DPA of Baden-Württemberg (Germany) fined a health insurance company 1'240'000 EUR for insufficient implementation of TOMs resulted in personal data of app. 500 individuals being accidentally processed for advertising purposes without due consent. The fine is quite high, especially given that there have been some mitigating factors in this case: not too many data subjects … Continue reading On a crucial importance of TOMs under GDPR Article 32
From 29 July 2020 onwards, Tiktok Ireland will control the data of all users in the EEA and Switzerland. Nothing specific, just another smart move of a non-EEA company (parental company Tiktok Inc incorporated in the US) in an attempt to use one-stop-shop mechanism via its EEA subsidiaries. Except for one thing. The recent French … Continue reading Tiktok moves under control of Irish DPC
France's Council of State has ordered the CNIL (French data protection watchdog) to cancel parts of its guidelines on cookies as the ban on cookies walls was not valid. The court explained that the CNIL exceeded its specific mandate under an act called "flexible law" which refers to instruments, such as regulatory authorities' guidelines, which … Continue reading An interesting twist in the ‘cookie walls’ saga.
PwC developed a facial recognition tool that logs when employees are absent from their computer screens while they work from home. In particular, there have to be a specific excuse for any absence (including toilet breaks). Too invasive? No doubt. Disproportionate with no likely legal grounds? WP29 Opinion 2/2017 on data processing at work suggests … Continue reading PwC vs. employee privacy
A thorough analysis of clear things and grey zones of the EDPB Guidelines 3/2018 on territorial scope. My attention was, in particular, drawn by a friendly reminder that a status of a non-EU processor is dual as per Article 3(2): it is indirectly influenced by the GDPR if carries out processing on behalf of a … Continue reading Status of non-EU processors under Article 3(2) GDPR
An old issue each privacy pro learnt by heart: "risk of negative consequences (e.g. substantial extra costs)" for data subject = no freely-given consent. Substantial. But what if extra costs are not substantial? What if, say, 10$ turns into 11$ if you refuse to consent? Is it ok? At leats, German watchdog seems to say … Continue reading Ticking time-bomb in the EDPB Guidelines on consent?
CJEU gave the Judgement in the course of a preliminary ruling on whether Articles 6(1)(c) and 7(f) of the Data Protection Directive (95/46/EC) precluded national law from allowing installation of a CCTV system in the common parts of a residential building, relying on a legitimate interest (Case C-708/18). The overall answer is "No, it … Continue reading CJEU & legitimate interest in scope: what the controller should remember of.
An interesting GDPR enforcement case came from Belgium in late May. Imagine that a data controller is sending unsolicited postal communications and ignoring data subject rights to object (Article 21) and to be forgotten (Article 17). On top of that, it misidentified legal basis and relied on the legitimate interest instead of consent (of course, … Continue reading Belgian data protection watchdog sends controversial ‘message’ with regard to non-profit data controllers.
In 'Opinion 4/2007' on the concept of personal data, Working Party 29 ('WP29’) identified four building blocks in the definition of personal data - ‘any information’, ‘relating to’, identified or identifiable’, ‘natural person’. They remained the same in the GDPR, thus rendering ‘Opinion 4/2007’ relevant for understanding the concept of personal data. However, WP29, instead … Continue reading A “purpose” element: what is inside the controller’s mind?