#eudp — Public Fediverse posts

quite fantastical decision of the polish supreme court; if consent to data processing given, little a DPA can do to query failures in data minimisation/purpose limitation. Consent, they say, is consent - as long as it meets consent’s conditions. But whenever does it? #EUDP https://doi.org/10.1093/grurint/ikaf094

Presumably now there is no DPDI Bill, the Information Commissioner's Office can continue with its anonymisation guidance and 'unpause' it? https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-call-for-views-anonymisation-pseudonymisation-and-privacy-enhancing-technologies-guidance/ #eudp

New #EDPB opinion says that companies can't just establish a #GDPR main establishment with a plaque on a door — it has to be where decisions on processing are taken, and if decisions are taken overseas, *there can be no main establishment* and thus the one-stop-shop does not apply. https://edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-042024-notion-main-establishment_en #eudp #dataprotection @ggf

Interesting that #Google has choosen to disable image generation in their multi-modal #Gemini image model in countries with strong #dataProtection law. Concerned it might be full of identifiable imagery? #eudp

'Database Retrieval Technology and Subject Access Principles' by Graham Greenleaf and Roger Clarke in 1984 is one of the most precient and under-referenced pieces in the data protection literature and is and more more relevant by the day. https://rogerclarke.com/DV/DRT-84.pdf #GDPR #DataProtection #eudp

Unsurprising but the #CJEU clarify that you can't retain communications data under the limited #dataRetention powers associated with serious crime and then decide to use it to prosecute something else. fedi post: https://social.network.europa.eu/@Curia/111022918723074019 press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-09/cp230135en.pdf #eudp

Dutch DPA publishes damning advice about the government’s attempt to require skin perspiration alcohol meters for those subject to an alcohol ban. Objects to data being transferred to the United States and the high-level of false positives in the system. https://autoriteitpersoonsgegevens.nl/uploads/2023-08/Advies%20alcoholmeter.pdf #eudp #gdpr #LawEnforcementDirective

The #CNIL fines an e-scooter firm for tracking the #geolocation of its #escooters every 30 seconds without purpose limitation. Challenges also on informing them or establishing a legal basis for tracking. Even if in a separate database as easily cross referenced to users. While not special category data, CNIL calls location ‘highly personal’. Company could also not demonstrate effectiveness of this geolocation for finding lost scooters. https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047346903?isSuggest=true #GDPR #RGPD #eudp #dataprotection

at least #Microsoft’s reported integration of #GPT4 into #Bing saves regulators the back and forth of ‘is a large language model processing personal data’ (spoiler: often) because now they can just look at the Google Spain case.

Yet how will Microsoft comply with right to be forgotten requests? https://medium.com/@owenyin/scoop-oh-the-things-youll-do-with-bing-s-chatgpt-62b42d8d7198 #LLMs #chatGPT #eudp #rtbf

Incredible to see Dutch privacy legend @sjoera Nas profiled in the New York Times for her and colleagues' groundbreaking work on public sector #dataProtection, slowly transforming giants like Microsoft, Zoom and Google and forcing significant changes. #edTech #eudp #gdpr https://www.nytimes.com/2023/01/18/technology/dutch-school-privacy-google-microsoft-zoom.html

Full judgment to come, but @Curia CJEU rules today that controllers cannot get away with providing just "categories" of data recipients when they hold the actual data on who they transferred to. Important for strengthening the #RightOfAccess to ensure forward provenance is as a strong as backward provenance, to track complex data chains. Ruling in C-154/21 Österreichische Post (Informations relatives aux destinataires de données personnelles), press release https://curia.europa.eu/jcms/jcms/p1_3869656/en/ #GDPR #eudp

The incredible Orla Lynskey (LSE) is giving a #CurrentLegalProblems lecture at UCL Laws in-person on 2 February. It's entitled "Effective or Complete Data Protection" — can it really be both? Register https://www.ucl.ac.uk/laws/events/2023/feb/person-effective-or-complete-data-protection #dataProtection #GDPR #eudp

I'd missed this pending judgment on #LectureCapture and #DataProtection in employment context, with its AG Opinion already out @lilianedwards @tnhh (Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer) https://curia.europa.eu/juris/document/document.jsf?text=&docid=266121&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5802 #eudp #gdpr #workersrights

The hearing for the first ever CJEU @Curia #Article22 #GDPR case, SCHUFA Holdings, on whether the upstream creation of profile for #CreditScoring that will be influential downstream will be a significant, automated decision, is scheduled for the 26 January 2023.

@RDBinns and I wrote about the underlying conceptual quandaries the Article 22 definition creates in IDPL here. Not clear how the court will deal with them. https://doi.org/10.1093/idpl/ipab020 #eudp #privacy #algorithms

Amazing work by @EDPS setting up a #PeerTube account for #eudp videos in the fediverse! You can follow other fediverse applications as if they were on Mastodon: just put your username (without the first @) in 'Subscribe' at the video link https://tube.network.europa.eu/w/4unihHaPLjejmxHoz4Xm6t, and you'll be following @edps_tv. And if you either reply to the video within Mastoson (paste the URL into search), or use the comment feature on the page with your Mastodon username, your post will appear below the video!