Category Archives: GDPR

The problem with the Privacy Shield challenges: do the challengers have legal standing?

by Gabriela Zanfir Fortuna

privacy shield.jpg

Photo: commerce.org

There are currently two ongoing challenges of the Privacy Shield before the CJEU (one submitted by Digital Rights Ireland and one by a coalition of French NGOs). Before deciding on the merits of these cases, there is a risk that the Court may not consider them admissible based on legal standing rules. The Court is very strict when applying the rules under Article 263(4) TFEU, most of the actions for annulment initiated by natural or legal persons being declared inadmissible due to lack of legal standing. 

European Commission’s adequacy decision for transfers of personal data between the EU and the US under the Privacy Shield framework was challenged directly before the Court of Justice of the EU – the Grand Chamber to be more precise, under the procedure for “actions for annulment” enshrined in Article 263 TFEU.

An “action for annulment” under Article 263 TFEU allows the CJEU to “review the legality of legislative acts, of acts of the Council, of the Commission and of the European Central Bank, other than recommendations and opinions, and of acts of the European Parliament and of the European Council intended to produce legal effects vis-à-vis third parties”.

Such actions can be brought by three categories of applicants.

The privileged applicants – any “Member State, the European Parliament, the Council or the Commission on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or of any rule of law relating to their application, or misuse of powers”, according to the second paragraph of Article 263.

A second category of challengers is defined in the third paragraph of Article 263: the Court of Auditors, the European Central Bank and the Committee of the Regions. They can bring actions for annulment before the Court only “for the purpose of protecting their prerogatives”.

Finally, a third category of challengers comprises “any natural or legal person”, according to the fourth paragraph of Article 263 TFEU. But for private parties to actually have legal standing for such actions, the conditions to be met are quite strict (this is why they are also known as “non-privileged applicants”). In fact, there are only three instances where such an action is declared admissible:

  1. if the act is addressed to that person or
  2. if the act is of direct and individual concern to them or
  3. if the act is “a regulatory act which is of direct concern to them and does not entail implementing measures”.

The third possibility was introduced by the Treaty of Lisbon, in 2009, and was meant to address the critique that individuals did not have a real possibility to challenge EU acts, due to the very strict application of the “direct and individual concern” test by the Court.

As it was explained by scholars, “particularly the requirement that the act be of individual concern proves in practice to be a hurdle that is virtually insurmountable” (1). According to the much criticised Plaumann test, the Court established that “persons other than those to whom a decision is addressed may only claim to be individually concerned if that decision affects them by reason of certain attributes which are peculiar to them or by reason of circumstances in which they are differentiated from all other persons and by virtue of these factors distinguishes them individually just as in the case of the person addressed” (Case 25/62 Plaumann v. Commission, 15 July 1963).

To understand how the Court applies the Plaumann test, a very good example is the Toepfer case (Case 106-107/63).

The Court will however grant standing to those who can show that the category of applicant into which they fall is closed, that is, incapable of taking any new members; an example is Toepfer, where a certain decision of the German government to delay the granting of a licence to import grain only affected those who had applied for the licence on 1st October 1963. As this was a completed past event, the category of grain importers applying on that day (which of course included the applicant) was closed to any new members. Mr Toepfer was thus individually concerned.” – R. Lang, “Quite a challenge: Article 263(4) TFEU and the case of the mystery measures”, p. 4-5.

The Plaumann test survived decades of challenges, including a decision of the Court of First Instance (Case T-177/01 Jégo-Quéré, see particularly paragraph 51) that tried to reform it but that was quashed in appeal by the Court of Justice. The Court of First Instance argued that denying legal standing to the applicants in this case meant they would have no right to an effective remedy, due to their particular circumstance. The Court of Justice, in appeal, did not give merit to this argument.

Some nuances have been added to the Plaumann test for different areas of law, but the essence remained the same. For instance, the Court detailed additional conditions for private parties that could be individually concerned by provisions of regulations imposing anti-dumping duties (see Cases T-112/14 to T-116/14, T-119/14 Molinos Rio de la Palata from 15 September 2016, paras 43 to 45). These conditions, however, apply subsequently to the Plaumann test (see para 40 from the Molinos Rio de la Plata cases).

Therefore, it will be extremely difficult, if not impossible, for the NGOs that initiated the actions for annulment of the Commission’s adequacy decision to meet the Plaumann test. If they will manage to do it, this will come with a change of settled case-law.

However, there is another line of argumentation that the NGOs could use and that would have more chances of success. They could use the third limb of Article 263(4), the one introduced in 2009 by the Treaty of Lisbon that allows challenges by private parties of regulatory acts which are of direct concern to them and which do not entail implementing measures.

This way, the applicants will not have to prove they are individually concerned by the act, so the Plaumann test will not be applicable. However, they will enter a new, almost uncharted field: regulatory acts which do not entail implementing measures.

They will have to prove that:

  • the adequacy decision is a regulatory act;
  • the adequacy decision is of direct concern to them;
  • the adequacy decision does not entail any implementing measures.
  1. Is the adequacy decision a regulatory act?

According to case-law following the entry into force of the Lisbon Treaty and the changes that were brought to Article 263(4), “the meaning of ‘regulatory act’ for the purposes of the fourth paragraph of Article 263 TFEU must be understood as covering all acts of general application apart from legislative acts” (Case T‑18/10 Inuit Tapiriit Kanatami and Others v Parliament and Council, 6 September 2011, para 56; Case T-262/10 Microban 25 October 2011, para 21).

In Microban, the Court found that the Commission Decision at issue was adopted “in the exercise of implementing powers and not in the exercise of legislative powers” (para 22), which confirmed its nature of a “regulatory act”. Further, the Court also took into account that “the contested decision is of general application in that it applies to objectively determined situations and it produces legal effects with respect to categories of persons envisaged in general and in the abstract” (para 23).

As the adequacy decision was adopted by the Commission in the exercise of implementing powers (following Directive 95/46), and as it is of general application, producing legal effects to categories of persons envisaged in general and in the abstract, it will most probably be classified as a “regulatory act” for the purposes of Article 263(4) TFEU.

However, there are two more conditions to be met cumulatively before the actions are declared admissible.

2. Are the applicants directly concerned by the act?

The Court uses several criteria to establish there is a “direct concern”.

The classic test the Court usually uses is the following: “firstly, the contested Community measure must directly affect the legal situation of the individual and, secondly, it must leave no discretion to its addressees, who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from Community rules without the application of other intermediate rules” (Case C‑386/96 P Dreyfus v Commission, para 43, Joined Cases C‑445/07 P and C‑455/07 P Commission v Ente per le Ville vesuviane and Ente per le Ville vesuviane v Commission, para 45; Microban, para 27).

For instance, in Microban this test was met because the contested decision prohibited the marketing of materials containing triclosan. The applicants bought triclosan and used it to manufacture a product, which was further sold on for use in the manufacture of plastic materials. Therefore, the Court considered “the contested decision directly affects their legal position” (para 28).

On another hand, in a very recent case, the Court found that “no provision of the contested act is directly applicable to the applicants, in the sense that it would confer rights or impose obligations on them. Consequently, the contested act does not affect their legal position, and therefore the condition of direct concern, as referred to in the second and third situation referred to in the fourth paragraph of Article 263 TFEU, is not met” (Case T-600/15 Pesticide Action Network Europe, 28 September 2016, para 62).

This case concerned an action brought by an environmental NGO and different associations of beekepeers that challenged an Implementing Regulation approving the use of a substance called sulfoxaflor as pesticide. The Court dismissed all the arguments brought forward by the applicants to prove they were directly concerned by this act: starting with a claim that it touched the right of property and the right to conduct business of the beekeepers – due to the harmful effect of sulfoxaflor on bees, to the claim that the applicants participated in the decision making process for the Implementing Regulation, to the claim that refusing their legal standing breached their right to environmental protection under Article 37 of the Charter and their right to effective judicial remedy under Article 47 of the Charter (see paras 46 to 50).

Thus, it will not be easy to argue that the adequacy decision is of direct concern to the applicants. For instance, it could be argued that the decision primarily impacts the legal situation of controllers (and not that of data subjects) who are allowed to transfer personal data pursuant to this decision.

However, it will neither be impossible to argue the direct concern of data subjects, represented by the applicant NGOs. A first argument, perhaps of a general nature, would be that the purpose of the Decision is to establish that companies adhering to the Privacy Shield ensure an adequate level of protection of personal data with the level of protection afforded in the EU, having the consequence that transfers of personal data to those companies will automatically take place, without any further safeguard and without any additional scrutiny or authorisation. Therefore, it affects the legal situation of individuals in the EU whose data are transferred, as they will not be able to oppose the transfer before it takes place.

An objective argument could be the recognition of the rights of the data subject in Annex II of the Decision (the Privacy Shield Principles) – admitting therefore that the Decision, through its Annex, grants rights to individuals represented by the applicants.

Another argument could also be the finding of the Court in Schrems that legislation allowing mass-surveillance and access to content of communications touches the essence of the fundamental right to private life as enshrined in Article 7 of the Charter (see Schrems C-362/14, paras 93 and 94). Therefore, a regulatory act that has as direct consequence transfers of personal data to a legal system that allows such a fundamental breach of Article 7 of the Charter as directly affecting the legal situation of data subjects represented by the applicant NGOs. But for the Court to take this argument into account would mean to acknowledge the existence of mass-surveillance and access to content of communications in the US, at the time when the decision was adopted.

3. Does the adequacy decision entail implementing measures?

This will be the most difficult criterion to be met. The case-law of the Court regarding what can constitute implementing measures is very strict (from the point of view of granting legal standing), in the sense that the Court applies the concept of “implementing measures” for the purposes of Article 263(4) TFEU lato sensu.

For instance, in a landmark judgment in this area, T & L Sugars (case C-456/13, 28 April 2015), concerning an implementing regulation, “the measures at the Member States’ level consisted of receiving applications from economic operators, checking their admissibility, submitting them to the Commission and then issuing licences on the basis of the allocation coefficients fixed by the Commission” (as summarised here). So, even if AG Cruz Villalón “concluded that such non-substantive, or ‘ancillary’, measures […] by the national authorities […] in the exercise of a circumscribed power” or a “purely administrative activity” are not implementing measures (Opinion in Case C-456/13 P, T & L Sugars, para. 31 and 34)” (2), the Court found that “the decisions of the national authorities granting such certificates, which apply the coefficients fixed by Implementing Regulation No 393/2011 to the operators concerned, and the decisions refusing such certificates in full or in part therefore constitute implementing measures” (para 40).

Article 5 of the Privacy Shield adequacy decision states that “Member States shall take all the measures necessary to comply with this Decision”. Therefore, it allows further administrative measures by the Member States. But what are those measures in practice? Could the Court consider they are ancillary enough so as not to amount to “implementing measures”?

On another hand, it is also clear that before the adequacy decision takes effect, a US company must go through an administrative procedure which could amount to a certification procedure similar to the one in the T&L Sugars case. But in this case, will it matter that the alleged “implementing measures” must be taken by a third country and not by a Member State?

Conclusion

In conclusion, the problem of legal standing of the applicants in the two cases challenging the Privacy Shield decision is not at all an easy one. The odds (based on existing case-law) seem to be leaning more towards an inadmissibility of the actions for annulment. But this is why a “legal precedent” system is exciting: the Court can always nuance and, if necessary, change its case-law depending on the particular elements of each case.

However, if these actions will be declared inadmissible, it does not mean that the NGOs concerned will not be able to challenge the Privacy Shield decision in national courts, bringing the case to the CJEU afterwards via the preliminary ruling procedure based on Article 267 TFEU. In fact, even an inadmissible decision will help their subsequent actions at national level, considering that their request to submit preliminary ruling questions to the CJEU will not be able to be dismissed by the national courts due to the fact that they did not challenge the decision directly following Article 263 TFEU (considering the possibility they could have had legal standing).

Whatever the outcome of these two challenges, the decision of the Court will be very important for the “legal standing of natural and legal persons” doctrine in general, on one hand, and for the application of Article 263(4) TFEU to the different acts of the future European Data Protection Board (see Recital 143 of the GDPR), on the other hand.

…………………………………………………………………

(1) Jan H. Jans, On Inuit and Judicial Protection in a Shared Legal Order, European Environmental Law Review, August 2012, p. 189.

(2) Jasper Krommendijk, The seal product cases: the ECJ’s silence on admissibility in Inuit Tapiriit Kanatami II, available here.

***

Find what you’re reading useful? Consider supporting pdpecho.

The GDPR already started to appear in CJEU’s soft case-law (AG Opinion in Manni)

CJEU’s AG Bot referred to the GDPR in his recent ‘right to be forgotten’ Opinion

It may only become applicable on 25 May 2018, but the GDPR already made its official debut in the case-law of the CJEU.

It was the last paragraph (§101) of the Conclusions of AG Bot in Case C-398/15 Manni, published on 8 September, that specifically referred to Regulation 2016/679 (the official name of the GDPR). The case concerns the question of whether the right to erasure (the accurate name of the more famous “right to be forgotten”) as enshrined in Article 12 of Directive 95/46 also applies in the case of personal data of entrepreneurs recorded in the Public Registry of companies, if their organisation went bankrupt years ago. Curiously, the preliminary ruling question doesn’t specifically refer to the right to erasure, but to the obligation in Article 6(1)(e) for controllers not to retain the data longer than necessary to achieve the purpose for which they were collected.

In fact, Mr Manni had requested his regional Chamber of Commerce to erase his personal data from the Public Registry of Companies, after he found out that he was losing clients who performed background checks on him through a private company that specialised in finding information in the Public Registry. This happened because Mr Manni had been an administrator of a company that was declared bankrupt more than 10 years before the facts in the main proceedings. In fact, the former company itself was radiated from the Public Registry (§30).

Disclaimer! The Opinion is not yet available in English, but in another handful of official languages of the EU. Therefore, the following quotes are all my translation from French or Romanian.

AG Bot advised the Court to reply to the preliminary ruling questions in the sense that all personal data in the Public Registry of companies should be retained there indefinitely, irrespective of the fact that companies to whose administrators the data refer are still active or not. “Public Registries of companies cannot achieve their main purpose, namely the consolidation of legal certainty by disclosing, in accordance with the transparency principle, legally accurate information, if access to this information would not be allowed indefinitely to all third parties” (§98).

The AG adds that “the choice of natural persons to get involved in the economic life through a commercial company implies a permanent requirement of transparency. For this main reason, detailed throughout the Opinion, I consider that the interference in the the right to the protection of personal data that are registered in a Public Registry of companies, specifically ensuring their publicity for an indefinite period of time and aimed towards any person who asks for access to these data, is justified by the preponderant interest of third parties to access those data” (§100).

Restricting the circle of ‘interested third parties’ would be incompatible with the purpose of the Public Registry

Before reaching this conclusion, the AG dismissed a proposal by the Commission that suggested a limited access to the personal data of administrators of bankrupt companies could be ensured only for those third parties that “show a legitimate interest” in obtaining it.

The AG considered that this suggestion “cannot, at this stage of development of EU law, ensure a fair balance between the objective of protecting third parties and the right to the protection of personal data registered in Public Registries of companies” (§87). In this regard, he recalled that the objective to protect the interest of third parties as enshrined in the First Council Directive 68/151  “is provided for in a sufficiently wide manner so as to encompass not only the creditors of a company, but also, in general, all persons that want to obtain information regarding that company” (§88).

Earlier, the AG had also found that the suggestion to anonymise data regarding the administrators of bankrupt companies is not compatible with the historical function of the Public Registry and with the objective to protect third parties that is inherent to such registries. “The objective to establish a full picture of a bankrupt company is incompatible with processing anonymous data” (§78).

Throughout the Opinion, the AG mainly interprets the principles underpinning the First Council Directive 68/151/EC (of 9 March 1968 on co-ordination of safeguards which, for the protection of the interests of members and others, are required by Member States of companies within the meaning of the second paragraph of Article 58 of the Treaty, with a view to making such safeguards equivalent throughout the Community)  and it is apparent that it enjoys precedence over Directive 95/46/EC.

Finally: the reference to the GDPR

The AG never refers in his analysis to Article 12 of Directive 95/46,  which grants data subjects the right to erasure. However, come the last paragraph of the Opinion, the AG does refer to Article 17(3)(b) and (d) from Regulation (EU) 2016/679 (yes, the GDPR). He applies Article 17 GDPR to the facts of the case and mentions that the preceding analysis “is compatible” with it, because “this Article provides that the right to erasure of personal data, or ‘the right to be forgotten’, does not apply to a processing operation ‘for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’ or ‘for archiving purposes in the public interest'” (§101).

While I find the Opinion of the AG clear and well argued, I have two comments. I wish he had referred more comprehensively to the fundamental rights aspect of the case when balancing the provisions of the two directives. But most of all, I wish he would have analysed the right to erasure itself, the conditions that trigger it and the exemptions under Article 13 of Directive 95/46.

My bet on the outcome of the case: the Court will follow the AG’s Opinion to a large extent. However, it may be more focused on the fundamental rights aspect of balancing the two Directives and it may actually analyse the content of the right to erasure and its exceptions. The outcome, however, is likely to be the same.

A small thing that bugs me about this case is that I find there is a differentiation between searching a Registry of Companies being interested in a company name and searching a Registry of Companies being interested in a specific natural person. I mean, all third parties may very well be interested in finding out everything there is to know about bankrupt Company X, discovering thus that Mr Manni was the administrator. To me, this does not seem to be the same situation as searching the Public Registry of companies using Mr Manni’s name to find out all about Mr Manni’s background. In §88 the AG even mentions, when recognising the all encompassing interest of every third party to access all information about a certain company indefinitely, that Directive 68/151 protects the interest of “all persons that want to obtain information regarding this company“. I know the case is about keeping or deleting the personal data of Mr Manni from the Registry. And ultimately it is important to keep the information there due to the general interest of knowing everything about the history of a company. However, does it make any difference for the lawfulness of certain processing operations related to the data in the Registry that the Registry of companies is used to create profiles of natural persons? I don’t know. But it’s something that bugged me while reading the Opinion. Moreover, if you compare this situation to the “clean slate” rules for certain offenders that have their data erased from the criminal record, it is even more bugging.  (Note: at §34 the AG specifies he is only referring in his Opinion to the processing of personal data by the Chamber of Commerce and not by private companies specialising in providing background information about entrepreneurs).

Fun fact #1

The GDPR made its ‘unofficial’ debut in the case-law of the CJEU in the Opinion of AG Jaaskinen in C-131/14 Google v. Spain delivered on 25 June 2013. In fact, it was precisely Article 17 that was referred to in this Opinion as well, in §110. There’s another reference to the GDPR in §56, mentioning the new rules on the field of application of EU data protection law. Back then, the text of the GDPR was merely a proposal of the Commission – nor the EP, or the Council had adopted their own versions of the text, before entering the trilogue which resulted in the adopted text of Regulation 2016/679.

Fun fact #2

AG Bot is the AG that the delivered the Opinion in the Schrems case as well. The Court followed his Opinion to a large extent for its Judgment. There are fair chances the Court will follow again his Opinion.

***

Find what you’re reading useful? Consider supporting pdpecho.

The EDPS, “impressed” by the Albrecht report

The European Data Protection Supervisor released an opinion on the European Parliament’s report containing amendments for the data protection legislative package, made public last week (important note: the report has not yet been adopted by the PE).

In its Opinion, the EDPS points out that it is “impressed about the huge amount of the work” it contains.

We are grateful to them since we’re impressed by the huge efforts aimed to make  a proper balance of the various –sometimes conflicting- concerns of different stakeholders in the private and public sectors. Many of the EDPS (and Working Party 29) recommendations have been fully or partly considered.

according to Giovanni Buttarelli, Assistant European Data Protection Supervisor, who attended a meeting of the Committee on Civil Liberties, Justice and Home Affairs of the European Union.

He added that:

On the same Regulation, I could find within the amendments many improvements. Being extremely selective, I would only mention that we appreciated, among others, the efforts aimed to clarify: 

1) some provisions on the rights of the individuals and the transparency of the
processing;

2) the notion of lead authority, which should be seen not as an exclusive
competence, but as a structured way of cooperation with other competent
supervisory authorities;

3) the consistency mechanism and the selective conditions which will trigger the
mechanism, with a view to prevent that the mechanism will be overburdened;

4) the necessary flexibility and the more realistic deadlines necessary for the
adoption of the EDPB opinions;

5) the more selective powers of the Commission in the consistency mechanism,
which should be limited to triggering the seizure of the EDPB and the power to
submit valuable opinions without overruling decisions in individual cases;

6) the more selective approach on delegated and implementing acts;

7) the necessary margin of appreciation with regard to the application of
administrative sanctions, to better ensure that they will always be effective and
proportional to the infringement. We also find it important to point at remedial
sanctions, which can be very effective as well;

8) the way in which the purpose limitation principle is to be respected;
9) the reduction where appropriate of administrative burdens, by focusing on what is
crucial for a substantive and effective protection of fundamental rights.

 

You can find the entire document HERE.

Germany: Peter Schaar welcomes Proposal for Amendments by the European Parliament

According to the Federal Commissioner for Data Protection and Freedom of Information, Peter Schaar, the report on the European General Data Protection Regulation submitted by the rapporteur of the Committee on Civil Liberties, Justice and Home Affairs (LIBE) of the European Parliament, Jan Philipp Albrecht, has to be seen as an important signal for a Europe-wide high level of data protection.

Peter Schaar: The proposed amendments would clearly improve the European Commission’s draft on the reform of European data protection law. The combination of personal data from different sources (profiling) shall be further restricted and the data subjects’ rights shall be strengthened. The data subjects’ right of objection shall be applied without any premises and thus independently of special personal reasons. I am also positive about the independent status of data protection authorities when coordinated action against privacy breaches shall be improved.

The European Parliament hopefully will approve the proposals and I advise the Federal Government to actively advance the absolutely necessary improvements of European data protection law in Council.

The rapporteur’s proposals for amendment prepare the LIBE Committee’s opinion, which regularly serves as a basis for decision-making in the plenary of the European Parliament. The data protection reform requires the consent of the European Parliament and of the Council of Governments of the EU Member States.

Source: The Federal Commissioner for Data Protection and Freedom of Information website

PILB: European Parliament’s take on the Regulation: Stricter, thicker and tougher

Eduardo Ustaran writes for the Privacy and Information Law Blog that if anyone thought that the European Commission’s draft Data Protection Regulation was prescriptive and ambitious, then prepare yourselves for the European Parliament’s approach. The much awaited draft report by the LIBE Committee with its revised proposal (as prepared by its rapporteur Jan-Philipp Albrecht) has now been made available and what was already a very complex piece of draft legislation has become by far the strictest, most wide ranging and potentially most difficult to navigate data protection law ever to be proposed.

This is by no means the end of the legislative process, but here are some of the highlights of the European Parliament’s proposal currently on the table:

*     The territorial scope of application to non EU-based controllers has been expanded, in order to catch those collecting data of EU residents with the aim of (a) offering goods or services (even if they are free) or (b) monitoring those individuals (not just their behaviour).

*     The concept of ‘personal data’ has also been expanded to cover information relating to someone who can be singled out (not just identified).

*     The Parliament has chosen to give an even bigger role to ‘consent’ (which must still be explicit), since this is regarded as the best way for individuals to control the uses made of their data. In turn, relying on the so-called ‘legitimate interests’ ground to process personal data has become much more onerous, as controllers must then inform individuals about such specific processing and the reasons why those legitimate interests override the interests or fundamental rights and freedoms of the individual.

*     Individuals’ rights have been massively strengthened across the board. For example, the right of access has been expanded by adding to it a ‘right to data portability’ and the controversial ‘right to be forgotten’ potentially goes even further than originally drafted, whilst profiling activities are severely restricted.

*     All of the so-called ‘accountability’ measures imposed on data controllers are either maintained or reinforced. For example, the obligation to appoint a data protection officer will kick in when personal data relating to 500 or more individuals is processed per year, and new principles such as data protection by design and by default are now set to apply to data processors as well.

*     The ‘one stop shop’ concept that made a single authority competent in respect of a controller operating across Member States has been considerably diluted, as the lead authority is now restricted to just acting as a single contact point.

*     Many of the areas that had been left for the Commission to deal with via ‘delegated acts’ are now either specifically covered by the Regulation itself (hence becoming more detailed and prescriptive) or left for the proposed European Data Protection Board to specify, therefore indirectly giving a legislative power to the national data protection authorities.

*     An area of surprising dogmatism is international data transfers, where the Parliament has added further conditions to the criteria for adequacy findings, placed a time limit of 2 years to previously granted adequacy decisions or authorisations for specific transfers (it’s not clear what happens afterwards – is Safe Harbor at risk?), reinforced slightly the criteria for BCR authorisations, and limited transfers to non-EU public authorities and courts.

*     Finally, with regard to monetary fines, whilst the Parliament gives data protection authorities more discretion to impose sanctions, more instances of possible breaches have been added to the most severe categories of fines.

Whole story HERE.

 

EP amendment on the draft regulation: New definition for anonymous data

In the draft report published yesterday on the proposed data protection regulation, the rapporteur, Jan Albrecht, proposes that a new definition to anonymous data be introduced in Recital 23 of the preamble.

2

He proposes this text to be added to the original wording of the recital:

“This Regulation should not apply to anonymous data, meaning any data that can not be related, directly or indirectly, alone or in  combination with associated data, to a natural person or where establishing such a relation would require a disproportionate amount of time, expense, and effort, taking into account the state of the art in technology at the time of the processing and the possibilities for development during the period for which the data will be processed.”

The original text merely states that “The principles of protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.”

As a justification for the introduction of this definition, Albrecht writes in the report that “the concept of personal data is further clarified with objective criteria for anonymous data, based on Council of Europe Recommendation 2006(4)”.

The proposed definition excludes from the category of anonymized data information that can be easily de-anonymized, taking into account the “state of the art in technology” at the time of the processing.

pdpEcho on the Data Protection reform in the EU

pdpEcho starts today a category dedicated to the legislative process of the data protection draft regulation and the data protection draft directive, from the EU reform package.

Now that the European Parliament officially released its draft reports on the reform package (see The European Parliament released its reports on the data protection reform package, proposing several changes), we will analyze throughoutly, on an article by article basis, the modifications the EP is proposing for both the legislative acts.

If you are also interested to contribute with ideas and comments on the data protection reform package, send your piece to info@pdpecho.com and it will be published here.