EU

European Commission Publishes Guidelines on Data Protection

The European Commission’s Article 29 Working Party (WP29) has published guidelines on transparency under Regulation 2016/679 under the General Data Protection Regulation (GDPR). These guidelines provide practical guidance and interpretative assistance on the obligation of transparency concerning the processing of personal data under the GDPR. The guidelines emphasise that the onus is on controllers to present information to data subjects, avoiding the issue of information fatigue by communicating efficiently and succinctly.

Regarding how information must be easily accessible, the guidelines reference apps. An example is given of an installed app where data privacy information should never be more than two taps away, essentially by installing a “privacy/data protection” option under the menu. Examples were also given of phrases that would not be deemed “clear and plain language”, such as “we may use your personal data for research purposes”, which does not provide clarity on what type of research this refers to.

Writing in the passive form and using the qualifiers “may”, “might” and “possible” should be avoided. The guidelines further summarise the categories on information that must be provided under Articles 13 and 14, of which all sub-articles are viewed as being of equal importance. WP29 states that an evidence-based approach must be taken and research conducted in the development of a code of icons.

The Dutch Data Protection Authority Allows Film Distributor to Process Personal Data for Copyright Infringement Purposes

The Dutch data protection authority (AP) has authorised the film distributor Dutch FilmWorks (DFW) to collect and process the personal data of individuals who are suspected of illegally downloading copyright protected materials. Generally, the processing of this criminal data is prohibited under the Personal Data Protection Act 2000. However, the AP has permitted DFW to rely on the exemption from the ban, under Article 22(2) (b) of the act, which authorises the processing on the grounds that it is carried out for the protection of the controller’s interests insofar as it concerns criminal offences that are, or are expected to be, committed against the controller or against persons who are at its service.

It was deemed by the AP that DFW had a legitimate interest in collecting such data to carry out investigations, which it believed outweighed risks to rights and freedoms of data subjects. The AP approved the safeguards implemented by DFW for data processing, notably drafting a code of conduct governing how it targets groups, including an information security policy and implementing retention periods and complaints procedures.  

Intervention by EU in Microsoft and the US’s Data Privacy Battle

The EU has intervened in an ongoing case (since 2013) between Microsoft and the US government to ensure the US Department of Justice (DOJ) understands European data laws. The DOJ demanded that Microsoft hand over data related to a US criminal case, despite this data being stored in a Dublin-located server. The EU claimed that this would fall under EU data protection laws, as the data in question would have to be moved from Europe to the US.

The European Commission has reinforced that it is, therefore, in the interest of the EU to ensure that EU data protection rules on international transfers are correctly understood and considered by the US Supreme Court. Another issue that the commission considered was whether the US Stored Communications Act permits US courts to require a US-based service provider to produce a customer’s data stored on a server located outside of the US.

Yet, the DOJ has responded that it would pursue its claim, insisting Microsoft comply with its data warrant by undertaking acts entirely in the US. The DOJ highlights Microsoft’s failure to divulge its requirement to comply with EU data laws, stating further that the US judicial system would be well prepared to handle a conflict of laws scenario.

UK

Baroness Hollins Backs Down on Amendments to Data Protection Laws

Baroness Sheila Hollins submitted amendments to the Data Protection Bill with the aim of restricting special freedoms accorded to journalists. These freedoms allowed them to process personal information on the condition that they have a reasonable belief that their publication would be in the public interest. A further proposal was to oblige journalists to sign up to the state-approved press regulator, Impress. However, Baroness Hollins has since backed down, stating that her proposals were no more effective than those of Lord Justice Leveson’s to rebalance data protection law.

Criticisms of these amendments were extensive, labelling them “deeply repressive” upon investigative journalism and evoking examples of creative works that are exempt from data privacy laws. Baroness Hollins defended her proposals, recalling her personal experience of “incredibly intrusive” reporters after her daughter was left paralysed after a knife attack. It remains to be seen whether Parliament will decide upon a second Leveson inquiry into the relationship between the media and the police.

ICO Executes Search Warrants Related to Millions of Automated Nuisance Calls

The Information Commissioner’s Office (ICO) has searched two addresses in Nottingham as part of an investigation into a network suspected of making hundreds of millions of nuisance calls. ICO enforcement officers were joined by the Claims Management Regulator and Nottinghamshire Police to execute a search warrant at an office building in the city.

The operation was part of an ICO investigation into a network of people and associated companies believed to be responsible for bombarding UK citizens with hundreds of millions of unsolicited automated calls promoting personal injury claims.

The Claims Management Regulator, part of the Ministry of Justice, is also investigating potential breaches of the Compensation Act 2006.