October 14, 2022, the Federal Trade Commission announced that the deadline for submitting comments on its preliminary proposal for regulation regarding commercial surveillance…
The Commission has enthusiastically supported a recent US decision to implement a new framework for the protection of the privacy of personal data exchanged between the US and…
The Commission has endorsed enthusiastically a recent US order to implement a new framework to protect the privacy of personal data shared between the US and Europe. Dick Roche…
Hardly noticed by the general public, the Advocate General (AG) of the Court of Justice of the European Union (CJEU) has issued an opinion, aiming to limit one of the last…
The concept of proportionality is at the very core of the modern understanding of human rights. Proportionality is, first and foremost, a condition for the limitation of a…
The Advocate General of the Court of Justice of the European Union (CJEU) has issued a non-binding opinion that has privacy advocates concerned, as it could further limit users’…
Legal Analysis: No non-material damages for GDPR violations (C-300/21)? By Max Schrems | Download the PDF Version of this Legal Analysis On 6 October 2022, Advocate General (AG)…
The GDPR risk assessment is intended to help controllers and processors identify the risk factors affecting the rights and freedoms of data subjects whose data is being processed.…
> GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the…
Machine learning can be used to optimize sales practices in consumer markets, but it also raises concerns about manipulation. According to this article, in order to mitigate these…
Self-sovereign identity is a technology in the early stages of development, and its benefits for refugees remain uncertain. While it may give them greater autonomy, it also risks…
Self-sovereign identity is an embryonic technology with uncertain benefits for refugees. It may help to empower them, but it also risks reinforcing the power of states and…
Proposals regarding data ownership are misplaced and would be counterproductive if implemented. Instead, reform of privacy laws should focus on strengthening existing restrictions…
Data ownership proposals are misguided and would be self-defeating if implemented. Instead, privacy law reform should focus on strengthening ongoing use restrictions over personal…
Machine learning can be used to optimize sales strategies in the consumer market, but it also raises concerns about manipulation. According to this article, it is important to…
Data protection authorities (DPAs) are independent bodies responsible for the consistent application of the GDPR, and they are required to facilitate the filing of complaints.…
DPAs are independent authorities entrusted with the consistent application of the GDPR, and are obliged to facilitate the submission of complaints. However, according to this…
> Legally, until an adequacy determination is granted, companies should continue to follow the European Data Protection Board’s recommendations on measures that supplement…
From a legal standpoint, until an adequacy determination has been issued, companies must continue to follow the recommendations of the European Data Protection Board (EDPB)…
Data Transfers We are now working on an in-depth analysis, which will be published on noyb.eu in the next days. First reaction: Executive Order on US Surveillance unlikely to…
The European Digital Rights (EDRi) network has published a position paper on the proposed European regulatory framework for automated data exchange to promote cooperation among…
> Privacy protection is not absolute. In fact, this is stated explicitly in privacy legislation. The GDPR therefore includes various exceptions. One of the exceptions that appears…
This article examines the installation and configuration process for consent pop-ups, as well as their potential implications for website publishers’ decision-making. It finds…
This paper studies the installation and configuration process of consent pop-ups and their potential effects on website publishers' decision making. It finds that Consent…
The European Digital Rights (EDRi) network published a position paper on the proposed Regulation on automated data exchange for police cooperation, known as “Prüm II”. This…
Mr. Depoorter realized that he could develop an automated way to combine these publicly available camera feeds with the photos people had posted on Instagram. Over the course of…
> Mr. Depoorter realized that he could come up with an automated way to combine these publicly available cameras with the photos that people had posted on Instagram. So, over a…
The 405 million euro fine imposed on Meta by the Irish Data Protection Authority marks a “crucial moment” in the enforcement of the European General Data Protection Regulation…
The U.K. Information Commissioner's Office has reprimanded seven government and private organizations and issued recommendations regarding their practices for failing to respond…
> The Irish Data Protection Commission’s 405 million euro fine against Meta represents a “watershed moment” in EU General Data Protection Regulation enforcement, write Bird &…
> The U.K. Information Commissioner’s Office issued reprimands and practice recommendations for seven public and private entities for failure to respond to subject access…
The Data Protection Authority (DPA) emphasized that simply entering into a data processing agreement that includes security requirements is not sufficient. The controller must…
The Data Protection Authority (DPA) of Lower Saxony has fined a bank 900,000 euros for creating customer profiles—supplemented with third-party data—for advertising purposes…
The Belgian Data Protection Authority (SA) has ruled that a data controller may rely on a legitimate interest as the legal basis for sending direct marketing to former customers,…
The Belgian Data Protection Authority (SA) has ruled that discussing an employee’s personal health information during a meeting in which she was not present, and subsequently…
The Icelandic Data Protection Authority (SA) has determined that a conflict of interest exists when a Data Protection Officer (DPO) also serves as a senior legal counsel, deputy…
The Spanish Data Protection Authority (SA) has fined an individual 10,000 euros for publishing a third party’s personal data on an online blog without that person’s consent.…
Finally, the data protection authority ruled that the controller’s decision to involve the data protection officer (DPO) in the defense during legal proceedings placed the DPO in…
The Danish Data Protection Authority (DPA) has temporarily suspended its processing ban against the municipality of Helsingør, regarding the use of Google Chromebooks and…
The European Commission has adopted a proposal to harmonize the rules regarding consumer compensation in the Directive on Liability for Artificial Intelligence. The proposed rules…
The French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), has developed a checklist for organizations that store health data. This…
> France’s data protection authority, the Commission nationale de l'informatique et des libertés, created a compliance checklist for controllers operating health data warehouses.…
> The European Commission adopted a proposal for harmonizing rules around consumer redress in the Artificial Intelligence Liability Directive. The proposed rules will allow…
The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute…
> * We propose a framework for defining different types of explanations for AI systems. > * We situate current discussions on "Explainable AI" (XAI) within this proposed…
> * We propose a framework for defining different types of explanations of AI systems. > * We contextualize current XAI discourses within the proposed framework. > * We highlight…
The CLOUD Act agreements between the US and UK will likely improve the digital privacy rights of US and UK citizens, but they will further undermine these rights for Third Country…
The CLOUD agreements between the U.S. and the United Kingdom are likely to improve the digital privacy rights of U.S. and U.K. citizens, but they will further erode these rights…
> Registering the target's license plate in parking apps and enabling license plate recognition (ANPR). I could add as many plates as I wanted. Doesn't matter if they already used…
The UK Information Commissioner's Office has announced that TikTok will be fined 27 million pounds for alleged violations of UK data protection laws. The ICO’s investigation…
> The U.K. Information Commissioner's Office announced a notice of intent to fine TikTok 27 million GBP for alleged U.K. data protection violations. The ICO's investigation found…
Data Transfers Half a year of political announcements, but no agreement on EU-US data transfers. On 25 March 2022, in the wake of the war on Ukraine, US-President Joe Biden and…
The Berlin Commissioner for Data Protection and Freedom of Information has imposed a fine of 525,000 euros on a Berlin-based retailer for violating the requirements regarding the…
> The Berlin Commissioner for Data Protection and Freedom of Information issued a 525,000 euro fine to a Berlin-based retailer for violation of data protection officer…
The Danish Data Protection Agency has conducted an investigation into the Google Analytics tool and its settings, as well as the terms under which the tool is offered. Based on…
The Danish Data Protection Agency has looked into the tool Google Analytics and its settings, and the terms under which the tool is provided. On the basis of this review, the…
> The EU has identified artificial intelligence (AI) as one of the most relevant technologies of the 21st century and highlighted 1 its importance on the strategy for EU’s digital…
The European Union has identified artificial intelligence (AI) as one of the most significant technologies of the 21st century and emphasizes 1 its importance in the EU’s digital…
The Office of the UN High Commissioner for Human Rights has published a report describing how “modern, interconnected digital technologies” threaten individuals’ privacy. The…
> The United Nations Office for the High Commissioner of Human Rights issued a report detailing how “modern networked digital technologies” threaten individuals’ privacy. The…
The European Data Protection Supervisor ordered Europol to hand over personal data to Dutch activist Frank van der Linde. The decision is the result of a two-year investigation…
Following the binding decision by the European Data Protection Board (EDPB) on July 28, the Irish Data Protection Authority (DPA) adopted its decision regarding Instagram (Meta…
> Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms…
The European Data Protection Supervisor has ordered Europol to transfer personal data to Dutch activist Frank van der Linde. This decision is the result of a two-year…
The EDPB has adopted a statement on the European Commission’s proposal for an EU Code on Police Cooperation. The purpose of this proposal is to improve law enforcement cooperation…
The EDPB adopted a statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member…
"We are deeply concerned that, unless it is significantly increased, the 2023 budget will be far too small to enable the EDPB and the EDPS to carry out their duties adequately,"…
> “We are deeply concerned that the 2023 budget, if not substantially increased, will be significantly too small to allow the EDPB and the EDPS to fulfil their tasks…
The fine is the result of an investigation that began in 2020 and focused on how the company processed children’s personal data. Based on media reports, the investigation focused…
> The fine is the result of an investigation that began in 2020 and focused on the company’s processing of children’s personal data. Based on press reports, the investigation…
The current version of the bill aims to preserve most of the key principles underlying the UK’s data protection framework, while at the same time amending certain key provisions…
> The current version of the Bill seeks to maintain the majority of key principles that underpin the UK data protection law framework, while at the same time modifying certain key…
Today, noyb.eu filed a complaint against Google with the French Data Protection Authority (CNIL). The tech giant has repeatedly ignored the European Court of Justice (CJEU) ruling…
"Based on the facts of the case, we do not see how [Meta] could have continued its transfer of personal data after the ruling in the Schrems II case if it had complied with the…
> “Based on the facts of the case, we do not see how [Meta] could have continued its personal data transfers following the Schrems II judgment had it acted in accordance with the…
This article argues that viewing the negative consequences of artificial intelligence as risks is a deliberate choice with consequences. Risk management presents its own specific…