Aliki Foinikopoulou

EDPB plenary meeting starting today! On the agenda: guidelines clarifying the rules on international data transfers, review of the adequacy decisions and the European data protection seal.

12

“From François Bayrou to Marine Le Pen” - “In the case of the MoDem European parliamentary assistants, the Paris judicial court pronounced three acquittals on 5 February 2024, including that of François Bayrou. While we can only be pleased with the more lenient fate reserved for the MoDem parliamentarians, we must hope that the judges of the Paris judicial court will manage in 2025 to render an equally lenient judgment with regard to Marine Le Pen and the parliamentarians of the National Rally. We must be careful not to have double standards in court judgments. Especially since the voting method differs for electing deputies to the National Assembly. Indeed, the two-round single-member majority vote has been applied to legislative elections since the adoption of the Constitution of the Fifth Republic. The text was submitted to a referendum and approved by a very large majority on 28 September 1958. The same is not true for electing members of the European Parliament. They are elected using a single-round proportional list voting system. In fact, it must be recognised that parliamentary work requires more links for members of the European Parliament to have with their political party. The same goes for their parliamentary assistants.

1

Great read from Maria Teresa Stecher on the #EU #Connectivity #consultation results on #telecoms Conclusion: Much Ado About Nothing. There is no problem and the old ideas would create multiple ones. New #EUCommission can look to new ideas to boost #competitiveness and finally move on from damaging ideas that would hurt #telcos and #cloud #CCIAeurope CCIA Europe #networkfees #fairshare #disconnectEurope

6

Deal or no deal? On #CSA #CSAM we urge the Belgian #EU Presidency not to push for a deal at too high a cost. As we’ve seen on other recent policy files, rushing deals under political pressure doesn’t go well, and this issue is too important to have big problems unsolved. #childprotection #digitalEU #privacy #CCIAeurope CCIA Europe #EU2024BE #envryption

3

EU Digital Identity Regulation Comes Into Force

4

Italian DPA ruling on generative AI, does it effectively end LLMs in Italy? Or does a closer look at how Open AI and other LLMs scan to remove 'most personal data' end up supporting the required anonymisation? (Presumably acceptable to include certain personal data about public figures, like what is the name of the prime minister etc).

59

Important reading:

16

Get ready for the Wallets. Now it is official from the vote we had on the 21th of Nov. Commission adopts technical standards for cross-border European Digital Identity Wallets Today, the Commission adopted rules for the core functionalities and certification of the European Digital Identity (eID) Wallets under the European Digital Identity Framework. This is a major step towards Member States building their own wallets and releasing them by the end of 2026. Four implementing regulations set out uniform standards, specifications, and procedures for the technical functionalities of the wallets, such as data formats required for the cross-border use of digital documents and measures to ensure the reliability and security of the wallets. Setting uniform standards and specifications will allow each Member State to develop wallets in a way that is interoperable and accepted across the EU, while protecting personal data and privacy. Data is stored locally on the wallet, with users have control over what information they share, with zero tracking or profiling in the design of wallets. A privacy dashboard will also be built in, giving complete transparency on how and with whom information from the wallet is shared. The fifth implementing regulation establishes specifications and procedures to build a robust framework for the certification of the eID wallets, ensuring they are secure and protect users' privacy and personal data. European Digital Identity Wallets will offer private users and businesses a universal, trustworthy and secure way to identify themselves when accessing public and private services across borders. Examples of how digital wallets can be used include opening a bank account, proving one's age, renewing medical prescriptions, renting a car, or displaying their flight tickets. The implementing regulations will be published in the Official Journal in due course and enter into force 20 days thereafter.

99

9 Comments

🗞 European Commission Vice President Věra Jourova told POLITICO Europe that the initiative to convert the voluntary Code of Practice on Disinformation into a binding Code of Conduct under the #DSA has officially begun. ✳ Once adopted by the Digital Services Coordinators and approved by the College of Commissioners, #VLOPs will be able to show in their Risk Assessments how they're implementing mitigation measures on different areas, such as demonetisation of disinformation, transparency of political advertising, integrity of services, empowerment of users and researchers, and cooperation during elections ❓ What does this mean for you? Whether you're a VLOP or a small platform, it's crucial to pay attention to codes of conduct. ↘ To learn more about their provisions and implications, check out this resource. https://lnkd.in/dTD94e48 

11

A great example of Member States through the #D9+ forward looking countries calling on the #EU to review its #digital rule book, think very carefully before introducing any new #legislation, and really to call for #BetterRegulation to be properly incorporated into the process. It’s clear they see #MemberStates and many sectors struggling under the increasing regulatory burdens and that there aren’t always commensurate benefits to #consumers or society All in all a positive pro #Europe call to do better together! #digitalEU #CCIAeurope #competitiveness #competition CCIA Europe #EUCommission #digital #costofregulation https://lnkd.in/eqZgvxPQ

11

The European Commission is currently soliciting input on its White Paper "How to master Europe's digital infrastructure needs", which lays out the vision for the Digital Networks of the Future, referred to in the White Paper as “Connected Collaborative Computing” (“3C Networks”). What the White Paper does:   It does recognise the intricate relationship between connectivity and computing: connectivity has ensured the decentralized internet and computing has pushed connectivity to new heights (5G, 6G, satellite, fibre, etc.). It does a good job in asserting that, in order to ensure that this symbiotic relationship is healthy, three main factors should be in place: innovation; an appropriate regulatory environment; and, security. What the White Paper does not: The White Paper does not do a good job at recognising the complexity of internet infrastructure, often treating it as if it is the same as telcos' infrastructure. It also does not care about public and expert opinion and insists on network fees. This time around, it seeks to do that in a dishonest way, namely suggesting an unwarranted and unnecessary “dispute resolution mechanism” for the IP interconnection market, something that has been a part of the big European telcos wish list. And, finally, the White Paper is very much written under the notion of digital sovereignty and fails to take into consideration the conversations about connectivity that are right now taking place in the UN under the Global Digital Compact (GDC). Full submission here: https://lnkd.in/evnWp3_e #infrastructure #internet #networkfees #interconnection #telcos #fairshare #GDC

52

Curious about the DSA and Transparency? Tremau, in partnership with the Tech Coalition, created a guide that acts as an on-ramp for platforms to use or adapt their application of the TC’s pre-existing “Trust” Transparency Reporting Framework to meet (and go beyond) the 🇪🇺 DSA’s transparency requirements regarding OCSEA. Take a look #DSA #transparency #trustandsafety

5

📕 On the record. Exploring the ethical, technical and legal issues of voice assistants - White paper by CNIL - Commission Nationale de l'Informatique et des Libertés The CNIL - Commission Nationale de l'Informatique et des Libertés presents leading practices for designers, application developers, integrators and organisations wishing to roll out #voiceassistants in shared locations. It emphasises the need for #transparency and #security of the devices designed, in order to comply with #GDPR and protect the privacy of individuals. The white paper also explains how good security practices that users can implement, for instance to ensure confidentiality of the data transmitted, or the protect children who may interact with those devices.

96

4 Comments

Great infographics from IAPP - International Association of Privacy Professionals on the complexity of the regulatory intersections between the #AIAct and existing or nascent EU regulations, in particular in the fields of IP, Market Surveillance, Cyber etc...

23

1 Comment

To sub-processor infinity and beyond! European Data Protection Board opinion on sub-processors requires controllers to collect & review sub-processor lists; compliance documents & transfer impact assessments all the way down the sub-processor chain, even if it's hard/complex. TL:DR Roses are red Violets are blue Cross border transfers are complicated but that problem, controller, is for you. To do: Initial processor: 🔹Conduct due diligence for the processor you choose and be able to demonstrate to regulators that you did e.g. through: a questionnaire relevant documentation; publicly-available information and/or third party audits 🔹Conduct regular audits of the processor. Sub-processors: 🔹Before engaging: You definitely need a list of intended sub-processors (including: locations, what they will be doing and proof of safeguards). 🔹Conduct diligence / assure the guarantees. The extent depends on the data. 🔹In cases the information received seems incomplete/inaccurate or data is more sensitive; verify and complete/correct if necessary. 🔹Ask for the sub-processing contracts if necessary. 🔹Document all measures / steps. 🔹Include in contract how/when processor should provide you with all information on the processing. 🔹You may rely on the information provided by the processor, if the information submitted by the processor actually demonstrates compliance. This also applies to sub-processors. 🔹General authorization for engaging processors should be supplemented with criteria to guide the processor’s choice. Onward transfers - before engaging the processors/sub-processors: 🔹Ask for and assess things like: transfer mapping (which personal data is transferred including remote access), where, and for which purposes) , ground for transfer used, “transfer impact assessment” and supplementary measures. 🔹You may rely on such mapping and if necessary build on it if seems incomplete/inaccurate. 🔹For transfers based on an adequacy decision: assess: (1) whether the adequacy decision is in force and (2) whether the transfers carried out fall in scope and (3) get documentation re (sub-)processor ‘sufficient guarantees’ but no need to independently assess in all cases. 🔹For transfers without adequacy decision: (1) get TIA; (2) ensure it's OK and (3) build on it if necessary and (4) ensure (sub-)processor ‘sufficient guarantees’ In your Art 28 contract you: 🔹MUST include a commitment from the processor to only process personal data on documented instructions 🔹SHOULD add “unless required to do so by Union or Member State law to which the processor is subject” (either verbatim or in very similar terms). 🔹MAY add “unless required to do so by law or binding order of a governmental body” for non EU country 🔹MUST include processor’s obligation to inform controller before carrying out a processing that is not based on instructions #dataprivacy #dataprotection #privacyFOMO pic by ChatGPT https://lnkd.in/ehy32wUV

270

23 Comments

We have just published our 2023 Annual report - a comprehensive overview of the EDPB's binding decisions and DPAs' enforcement activities, as well as the EDPB's efforts to raise awareness on data protection and provide guidance #EDPB #GDPR

30

Happy to see that our Data Protection Guide for Small Business is now available in a wide range of languages! The guide is indispensable for anyone looking for easy-to-understand information on GDPR compliance #dataprotection #GDPRcompliance

24

Today the #EuropeanCommission launched a #callforevidence to gather feedback for its upcoming #guidelines on #protectionofminors online, which, once adopted, will advise on how online platforms are to implement high levels of privacy, safety and security for minors online, as required by the #DigitalServicesAct (DSA). More info here 👇 https://lnkd.in/dEDFmf4y

30

3 Comments