Search

Case of Breyer v Germany Application no 50001/12 (ECtHR, 30 January 2020) The Breyer judgment concerns the storage of subscriber data by telecommunications service providers. To the Court, the collection and storage of such data amounted to interference of a rather limited nature. Additional safeguards were provided in the relevant German laws and there was independent supervision by the data protection authorities. The German lawmaker had not exceeded the margin of appreciation. There had been no violation of Article 8 of the European Convention on Human Rights.

Creation of the European health data space is one of the core actions promoted by the European Commission in the EU Data Strategy. This task is challenging due to technical, organizational, economic and other issues that require different measures. This paper focuses on the issues in the legal field and identifies four key legal areas where the creation of a European health data space may face obstacles or may influence its development. These areas are: 1) rules on the provision of healthcare in the Member States; 2) protection of personal data in healthcare provision and medical research; 3) control and use of non-personal data and 4) the regulatory framework on AI. The article provides the analysis and comparison of these areas to submit the systemized view on causes and consequences of the identified issues and to suggest the vision of the further legislative process related to the European health data space.

After outlining the relevant regulatory provisions governing access to the Internet in the EU (section 2) and its Member States (section 3), and after summarizing arguments supporting the introduction of the right to Internet access, the authors seek to broaden the scope of social and legal debates on Internet access in the EU. In particular, they question (a) whether the Internet is a vital element to achieve a decent standard of living in the Gigabit society (section 4); and (b) whether it deserves a place alongside the fundamental rights or human rights (section 5) and under what conditions it could be incorporated among the EU fundamental rights (section 6). The following sections of the chapter reflect on the potential scope of a right to Internet access (sections 7 and 8) and how eGovernment could facilitate the introduction of such a right (section 9). Considerations about limitations of a right to Internet access are addressed in section 10. Access to the Internet is inherently an Internet governance matter and therefore its regulation should entail a multi-stakeholder debate. Access to the Internet then would be seen not only in a technical way as a communication service but as ‘the set of devices, services, facilities and skills that allow people to connect to and use Internet services, applications and content’. Perhaps, this shift in approach could strengthen the EU’s role within the broader context of Internet governance. The authors suggest that the EU debate on Internet access should employ a human rights-based approach to Internet access because the social benefits brought by the Internet cannot be defined by numbers. The authors conclude that acknowledgment or recognition of Internet access as a fundamental right would be valuable as it would encourage policy- and law-makers, as well as civil society, to reconsider the scope and limitations imposed on this right.

Online evidence has been indispensable in criminal matters but due to its transnational and volatile nature, there have been issues and challenges as regards access, transfer, and usage in criminal investigations and prosecutions. In recent years, practices have been established to overcome the hurdles of cross-border access to online evidence. One of these practices is direct cooperation between law enforcement authorities and data companies, the latter of which are mostly based in the US. While this cooperation has been less blatant and apparent in its earlier years due to the want of legal basis, law enforcement authorities have been less coy towards the practice more recently. The present contribution walks the reader through the recent developments on codifying the practice of direct cooperation between European law enforcement authorities and US data companies. These developments evince how law enforcement authorities are willingly and wittingly overlooking protective safeguards and issues that ought to be addressed and thoroughly discussed. By sanctioning a relationship of direct cooperation, not only are state interests affected, but likewise issues of trust, MLA rights, privacy and data protection are affected. There ought to be a thorough discussion on these issues and hopefully the lessons learned from the recent CJEU judgments and the German Federal Constitutional Court are taken into consideration.

This Contribution focuses on the use made by the Belgian Constitutional Court, the Cour de Cassation and the ordinary courts of the right to privacy and the right to have personal data protected as anchored in the Belgian Constitution, the Belgian Data Protection Act and the European sources. A selection of their judgements, all dating from the era before the new EU Data Protection Regulation, are discussed along the lines of their impact on health privacy, workplace privacy, surveillance and social media privacy. Our analysis shows a great deal of European loyalty on behalf of the Belgian Constitutional Court towards European trends to favour privacy and data protection. In stark contrast stands the case law of the Cour de Cassation mainly focused at preserving prosecutorial interests and employer’s interests at the detriment of privacy and data protection interests. In our conclusions we discuss tendencies towards cosmopolitanism and tribalism, the dramatic impact of evidence law and patterns of litigation. Our analysis covers the data protection era where Belgian law was indirectly governed by EU Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23 November 1995, 31). The Directive contributed to the roll-out of data protection and harmonized the data protection provision in the EU Member States but suffered from implementation weaknesses and lack of recognition. A certain lack of recognition of the importance of data protection in the European (and Belgian legal) landscape disappeared with the the EU General Data Protection Regulation 2016/679 (“GDPR”) (OJ L 119, 5 Ma.2016, 1–88 ) that repealed Directive 95/46/EC and came into force on 25 May 2018 with direct applicable provisions. Further studies are needed to study the impact of the new European provisions on the work and output of the Belgian courts.

Over the past few years big data analytics have forcefully entered the mainstream. Admittedly, mod- ern life would be inconceivable without the services afforded by this type of processing in the field of electronic communications. At the same time public administrations are increasingly discovering the benefits of big data analytics afforded to them by telecommunications operators. Nevertheless, despite public attention and high volumes of expert analyses, the majority of approaches on the challenges to personal data protection by this type of data processing remains theoretical; Tellingly, the EDPS speaks of the “black box” of big data analytics. However, the authors were able to open, and stare into, the “black box” of big data analytics in the electronic communications field in 2017 and 2018 in the context of GDPR compliance assessments. Their analysis first attempts to set the legal scene today, answering two crucial questions on scope and applicable law, before presenting a typology for a scalable and granular approach that the authors feel is necessary but nevertheless is missing from the text of the draft ePrivacy Regulation. The authors therefore conclude that processing requirements and particularities, as evidenced under the big data analytics paradigm, make necessary a much more detailed approach than the one afforded by the draft ePrivacy Regulation today. Until these needs are met, through the introduction of a new, fundamentally amended text, the authors suggest that the current regulatory framework and the mechanisms afforded by it be extended for an interim period, so as to afford legislators with the necessary space and time to revise their work.

The General Data Protection Regulation provides new tools and concepts such as Data Protection Impact Assessments, accountability and certification, but to a large extent retains the rationale of the Data Protection Directive for a principles-driven legislation. One of the cornerstones of both the reformed and new EU data protection legislation is the grounds for lawful processing. Much debate has taken place over consent and the conditions for a meaningful informed choice of the data subject, while other grounds have not been at the spotlight of academia and practitioners. The legitimate interest of the controller has been one of the least discussed legal grounds for lawful processing, with a few exceptions, mainly the opinion of the Article 29 Data Protection Working Party, despite its significance as equally binding ground for processing. This contribution analyses the concept of legitimate interest of the controller of art. 6 (f) GDPR in relation to art. 7 (f) of the Data Protection Directive 95/46/EC and the interpretations of the concept by the Court of Justice of the EU and the Article 29 Data Protection Working Party.

This in-depth analysis was commissioned by the European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs at the request of the LIBE Committee. One cannot talk of a proper data protection regime in China, at least not as it is perceived in the EU. The international data protection fundamentals that may be derived from all relevant regulatory instruments in force today, namely the personal data processing principles and the individual rights to information, access and rectification, are not unequivocally granted under Chinese law. An efficient enforcement mechanism, also required under European standards, is equally not provided for. China has no comprehensive data protection act but several relevant sectorial laws that, under a combined reading together with basic criminal and civil law provisions, may add up to a data protection ‘cumulative effect’. This assertion is examined and assessed in the analysis that follows. A list of realistic policy recommendations has been drawn up in order to establish whether China’s recent data protection effort is part of a persistent, yet concise, policy.

At a time when cloud computing industry is developing rapidly, mainly due to the flexibility and the cost minimization cloud computing offers, ISO and IEC developed a new standard on cloud computing to deal with issues of protection of PII and security of information. The new standard aims to address the down-sides of cloud computing and the concerns of the cloud clients, mainly the lack of trust and transparency, by developing controls and recommendations for cloud service providers acting as PII processors. The article examines the strengths and weaknesses of the new standard, its added value to the cloud computing landscape and to data protection, as well as its relation to the European Personal Data Protection framework.

This study aims, fi rst, at identifying data protection shortcomings in the inter-agency cooperation regime in the EU criminal justice and law enforcement area and, second, at outlining, under six possible scenarios, the interplay among the data protection legal instruments in the law-making process today in fi eld, as well as, the response each could provide to such shortcomings.

What is the current legal data protection framework for the Area of Freedom, Security and Justice (AFSJ) personal data processing and what framework could be created in the near future? These two questions are constantly recurring in the EU data protection field, particularly after the ratification of the Lisbon Treaty. The amendment of the EU data protection regulatory framework currently under way offers a unique opportunity to re-evaluate past regulatory options and plan for the future.

The recent release by the European Commission of the first drafts for the amendment of the EU data protection regulatory framework is the culmination of a consulting and preparation process that lasted more than two years. At the same time, it opens up a law-making process that is intended to take at least as much time. The Commission has undertaken the herculean task to amend the whole EU data protection edifice, through the introduction of a General Data Protection Regulation, intended to replace the EU Data Protection Directive 95/46/EC, and a Police and Criminal Justice Data Protection Directive, intended to replace the Framework Decision 2008/977/JHA. This paper shall focus at the replacement of the EU Data Protection Directive by the draft General Data Protection Regulation. Due to the fact that the draft Regulation is a long (and ambitious) text, a selection has been made, with the aim of highlighting its treatment of basic data protection principles and elements, in order to identify merits and shortcomings for the general data protection purposes.

Academics and practitioners have been using the idiom of a 'toolkit' or 'toolbox' for governance regulatory policy, both in general and with specific application to controlling the invasive effects of technologies on human values. With regard to the latter, the regulatory instruments are now usually considered mainly to be laws and a large variety of 'privacy-enhancing' technological measures, about which there has been a burgeoning of interest. Working in this idiomatic 'toolbox' frame of reference has some advantages, but also some important drawbacks and inadequacies, conceptually, empirically and normatively. This paper explores this terrain, concentrating in particular on the relationship between legal, technical and other regulatory options. Emphasising the importance of actors and institutions, it looks critically and constructively at the 'tool' formulations of Lawrence Lessig and others. It suggests that we need new departures in thinking about regulation that draw upon these sources but go beyond them, both in terms of the 'tools', their effects, their power and normative dimensions, their regulators and the jurisdictional levels at which the regulation of technologies and their consequences is now required. Christopher Hood's The Tools of Government, a general work within political science, offers relevant further analytical equipment. His description of a range of regulatory tools and their combinations and substitutions allows for an improved understanding of how regulators can operate.

In this article the authors discuss the interoperability of police data bases in the EU with reference to the 24 November 2005 Communication from the Commission to the Council and the European Parliament on improved effectiveness, enhanced interoperability and synergies among European databases in the area of Justice and Home Affairs. The authors identify different levels of interoperability. Straightforward interoperability within the EU is distinguished from four more controversial levels of interoperability, such as interoperability with atypical systems and interoperability with systems outside the EU. On the basis of this analysis the question of the desirability and suitability interoperability will be addressed, followed by a discussion of the necessary guarantees to be included. Contrary to what is often suggested, interoperability is a highly sensitive political issue. The attempt of the Commission's 2005 Communication, to make it look like a mere technical issue does not create the right context for a serious and in-depth discussion.