Anna Strzykała FIP, CIPP-E, CIPM, AI-Gov.,GDD-Cert.DPO-EU

ONKIDA: An Essential Overview of Orientation Guides to navigate AI and GDPR ONKIDA is a fantastic aid for understanding the main principles and rights and how they are covered by CNIL, EDPS, and German authorities. 📑 Key Features of ONKIDA: - Central Data Protection Guidelines: The left column lists the "Top Ten Data Protection and AI" principles that regularly come into play with AI applications involving personal data. - Orientation Guides: The top row features a selection of orientation guides from various supervisory authorities and cooperating bodies, linked directly to the original documents. - Detailed References: For each document, ONKIDA specifies whether and where (page, margin number) the respective paper addresses the guidelines in the left column. 👏 Kudos to Prof. Dr. Tobias Keber, State Commissioner for Data Protection and Freedom of Information Baden-Württemberg/Germany, and his dedicated team for this remarkable contribution to the field of data protection and AI! Please note: The guidance has been automatically translated into English and should be read with care.

74

1 Kommentar

Dutch DPA Fines Clearview AI €30.5 Million for Illegal Data Collection The Dutch Data Protection Authority (Dutch DPA) has imposed a significant fine of €30.5 million on Clearview AI, an American company providing facial recognition services. The fine comes with an additional penalty of up to €5.1 million for future non-compliance. This decision highlights the serious breaches of privacy laws committed by Clearview AI, which has illegally amassed a database of 30 billions of facial images, including those of Dutch citizens, without their consent. The Dutch DPA’s investigation revealed that Clearview AI has seriously violated the GDPR on multiple fronts. The company’s actions include: - Illegal Database Creation: Collecting and using biometric data, such as facial images, without legal grounds. - Insufficient Transparency: Failing to inform individuals about the use of their data and not cooperating with data access requests. Despite previous fines from other data protection authorities, Clearview AI has not altered its conduct, prompting the Dutch DPA to explore additional measures, including holding the company’s directors personally liable. #GDPR #AI

204

8 Kommentare

New Guidance from German Authorities for Digital Service Providers The German data protection authorities (DSK) have released updated guidance for digital service providers. It is only available in German but here are the key points: Scope: Applies to all digital service providers Consent Requirement: Storing information on or accessing information from end devices requires user consent. Technology Neutrality: Applies to all technologies, not just cookies. No Personal Data Required: Protection extends beyond the GDPR. Consent Requirements: Must be voluntary, informed, unambiguous, and revocable. Exceptions from consent: Only in cases of technical necessity or service provision. The new guidance significantly impacts the design of digital services, especially regarding consent declarations. It's worth examining the sections on consent design closely. For instance: Informed consent in this context (referring to user tracking by third parties) requires clearly explaining the purposes of processing, particularly if individual profiles are created and enriched with data from other websites. Third-party service providers must be individually named. The requirements aare not limited to the operation of websites and apps, although these are the most common use cases. Therefore, the guidance primarily includes examples from these areas to illustrate the points.

35

Worried about immaterial damages under the #GDPR? Whether #datasubjects can #claim #compensation for GDPR #infringements that caused only 'moral' damages has been the subject of a very heated debate. The national courts are ruling very differently on the subject. Germany's Federal Court of Justice BGH, judgement of 18.11.2024, case no. VI ZR 10/24 has ruled against #Meta in a large data #leak case from 2021 that comprises personal data of half a billion people. This overrode the decision of a lower court that had ruled in favor of #Meta, and said instead that it was sufficient for users to just show they were victims of the #dataleak and they did not have to prove #suffering. Does the fact that a data subject does not know whether their own data, such as their name and telephone number, has been disclosed constitutes damage? Plaintiffs are often unable to prove any further #damage - such as increased spam calls. They therefore only receive money if the "abstract" loss of control is recognised as damage. At the same time, it is undisputed that the "loss of control" can be #harmful. This has long been recognised by the European Court of Justice (#ECJ). According to the ECJ, however, it must be proven that such damage has actually occurred. German courts have therefore often argued that the mere possibility that third parties have gained access to the data does not constitute damage. More would have to be involved, such as a demonstrable increase in spam calls or credible psychological stress. Most plaintiffs are unable to do this. BGH: Loss of control over #Facebook data justifies compensation, the "mere and short-term loss of control over one's own personal data as a result of a breach of the #GDPR alone constitutes immaterial damage. It is not necessary to prove that the data has been #misused to the detriment of the data subject. Further noticeable negative consequences are also not required. The judgement gives a boost to professional plaintiffs' representatives in particular, may influence many pending #PrivacyLitigation cases, and opens the door for potentially unforeseeable #risks and limitless #liability for organizations. The companies should take precautions: Data protection #violations can quickly become expensive because professional plaintiffs' representatives organise waves of lawsuits for their own financial gain. This can be prevented with good data protection #compliance. Ideally, this will prevent an #incident from occurring in the first place. If a data protection incident does occur, which can never be ruled out, good documentation of the #TOMs taken provides a good line of defence to halt such #risks at an early stage. #Personaldata #DataProtection #GDPR #ArtificialIntelligence #Webscraping #LossOfControlOverData #TOMs #Security #Lawfulbasis #ScrapingIncident #DataBreach #MisuseOfData #Accountability #Documentation #ClaimsForDamages

13

To sub-processor infinity and beyond! European Data Protection Board opinion on sub-processors requires controllers to collect & review sub-processor lists; compliance documents & transfer impact assessments all the way down the sub-processor chain, even if it's hard/complex. TL:DR Roses are red Violets are blue Cross border transfers are complicated but that problem, controller, is for you. To do: Initial processor: 🔹Conduct due diligence for the processor you choose and be able to demonstrate to regulators that you did e.g. through: a questionnaire relevant documentation; publicly-available information and/or third party audits 🔹Conduct regular audits of the processor. Sub-processors: 🔹Before engaging: You definitely need a list of intended sub-processors (including: locations, what they will be doing and proof of safeguards). 🔹Conduct diligence / assure the guarantees. The extent depends on the data. 🔹In cases the information received seems incomplete/inaccurate or data is more sensitive; verify and complete/correct if necessary. 🔹Ask for the sub-processing contracts if necessary. 🔹Document all measures / steps. 🔹Include in contract how/when processor should provide you with all information on the processing. 🔹You may rely on the information provided by the processor, if the information submitted by the processor actually demonstrates compliance. This also applies to sub-processors. 🔹General authorization for engaging processors should be supplemented with criteria to guide the processor’s choice. Onward transfers - before engaging the processors/sub-processors: 🔹Ask for and assess things like: transfer mapping (which personal data is transferred including remote access), where, and for which purposes) , ground for transfer used, “transfer impact assessment” and supplementary measures. 🔹You may rely on such mapping and if necessary build on it if seems incomplete/inaccurate. 🔹For transfers based on an adequacy decision: assess: (1) whether the adequacy decision is in force and (2) whether the transfers carried out fall in scope and (3) get documentation re (sub-)processor ‘sufficient guarantees’ but no need to independently assess in all cases. 🔹For transfers without adequacy decision: (1) get TIA; (2) ensure it's OK and (3) build on it if necessary and (4) ensure (sub-)processor ‘sufficient guarantees’ In your Art 28 contract you: 🔹MUST include a commitment from the processor to only process personal data on documented instructions 🔹SHOULD add “unless required to do so by Union or Member State law to which the processor is subject” (either verbatim or in very similar terms). 🔹MAY add “unless required to do so by law or binding order of a governmental body” for non EU country 🔹MUST include processor’s obligation to inform controller before carrying out a processing that is not based on instructions #dataprivacy #dataprotection #privacyFOMO pic by ChatGPT https://lnkd.in/ehy32wUV

270

23 Kommentare

📢 Data Privacy Updates on Asset Deals, Patient Records, and Scientific Research in Germany On September 11, 2024, the German Conference of Data Protection Authorities of the Federal and State Governments (Datenschutzkonferenz=DSK) discussed critical topics. Here's a look at the major outcomes: 1. Revised Guidelines for Asset Deals: The DSK has updated its 2019 resolution on "Asset Deals" to offer clearer guidance on the application of the GDPR. This is crucial for companies involved in the transfer of business assets, including customer, supplier, and employee data. The new resolution provides a more detailed framework for ensuring data protection compliance in these transactions. 2. First Free Copy of Patient Records: Following a ruling from the European Court of Justice (ECJ) on October 26, 2023, the DSK is advocating for legislative changes to ensure patients receive their first copy of medical records for free. This aligns with Article 15(3) of the GDPR, which grants patients the right to one free copy of their records, challenging existing national regulations that require payment. 3. Unified Definition of Scientific Research: The DSK has established a consistent understanding of "scientific research purposes" under the GDPR. This aims to ensure that data processing for research is methodologically sound, independent, and serves the public interest, while also respecting the rights of data subjects. Why This Matters: These resolutions are pivotal for harmonizing data protection practices. The focus on AI, patient rights, and scientific research underscores the DSK's commitment to adapting data protection to contemporary challenges. The original press release was in German and has been translated into English using DeepL. Please read with care. #DataPrivacy

45

2 Kommentare

📕 🔥 Consent Banner Report. Overview of EU and national guidelines on dark patterns by noyb.eu The purpose of this report is to offer a comprehensive account of the European Data Protection Board taskforce’s report findings for each violation, compared with the positions taken by national DPAs in guidance documents. The Report will address each practice in turn, outlining some relevant issues, the position of the #EDPB taskforce, and the guidelines published by the national DPAs. The final section of the report will outline some other relevant EDPB and WP29 guidelines for further research. #cookies #GDPR

79

HOW LARGE IS "LARGE-SCALE" DATA PROCESSING? In almost all data protection laws worldwide, "large-scale" data processing is an important factor for certain requirements, like conducting a Data Protection Impact Assessment (DPIA) or appointing a Data Protection Officer (DPO). However, the definition of "large-scale" is often unclear, leaving organizations unsure about when these rules apply. Different countries take different approaches to define large-scale data processing. Some, like Estonia and Germany, use numbers to set thresholds. For example, Estonia considers processing data for 50,000 individuals as large-scale, while Germany defines it as involving over 5 million people or 40% of a relevant population. These specific numbers can help but are not consistent across all regions. Other countries focus on context instead of numbers. The United Kingdom looks at things like the number of people involved, the scope of the processing, and how sensitive the data is. France also considers factors like how much data is being processed, how long the processing lasts, and how wide its impact is. This approach requires businesses to make their own judgment based on the situation. Without a clear definition, organizations should focus on the risks involved. Ask questions like: How many people will this processing affect? Is the data sensitive? What could happen if there’s a problem with the processing? If the impact seems significant, it’s safer to treat the activity as large-scale and take steps like conducting a DPIA or appointing a DPO. To help businesses, regulators could provide clearer guidance or examples of what counts as large-scale. Until then, taking a cautious and proactive approach is the best way forward. Not only does this help meet legal obligations, but it also builds trust with customers and stakeholders. Here is the data I have gathered from various sources on the internet regarding large-scale data processing criteria across different jurisdictions. Please feel free to correct any inaccuracies or provide feedback if something appears incorrect or misaligned.

65

GDPR / UK GDPR is not a standard or a framework. It is a law which has effect in the EEA / UK and sometimes has effect on non-EEA / UK organisations for their processing which is in scope. if you aren't based in the EEA / UK, don't fall within the extra-territorial scope of GDPR / UK GDPR and yet maintain that you comply and have a privacy notice which addresses GDPR / UK GDPR with all the approprate lawful bases etc then you are wasting your time. You do not get to chose which data protection legislation you want to comply with, just demonstrate compliance with the ones you are in fact subject to.

1

Um guia visual que vale a pena ler. A visual guide worth reading.

14

1 Kommentar

The UK has a DPO notification problem. UK GDPR Article 37(7) states that "[t]he controller or the processor shall publish the contact details of the data protection officer and communicate them to the Commissioner." The only difference between UK GDPR and EU GDPR is that "the Commissioner" replaces "the supervisory authority". The first part of this passage - the publication requirement - isn't controversial: you only need to add a DPO email address to a website to comply. Problems arise with the communication requirement. Across the EEA, every data protection authority of a Member State, German Länder, or Spanish semi-autonomous region outlines a process for communicating the appointment of a DPO to the relevant authority. Mostly this is a simple webform, occasionally it's an email address, and in some cases it is a convoluted bureaucratic nightmare (your mileage may vary). In the UK, we don't really have an equivalent mechanism. UK data controllers that are obligated to register with the ICO by The Data Protection (Charges and Information) Regulations 2018 (as amended) can communicate DPO contact details as part of the registration process, or at any time after that using the "Add a DPO" page of the ICO website. There are two gaping holes with this approach. Firstly, and most critically, it excludes data processors. It's right there in 37(7): both controllers and processors are obligated to communicate their DPO's contact details to the Commissioner. Secondly, and more complicatedly, certain data controllers are not obligated to register with the ICO. There are a few exemptions laid out in law (e.g., certain not-for-profit organisations) and I have yet to see a convincing argument that non-UK data controllers (i.e., those with no physical establishment in the UK) are required to register. In both cases, the ICO does not have a valid DPO contact details communication pathway. I should say that it is possible to send an email to the ICO, but whether the ICO employee processing your communication understands what you are trying to say appears to be completely potluck. Why is this a problem? Needless to say, the risk of enforcement on this issue is low, considering the Commissioner's track record. I think there is a decent case to be made that a national registry of all DPO contact details (including data processors) could be beneficial from a resilience perspective, particularly for communicating zero day security vulnerabilities or changes to ICO guidance. More to the point, this situation is wholly avoidable. It would be trivial for the ICO to create a webform or an email inbox for this specific purpose. Conversely, if the ICO doesn't see the need for certain organisations to communicate their DPO contact details, then let's amend UK GDPR accordingly. At the very least, the ICO could recognise the gaps outlined above and update their guidance to address this ambiguity. What's your take? #gdpr #ukgdpr #ico #dpo #dataprotection

43

23 Kommentare

Top 5 GDPR Fines in September 2024 1️⃣ Norway: University of Agder was fined €12,565 for storing documents with personal data in publicly accessible folders on Microsoft Teams, affecting around 16,000 individuals. This highlights the importance of proper data access controls. 2️⃣ France: An administrative software company was fined €800,000 for using non-anonymized health data without authorization for studies and statistics, and for automatically uploading health insurance data into patient records without necessity. 3️⃣ Poland: The Prosecutor's Office was fined €19,883 for disclosing personal data of a crime victim during a press conference without a legal basis, demonstrating the need for lawful grounds in data disclosure. 4️⃣ Spain: A company was fined €10,000 for not providing a clear and accessible privacy policy, causing user confusion. This underscores the importance of easy access to privacy information. 5️⃣ Spain: A beauty clinic was fined €10,000 for posting before-and-after photos of a patient on social media without proper consent, emphasizing the need for explicit consent for using personal images in marketing. Add-on: Before the summer, the Norwegian Data Protection Authority decided to impose an infringement fine on Eidskog municipality for breaching the requirements for a legal basis in the GDPR. The fine was initially set at NOK 500,000 (approx. €42,000) on 1 February 2023 but was reduced in September to NOK 250,000 (approx. €21,000). The fine was imposed for the extensive publication of confidential information about a whistleblower and for giving unauthorized access to personal data, highlighting the importance of confidentiality in public administration. #GDPR #DataProtection

258

4 Kommentare

⁉️Is it too late to say sorry? 💸The CJEU recently considered whether an apology in lieu of compensation was sufficient remedy under Article 82(1) GDPR 🤝In the case of A v Patērētāju tiesību aizsardzības centrs it was held that A 82(1) was interpreted as meaning that the making of an apology may constitute sufficient compensation for non-material damage on the basis of that provision where it is impossible to restore the situation that existed prior to the occurrence of that damage, provided that that form of redress is such as to compensate in full the damage suffered by the data subject 🎥 Here a Latvian journalist claimed that a character resembling their likeness was used in a car safety video. ⚠️It was noted that in Österreichische Post’, Article 82 does not enable compensation to be ordered on the basis of an infringement of that regulation without first establishing damage that has been caused by that infringement. ↘️In its view, the appeal court in the present case breached Article 82 by awarding compensation without having found any harm to the reputation, honour and dignity of the applicant in the main proceedings. ↘️Does the unlawful processing of personal data may constitute, in itself, an infringement of the fundamental right to the protection of those data, as guaranteed in Article 8(1) of the Charter, and consequently constitute ‘damage’ within the meaning of Article 82, including where no harm to the reputation, honour or dignity of the person concerned has been established? The Court has repeatedly interpreted Article 82(1) to the effect that mere infringement of that regulation is not sufficient to confer a right to compensation on that basis, since the existence of ‘damage’, whether material or non-material, or of ‘damage’ which has been ‘suffered’ constitutes one of the conditions for the right to compensation laid down in that provision, as does the existence of an infringement of the provisions of that regulation and of a causal link between that damage and that infringement, those three conditions being cumulative. 1️⃣ Accordingly, the person seeking compensation for non-material damage is required to establish not only infringement of that regulation, but also that that infringement has actually caused him or her such damage 2️⃣ GDPR must be interpreted as meaning that the making of an apology may constitute sufficient compensation for non-material damage on the basis of that provision, inter alia where it is impossible to restore the situation that existed prior to the occurrence of that damage, provided that that form of redress is such as to compensate in full the damage suffered by the data subject. 3️⃣ FinallyArticle 82(1) of the GDPR must be interpreted as precluding the taking into account of the attitude and motivation of the controller in order, where relevant, to award compensation to the data subject that is lower than the damage he or she has actually suffered. ⬇️ See more here ⬇️

15

🌷 Netherlands Supervisory Authority publishes their guide to data scrapping Data scraping (data harvesting) is an automated way to pull large amounts of information from the web. Scraping from social media creates privacy risks and potential harms, such as the information people post online being used for reasons they don’t expect, exploited in cyberattacks or used for identity fraud. It's a common misunderstanding that using public data, for example, social networks, like from LinkedIn profiles means full compliance with data protection laws. While LinkedIn allows for networking and job searching, having access to this data doesn't mean it can be used freely. According to the GDPR, if you collect personal data from sources like LinkedIn, you need to inform the individual within a month. This rule ensures transparency and respects individual privacy. Also, when scraping data, especially from people in the EU and UK, you usually need their explicit consent. Claiming a legitimate interest isn't enough unless it's clearly justified. Remember, just because data is public doesn't mean it's free to use. Always check your legal obligations and ethical responsibilities. Scraping is usually only justifiable under a legitimate interest basis, which carries strict conditions, such as not being primarily profit-driven. However, it is rare for private entities to meet these conditions. Exceptions include: 🏀 Domestic use -a hobby project where data is shared with a small circle. 🏀Targeted scraping- an organization gathering news from media sites for company-relevant insights. Netherlands SA published "Guidelines for scraping by private individuals and private organizations" you can read the file attached (Dutch only)

16

🌐 DATA PROTECTION NEWS FROM AROUND THE WORLD | 🦄 Lithuania's first "unicorn" has been hit with a record-breaking fine for GDPR violations. The State Data Protection Inspectorate imposed the largest administrative penalty in the country’s history. 📖 In determining the fine, the Inspectorate adhered to the European Data Protection Board's Guideline No. 04/2022 (dated 24 May 2023) on calculating administrative fines under GDPR. Key factors considered included the cross-border nature of the company's data processing, the significant impact on a large number of individuals, and the prolonged duration of the breaches. 🌍 The decision stands out for being coordinated by supervisory authorities from six different countries! ▶️ For insights into the fine and its broader consequences, do not miss the in-depth article by our GDPR experts, Laima Nevarauskaitė and Liudgardas Maculevičius: https://lnkd.in/dPbzHube 🔐 The publication "Data Protection Bites" introduces with the latest data protection #highlights from all over the world and basically aims at collecting all updates, news and insights on data protection matters worldwide, with a special focus on the #gdpr.   💡 Our data protection experts Laima and Liudgardas will be glad to serve you with professional advice in any DP-related issues.   ▶️ All recent DP highlights for your convenience: https://lnkd.in/drpEBtq #DataProtection #ExpertGuidance

9

Morning! Anyone surprised about the EDPB's opinion that "pay or consent" is NOT okay for privacy legal purposes? *Would anything meta did ever be okay in the EDPB's opinion?.... Initial thoughts: What's the legal problem? The problem isn't advertising per se. It's targeted/behavioural advertising. This tracks individuals' browsing habits so the ads displayed to them when using meta, are relevant to the user. The "issue" with this, from a strictly legal pov, is it processes personal data for advertising, which ordinarily requires consent. Under the GDPR, consent has to be freely given - and if the user has no real choice, it fails at that hurdle. What's the reality? Organisations need to make money and people want to buy things. What's the privacy impact? I think part of the problem is people are not sufficiently aware how it all works behind the scenes, so they can't make an informed choice. Transparency really is key. Is the targeted ads market really "mass commercial surveillance"? To show me relevant ads, in SOME circumstances, information on my browsing habits is collected - such as what websites I've visited, purchases made, searches I've ran or my interactions with online content. I can then be segmented into a group with similar interests to me so that I can be delivered ads which align with my interests. I guess there's a number of concerns - to name a few - this segmentation data is stored in databases which may reveal a lot about me and may be exposed to data breaches, this data could contain some sensitive info, and I may not want others to know about my private browsing habits or feel like I'm being watched etc etc (frankly my browsing habits are fairly boring and I'd far rather see ads about the best anti-aging serum than ads about fishing tackle, but that's just me..). What's the options? I think it's fine to expect payment for use of a service like Meta - but what about smaller start ups who are trying to build their consumer base? We need new businesses and innovation and orgs need to make money -- they rely heavily on targeted ads to filtrate the market. Perhaps the general practice of targeted advertising which needs some review to increase transparency and trust as well as the practices of platforms the ads are placed on. Does model of "behavioural advertising only with "GDPR standard" consent" mean that platforms can no longer deploy frequency capping, attribution, anti fraud or analytics either? What is the impact of that on users and others? Many questions for my curious brain as always... In summary: Whilst personally, I would absolutely prefer to see ads about things I'm interested in (yes I'm a sales person's dream), some people would rather not - and that's okay. People should have choice in how their data is processed and what they do or don't sign up to. However, if people have a genuine concern about or expectation of privacy, query their use of some online services in any event...* *opinions are mine*

12

1 Kommentar

𝑳𝒊𝒏𝒌𝒆𝒅𝑰𝒏 𝑭𝒊𝒏𝒆𝒅 €310 𝑴𝒊𝒍𝒍𝒊𝒐𝒏 𝒇𝒐𝒓 𝑮𝑫𝑷𝑹 𝑽𝒊𝒐𝒍𝒂𝒕𝒊𝒐𝒏𝒔 𝒊𝒏 𝑬𝑼 𝑨𝒅 𝑻𝒓𝒂𝒄𝒌𝒊𝒏𝒈 Ireland's Data Protection Commission (DPC) has imposed a €310 million ($356 million) fine on LinkedIn for violating EU privacy laws through its advertising practices. The penalty addresses multiple breaches of the General Data Protection Regulation (GDPR) related to the platform's behavioral analysis and targeted advertising operations. The investigation, initiated by a 2018 complaint from French digital rights organization La Quadrature Du Net, found that LinkedIn failed to establish valid legal bases for processing user data. The company's attempts to justify data processing through "consent," "legitimate interests," and "contractual necessity" were all deemed invalid by the regulator. The DPC determined that LinkedIn violated fundamental GDPR principles of transparency and fairness in its data processing activities. The company has been given three months to bring its European operations into compliance with GDPR requirements. LinkedIn maintains it believes it was compliant with GDPR but has committed to adjusting its advertising practices to meet the DPC's requirements by the specified deadline. This sanction represents the most significant penalty imposed on LinkedIn to date for data protection violations. #DataPrivacy #GDPR #DigitalAdvertising #LinkedInNews #EURegulation #Linkedin

2

𝐗 𝐡𝐚𝐥𝐭𝐬 𝐝𝐚𝐭𝐚 𝐩𝐫𝐨𝐜𝐞𝐬𝐬𝐢𝐧𝐠 𝐟𝐨𝐫 𝐀𝐈 𝐦𝐨𝐝𝐞𝐥 𝐓𝐡𝐞 Data Protection Commission Ireland (DPC) 𝐡𝐚𝐬 𝐰𝐞𝐥𝐜𝐨𝐦𝐞𝐝 𝐚𝐧 𝐚𝐠𝐫𝐞𝐞𝐦𝐞𝐧𝐭 𝐫𝐞𝐚𝐜𝐡𝐞𝐝 𝐰𝐢𝐭𝐡 𝐭𝐡𝐞 𝐬𝐨𝐜𝐢𝐚𝐥-𝐦𝐞𝐝𝐢𝐚 𝐩𝐥𝐚𝐭𝐟𝐨𝐫𝐦 𝐗. 🤖 The platform, formerly known as Twitter, has agreed to suspend its processing of the personal data contained in the public posts of X’s users in the EU and the EEA for use in the training of its AI model, called ‘Grok’. ⏰ The suspension applies to data processed between 7 May 2024 and 1 August 2024. ‼️‘𝐔𝐫𝐠𝐞𝐧𝐭 𝐧𝐞𝐞𝐝’ 𝐓𝐡𝐞 𝐃𝐏𝐂 𝐡𝐚𝐝 𝐛𝐫𝐨𝐮𝐠𝐡𝐭 𝐚𝐧 𝐮𝐫𝐠𝐞𝐧𝐭 𝐇𝐢𝐠𝐡 𝐂𝐨𝐮𝐫𝐭 𝐚𝐩𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐗 𝐮𝐧𝐝𝐞𝐫 𝐬𝐞𝐜𝐭𝐢𝐨𝐧 134 𝐨𝐟 𝐭𝐡𝐞 𝐃𝐚𝐭𝐚 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐀𝐜𝐭 2018. ⚠️This section allows the DPC, where it considers that there is an urgent need to act to protect the rights and freedoms of data subjects, to make an application to the High Court for an order requiring the data controller to suspend, restrict, or prohibit the processing of personal data. ⚖️ The application was made before Ms Justice Reynolds, who indicated in her concluding remarks that the rights and freedoms of data subjects across the EU/EEA were at the core of the application. ⚠️This was the first time that the DPC had sought to use its powers under section 134. ⬇️See more here ⬇️ Law Society of Ireland

10

Illegal Secondary Use by BinDoc? The former data protection officer of Schleswig-Holstein, Thilo Weichert, accuses #BinDoc of illegally #secondaryuse of #patient #data. BinDoc initially processes this data in a legally compliant manner on behalf of hospitals to document the course of patients' illnesses. Subsequently, the data is apparently #anonymized by BinDoc and used for its own purposes, such as cost-effectiveness and market analyses. Thilo Weichert and co-author Karin Schuler are of the opinion that the data is only #pseudonymized because BinDoc only uses three measures for "anonymization". Some data fields are removed from the dataset, others are replaced by a #hash value or transferred to working groups (#cohorts) by #categorization. Even by trying out with known #patientIDs, it is therefore possible to clearly assign them to natural persons. Last week I was able to listen to a lecture by Andreas Sachs from the Bavarian State Office for Data Protection Supervision (#BayLDA) on the topic of anonymization. The requirements of the BayLDA for the anonymization of patient data are certainly not met with these three measures. I also wonder whether BinDoc has a legal basis for anonymization? In my opinion, this can only lie in the #consent of the patients. I will continue to monitor the case. https://lnkd.in/eAx2tWxP

5

1 Kommentar