European Data Protection Board Research Articles

Article: AI, Facial Recognition, and Policing: Business Opportunities and Legal Challenges: A UK Analysis with Glimpses of EU Law

It is a well-known fact that the health emergency caused an unprecedented surge in both information technology (IT) and digitalization. Not only did the virus spread, but technological advancement was also taking place: tracking ill people allowed for a semblance of normal social life to continue, despite the pandemic lockdown. One of the main consequences of the pandemic was the implementation of a large-scale video-surveillance system. This article examines, from a legal perspective, the relationship between video-surveillance activity and citizens’ rights, and attempts to balance the two sides of the same coin through a comparative analysis. To this end, reference is made to the UK case law and the controversy resolved by the European Court of Human Rights (ECtHR). Finally, an empirical approach on this matter is provided by the recent guidelines adopted by the European Data Protection Board (EDPB) and the EU Artificial Intelligence Act (AI Act). Artificial Intelligence, AI, Video-Surveillance, Automated Facial Recognition, Technology, Human Rights, Privacy, Policing, Rule of Law

Joint controllers in large research consortia: a funnel model to distinguish controllers in the sense of the GDPR from other partners in the consortium

Large European research consortia in the health sciences face challenges regarding the governance of personal data collected, generated and/or shared during their collective research. A controller in the sense of the GDPR is the entity which decides about purposes and means of the data processing. Case law of the Court of Justice of the European Union (CJEU) and Guidelines of the European Data Protection Board (EDPB) indicate that all partners in the consortium would be joint controllers. This paper summarises the case law, the Guidelines and literature on joint controllership, gives a brief account of a webinar organised on the issue by Lygature and the MLC Foundation. Participants at the webinar agreed in large majority that it would be extreme if all partners in the consortium would become joint controllers. There was less agreement how to disentangle partners who are controllers of a study from those who are not. In order to disentangle responsibilities, we propose a funnel model with consecutive steps acting as sieves in the funnel. It differentiates between two types of partners: all partners who are involved in shaping the project as a whole versus those specific partners who are more closely involved in a sub-study following from the DoA i or the use of the data Platform. If the role of the partner would be comparable to that of an outside advisor, that partner would not be a data controller even though the partner is part of the consortium. We propose further nuances for the disentanglement which takes place in various steps. Uncertainty about formal controllership under the GDPR can stifle collaboration in consortia due to concerns over (shared) responsibility and liability. Data subjects’ ability to exercise their right can also be affected by this. The funnel model proposes a way out of this conundrum.

Personal Data as Consideration

This article argues that personal data may have a commercial value in the European legal systems, and as such it can function as a consideration and has a quid pro quo character. It claims that the European Data Protection Board (EDPB) should not exclude that data concerning the data subject can be used as contractual consideration, especially in the world of the Internet. In particular, it cannot be excluded solely on the basis that the right to privacy is not transferable, a position taken thus far in the EDPB’s practice. This proposed new approach is supported by the fact that in some EU Member States the property aspects of the general right of personality have been recognized, a stance which may also apply to personal data, without the need to recognize a kind of data ownership or sui generis intellectual property right in the data. Thus, the theory of commercial aspects of personality rights can be linked to the commercial value of personal data. The quid pro quo function of personal data may also be recognized in line with the provisions of the General Data Protection Regulation (GDPR). In fact, maintaining the interpretation of the EDPB – which denies the quid pro quo character of personal data from a fundamental rights perspective – means that the dangers of such data processing cannot be assessed. This affects cultural heritage in many aspects – from the sending of newsletters to selling merchandise products in museums. The EDPB’s guidelines, as soft law, have no direct impact on the case-law of the national courts, thus this also significantly increases the risk of a collision between the simultaneously available remedy regimes established by the GDPR.

Procedural Challenges of Cross-border Cooperation and Consistency in Personal Data Protection in the EU

Abstract Data protection is an increasingly important topic in the European administrative field at national and cross-border levels. Such a trend reflects different phenomena in contemporary society, which further leads to a more focused concern for a harmonised elaboration by the Member States despite their autonomy, in principle, regarding EU law implementation. However, as revealed by the Slovenian case in this article, the European Data Protection Board and national supervising authorities, mostly information commissioners, express the need to regulate some issues more decidedly. Interestingly, yet not surprisingly, their focus is on procedural aspects, as according to administrative science and several European Commission documents, procedure strongly influences the results. As a result, the article elaborates on the relevant procedural issues to be addressed to ensure a harmonised enforcement of the General Data Protection Regulation (GDPR) in force since 2018. Various research methods are employed, combining qualitative, normative, and comparative analyses and quantitative approaches, emphasising statistical data obtained from annual reports for 2020, 2021, and 2022. The results show a lack of procedural provisions in several aspects, including the definition of the parties to the procedure and their defence rights, particularly access to the file, to be heard, and complain, as well as one-stop-shop access to legal protection, deadlines, and investigation powers. Such gaps are expected to be covered by procedural institutions enshrined in National Administrative Procedure Acts (APA). However, as suggested by the Slovenian experience, such a solution is minimal due to differing national regulations and relatively low awareness of APA relevance in data protection even among supervising authorities. Hence, the authors argue that there is a need to develop and adopt standard EU rules to regulate such issues. Points for Practitioners The article refers to data protection within theoretical, normative, practical, comparative, and national dimensions. In addition to analysing statistical data regarding procedural issues of cross-collaborative application of GDPR in the Member States - primarily Slovenia - the article provides practical implications of legislative, organisational, and IT adaptations required for harmonising EU-wide enforcement of GDPR. The insights provided herein can support the development of similar solutions in other EU countries. Therefore, the research findings are relevant for practitioners from various European administrations who are in charge of implementing GDPR and, specifically, supervising its implementation, as well as for policymakers and legislators in their respective areas of data protection and administrative procedural law. The findings will also benefit the European Commission when drafting new legislation to enhance cooperation and consistency between Member States in enforcing personal data rights set by GDPR.

Certification as guidance for data protection by design

ABSTRACT Data protection by design is an obligation for data controllers according to article 25(1) of the General Data Protection Regulation (GDPR). The present paper explores the concept of data protection by design and proposes that data protection certificates can offer guidance to data controllers, about compliance with this GDPR obligation. An exploration of officially approved certification schemes shows that the certification requirements may lay down concrete use cases which can guide data controllers about compliance with the obligation of data protection by design. Even though these policies are not a comprehensive guide for data protection by design, they lay down valuable solutions with respect to effective compliance. Moreover, the data protection measures of compliance in certification criteria have been approved by the competent Data Protection Authority and possibly the European Data Protection Board. As the present paper argues, the official approval by the competent authorities creates legitimate expectations under European Union Law. Specifically, data controllers can legitimately expect that abidance by approved safeguards meets the expectations of the authorities that are entrusted with monitoring their compliance. For these reasons, certification though an ex post mechanism, can offer valuable ex ante guidance.

The one-stop-shop and the European Data Protection Board’s role in combatting data supervision forum shopping

The one-stop-shop and the European Data Protection Board’s role in combatting data supervision forum shopping

EU: No direct actions for annulment against binding decisions of the European Data Protection Board

EU: No direct actions for annulment against binding decisions of the European Data Protection Board

슈렘스 Ⅱ결정 후 유럽데이터보호위원회(EDPB) 권고에 대한 평가 - GDPR의 위험기반접근을 중심으로 -

본 논문은 개인정보처리의 적정성 평가를 위험기반접근법을 통하여 분석하였다. 슈렘스Ⅰ판결, 슈렘스Ⅱ판결의 후속 조치로서 유럽데이터보호위원회의 권고에 이르기까지 개인정보의 역외 이전의 규율방식은 개인정보처리자에게 과도한 부담을 지우는 방식으로 전개되고 있다.BR 이러한 경향은 ‘적정한 처리’에 대한 해석에 관한 논의와 더불어 개인정보자기결정권의 보호영역의 본질로서 사생활 침해의 ‘위험’이라는 측면에서 권리의 내재적 한계와 연결되는 것이다. 즉 ‘적정한 처리’와 ‘위험’의 의미로부터 개인정보보호의 규율은 사례 중심적 접근이 요구된다고 할 것이다.BR 미국과 유럽의 데이터 보호 협정은 슈렘스 판결에서 무효화되었다. 이는 데이터 이전 대상국가의 개인정보보호 수준의 적정성 평가와 관련된 중요한 판결이었다. 이로 인하여 데이터 역외 이전은 GDPR 제46조의 근거에 따른 표준데이터보호계약에 의한 이전만 가능하게 되었다. 슈렘스 판결이후 유럽데이터보호위원회는 추가 조치를 내용으로 하는 권고를 제시하고, 이는 데이터 처리자에게 과도한 책임을 지우는 것으로 경직된 규율로 평가된다.BR GDPR은 개인정보의 보호밀도에 따른 비례적인 개인정보처리와 아울러 위험기반의 적정성 평가 요소를 동시에 가지고 있다. 유럽데이터보호위원회 권고는 제로리스크에 가까운 추가조치로서 데이터 이용을 과도하게 제한하는 결과를 초래한다.

Protecting EU data outside EU borders under the GDPR

The EU General Data Protection Regulation (GDPR) aims to protect personal data outside EU borders by its rules on territorial scope and its restrictions on international data transfers. Despite its importance in EU fundamental rights law, the purpose and interaction of the GDPR’s protections of cross-border data processing have long been shrouded in confusion. Initiatives of EU bodies to interpret the GDPR’s safeguards illustrate the need for EU law to demonstrate clarity and consistency in defending fundamental rights outside EU borders. Only by maintaining the high level of protection required by the GDPR and the Court of Justice, can the EU’s ambitions of cross-border data protection be realized and the GDPR’s influence in third countries be maintained. data protection, GDPR, territorial scope, international data transfers, Court of Justice, European Commission, European Data Protection Board

Brak kodeksu branżowego w systemie ochrony zdrowia a ochrona danych osobowych pacjenta

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) shall concern all those who process personal data of natural persons with regard to their professional, commercial and statutory activities. It was addressed to many industries, and as it is well known each industry is different, running an online store cannot be compared with the provision of health care or treatment. The Member States, the supervisory authorities, the European Data Protection Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation. The code of conduct is to provide the minimum requirements related to the protection of personal data in health care facilities that must be met in order to demonstrate compliance with the GDPR. The purpose of the code is, inter alia, the collection of the personal data, fulfilling the obligation to inform and the use of technical means to prevent personal data breach. Almost four years have passed since the application of the GDPR regulations and no code of conduct has been adopted for application, including the health protection. The GDPR applied without proper interpretation would make it impossible to conduct medical treatment which involve sensitive data processing. In the current legal situation is a patient provided with adequate protection?

Your genetic data is my genetic data: Unveiling another enforcement issue of the GDPR

The General Data Protection Regulation aims to protect data subjects by granting them control over their data. The shared nature of genetic data causes significant challenges in this framework by posing the question of whether the donor's biological family members can also be considered data subjects or not. In this respect, we have examined both scenarios and concluded that biological family members could indeed be considered in the scope of the data protection framework. However, we highlighted certain shortcomings attached to this interpretation, especially when biological family members exercise their data subject rights. Hence, we explored potential conflicts that might arise when biological family members exercise their right to information, right to access, right to erasure and right to restriction of processing. As a practical solution to this pressing problem, we called on the European Data Protection Board to revisit the 2004 Working Document on Genetic Data in order to develop principles to be applied when solving such conflicts and thus provide certainty and clarity to genetic data processing.

Regulating Creativity Online: Proposal for an EU Copyright Institution

Abstract In 2019, the EU adopted a new copyright directive aiming to modernise the legal rules established in the 2001 InfoSoc Directive, as well as promote a better functioning ‘digital single market’ for the exploitation of creative works and other protected subject matter. However, after extensive negotiations and compromises reached at the legislative level, the ongoing implementation of the directive into national law seems to have deepened existing regulatory differences between Member States. The result of this (and past) failed attempts to approximate national copyright regimes have led to copyright being the least harmonised of all IP rights in the EU. Furthermore, legislative interventions so far have often attracted criticisms for not sufficiently taking account of public interest concerns and safeguarding fundamental rights in the offline and online world. Therefore, the time has come to consider another perspective on harmonisation: one which focuses on improving the existing institutional and regulatory arrangement for copyright in the EU by providing a new avenue for Member State cooperation in oversight, policy-building and enforcement. In recent years, particularly considering the many challenges of regulating conduct online, attention has been increasingly focussed on re-centralising certain regulatory tasks to public, independent EU level authorities. Given the growing number of cross-border enforcement issues in administering copyright in the online environment, an EU-level regulator may also be better placed to monitor the copyright-relevant activities of online platforms, centralise EU-wide dispute resolution, deliver policy advice on the future design of copyright legislation, and help coordinate Member State enforcement and regulatory practices. Such a public regulator would also likely be in a better position than private actors to guarantee a fair balance of interests and the respect of fundamental rights online, giving shape to what has recently been conceptualised as ‘digital constitutionalism’. If created, such an authority may, in the long term, help to ensure greater levels of transparency, predictability and certainty for EU copyright stakeholders participating in the online content marketplace. Centring on the premise that the established institutional and regulatory frameworks in the EU are no longer capable of promoting the goals of a modern, online copyright, this article explores a specific solution in detail: introducing a new, EU-level public regulator for copyright. Part I first evaluates the available room for manoeuvre in the existing regulatory and institutional framework for administering copyright law in the EU by examining recent trends and developments in EU institutional frameworks. The examples of the European Data Protection Board and the European Board for Digital Services in the DSA are analysed in order to identify parallels and draw inferences for a potential equivalent in the field of copyright. Part II then identifies several key aspects of the Copyright in the Digital Single Market Directive that leave important questions of regulatory design unanswered and proposes several available ‘institutional’ options to improve its implementation. The article concludes with recommendations.

Joint controllers in large research consortia: a funnel model to distinguish controllers in the sense of the GDPR from other partners in the consortium.

Large European research consortia in the health sciences face challenges regarding the governance of personal data collected, generated and/or shared during their collective research. A controller in the sense of the GDPR is the entity which decides about purposes and means of the data processing. Case law of the Court of Justice of the European Union (CJEU) and Guidelines of the European Data Protection Board (EDPB) indicate that all partners in the consortium would be joint controllers. This paper summarises the case law, the Guidelines and literature on joint controllership, gives a brief account of a webinar organised on the issue by Lygature and the MLC Foundation. Participants at the webinar agreed in large majority that it would be extreme if all partners in the consortium would become joint controllers. There was less agreement how to disentangle partners who are controllers of a study from those who are not. In order to disentangle responsibilities, we propose a funnel model with consecutive steps acting as sieves in the funnel. It differentiates between two types of partners: all partners who are involved in shaping the project as a whole versus those specific partners who are more closely involved in a sub-study following from the DoA or the use of the data Platform. If the role of the partner would be comparable to that of an outside advisor, that partner would not be a data controller even though the partner is part of the consortium. We propose further nuances for the disentanglement which takes place in various steps. Uncertainty about formal controllership under the GDPR can stifle collaboration in consortia due to concerns over (shared) responsibility and liability. Data subjects' ability to exercise their right can also be affected by this. The funnel model proposes a way out of this conundrum.

Personal Data Transfers Outside the European Economic Area in the Insurance Sector Context

The article aims to cite and synthetically analyse key regulations in the field of personal data transfers outside the European Economic Area, taking into account the specificity and requirements of the insurance sector. It covers both national and European legislations, recent case law, guidelines of competent authorities as well as relevant industry standards. It also identifies the key risks for personal data controllers, particularly in the context of the Schrems II case and related requirements defined in the guidelines of the European Data Protection Board. In addition, it presents general recommendations on best practices related to the adequate protection of personal data transfers for the insurance sector entities.

Cross-Border Transfers of Personal Data After Schrems II: Supplementary Measures and new Standard Contractual Clauses (SCCs)

This article analyses the legal challenges of international data transfers resulting from the recent Court of Justice of the European Union (CJEU) decision in Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Schrems II). This judgement invalidated the EU-US Privacy Shield Framework but upheld the use of standard contractual clauses (SCCs). However, one caveat is that organisations would have to perform a case-by-case assessment on the application of the SCCs and implement ‘supplementary measures’ to compensate for the lack of data protection in the third country, where necessary. Regrettably, the CJEU missed the opportunity to specify what exactly these ‘supplementary measures’ could be. To fill this gap, the European Data Protection Board (EDPB) adopted guidelines on the measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. In addition, on June 4th, 2021 the European Commission issued new SCCs which replaced the previous SCCs that were adopted under the previous Data Protection Directive 95/46. These new developments have raised the bar for data protection in international data transfers. In this article, we analyse the current regulatory framework for cross-border transfers of EU personal data and examine the practical considerations of the emerging post-Schrems II legal landscape.

Case Study Discovering the Potential for Algorithmic DecisionMaking on Setting GDPR Fines

Administrative fines for GDPR infringements are growing rapidly in number, yet companies are presented with an opaque process on how these fines are issued by the data protection authorities (DPAs). In particular, one principle described within the guidelines issued by the European Data Protection Board (EDPB) requires a case-by-case assessment, which is potentially offsetting the automation of administrative fines in the future. This paper is challenging this principle through algorithmic arguments. The suggested approach has its benefits in terms of scalability. Yet, this approach may well receive funded critics due to potential clashes with other principles.

Mitigating the risk of US surveillance for public sector services in the cloud

Despite efforts to mitigate European concerns over US governmental access to European data, the US regulatory framework is still problematic from a fundamental rights perspective, as elevated by the Schrems II ruling. The issues associated with transnational transfers of data have been further complicated by the European Data Protection Board's recommendations that state that EU personal data cannot be processed in the clear in third countries where public authorities demand access to data. Based on empirical case studies from the Netherlands and Sweden, the present contribution outlines possible remedies that mitigate this problem, but the fundamental issue appears unsolvable. While the US has taken steps to grant foreign nationals more rights, significant challenges remain with the US approach to mass surveillance and EU citizens' lack of judicial redress.

Demystifying Schrems II for the cross-border transfer of clinical research data.

The Courts of Justice of the European Union (CJEU) held in its July 2020 Schrems II decision that, in order for entities in other countries to import personal data from the European Economic Area (EEA), the importer must be able to provide data protections ‘essentially equivalent’ to those the EEA offers under its General Data Protection Regulation. The CJEU expressed particular concern that United States’ national security intelligence gathering laws prevent U.S.-based entities from providing such protections. This decision has sharply limited the sharing of clinical research data from the EEA to the United States. After describing the pertinent aspects of the Schrems II decision, this article evaluates U.S. national security intelligence gathering frameworks, including Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333. The article then leverages recent draft guidance from the European Data Protection Board to explain how entities may be able to adopt widely used contractual and technical measures, such as data pseudonymization, to provide ‘essentially equivalent’ protections in the clinical research context.

A Data Scope Management Service to Support Privacy by Design and GDPR Compliance

In order to empower user data protection and user rights, the European General Data Protection Regulation (GDPR) has been enforced. On the positive side, the user is obtaining advantages from GDPR. However, organisations are facing many difficulties in interpreting GDPR, and to properly applying it, and, in the meanwhile, due to their lack of compliance, many organisations are receiving huge fines from authorities. An important challenge is compliance with the Privacy by Design and by default (PbD) principles, which require that data protection is integrated into processing activities and business practices from the design stage. Recently, the European Data Protection Board (EDPB) released an official document with PbD guidelines, and there are various efforts to provide approaches to support these. However, organizations are still facing difficulties in identifying a flow for executing, in a coherent, linear and effective way, these activities, and a complete toolkit for supporting this. In this paper, we propose the design of such flow, and our comprehensive supporting toolkit, as part of the DEFeND EU Project platform. Within DEFeND, we identified candidate tools, fulfilling specific GDPR aspects, and integrated them in a comprehensive toolkit: the DEFeND Data Scope Management service (DSM). The aim of DSM is to support organizations for continuous GDPR compliance through model-based Privacy by Design analysis. Here, we present DSM, its design, flow, and a preliminary case study and evaluation performed with pilots from the healthcare, banking, public administration and energy sectors.

Invalidation of the EU–US Privacy Shield: impact on data protection and data security regarding the transfer of personal data to the United States

The Court of Justice of the European Union has attracted international attention with its ruling, in which it declared the EU–US Privacy Shield invalid. Many companies have a connection to the United States, whether through service providers or affiliated companies. Data exporters and data importers are still wondering whether and how they can manage the transfer of personal data to the United States in accordance with European data protection laws. The national German data protection authorities have already published general recommendations for action, but these did not provide any remedy either. In November 2020, the European Data Protection Board published recommendations on measures to complement the transfer tools to ensure compliance with the European level of protection of personal data. The following article presents these recommendations and focuses on data security measures that play a major role in the future transfer of personal data to the United States.