GDPR & DATA PROTECTION CONSULTANTS

 Protecting your business is our business!

GDPRXpert is here to help you navigate through the maze of new elements introduced by the GDPR and the ePrivacy Regulations. GDPRXpert specialises in data protection advice and consultancy, with a strong focus on the General Data Protection Regulation, and the ePrivacy Regulations  (S.I. No.336 of 2011),  under which the old ePrivacy Directive , 2002/58/EC, was transposed into Irish law. The Law Enforcement Directive (LED) is a very  specific piece of EU legislation  that is parallel to the GDPR but lies  outside its direct scope. Personal data processing for  law enforcement purposes is properly scrutinised through the lens of the LED, as primarily transposed into Irish law through Part 5, Data Protection Act 2018. Such processing lies outside the scope of the GDPR.  However, in the case of disputes and doubts much will be interpreted in light of the GDPR, especially the GDPR  principles.

In particular, since the introduction  of the General Data Protection Regulation (GDPR), the data protection regulatory landscape has been irrevocably altered. A seismic shift has taken place because of the increase in the obligations and responsibilities now placed on many organisations. At the same time, the rights of the general public in relation to the processing of personal data have been strengthened.

You must be processing personal data to be subject to the GDPR. If this is the case , organisations involved in the processing of  that personal data now have a higher burden of obligations and responsibilities. Since May 2018,processing of personal data in the context of certain electronic communications ( including , amongst other things,unsolicited electronic communication made by phone, e-mail and SMS) is subject to both the general laws set out out in the GDPR, and the more specific laws of the ePrivacy Regulations. The  new EU ePrivacy Regulation is still pending but is unlikely to come into effect before 2021 as negotiations on the draft  text are ongoing.

Our expertise lies in translating all of  these  complex  legal and regulatory requirements into cost effective and practical  operational solutions for your business or organisation. The ultimate goal is compliance with all of the new regulatory requirements and data protection principles. In order for you to reach that goal,  GDPRXpert will ensure you meet  all the  transparency and accountability criteria.

GDPR

SERVICES

GDPR Introductory Consultation

GDPR Xpert will get you started on the road to compliance with an initial consultation.

Read More

Data Protection Impact Assessments

GDPR Xpert will carry out a full risk assessment based on the GDPR and all associated guidelines.

Read More

Data Protection Officer Outsourcing

GDPR Xpert will carry out the roles, functions & duties of the DPO in an independent manner.

Read More

Data Protection Audits

GDPR Xpert will conduct a comprehensive audit to verify the true level of compliance with the  GDPR.

Read More

Staff Training and Re-Training

GDPR Xpert encourages employee training and /or retraining, that is quite specific to your organisation.

Read More

Privacy Notices/Privacy Policy Statements

GDPR Xpert will draft a Privacy Notice for your business or organisation that will comply with the  GDPR.

Read More

GDPR AND YOU

Maybe your organisation does not process any personal data?

The definition of ‘personal data’ has been expanded under the new Regulation and now covers: …“any information relating to an identified or identifiable natural person(‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”. ( Art. 4(1), GDPR)

Maybe your organisation does process personal data?

This new definition of personal data covers many different types of personal data. If your organisation processes such data then you are subject to new responsibilities and obligations under the GDPR.
GDPRXpert is cognisant of these robust new obligations and responsibilities, and especially their positioning in the new data protection architecture. With a background in law, business and data protection, GDPRXpert is ideally qualified to offer professional advice in this complex area. Once it is clear that your organisation is processing personal data, the prudent thing to do is seek that expert advice. GDPRXpert is here to ensure that you and your organisation are processing that data in accordance with data protection principles, are transparent and accountable, and are compliant with all aspects of the new Regulation.

Remember! We are the GDPR and  Data Protection Experts. You don’t need to be an expert. You just need to be compliant. Our expertise will get you there safely.

Recent Articles

Homepage List
06/06/2022UncategorisedThe  DPC is  under pressure from critics with varied agendas. The backdrop for all of  this has to be criticism from late last year,  especially the criticism of the handling of some cases investigated by the DPC . Much of this criticism, perhaps unexpectedly, came from other EU  Data Protection authorities, and more from journalists, commentators, interested actors ( some perhaps with questionable motives) and data protection practitioners. In the foreground will be the DPC’s recently announced 2022-2027  regulatory strategy, which is timely in light of all the criticism  levelled at the DPC of late. An annual report  from the DPC is also  informative and its timing is helpful to the public and for the morale of staff at the DPC. It is available here for your convenience. In some opening remarks to the new regulatory strategy the DPC acknowledges that  some “challenges, against a backdrop of hugely increased public consciousness of data protection, have given rise to ambiguities of interpretation and application of the law that the DPC – along with its peer data protection authorities – must work to clarify”. The regulatory strategy is also “being implemented in the very early years of radically reformed data protection legislation – in the form of the GDPR and ancillary Law Enforcement Directive – along with all the attendant interpretative challenges that such immense regulatory change usually produces”.   The DPC “recognises that it cannot achieve its ambitions alone – new partnerships and new ways of engaging will be necessary as we look towards a future of closer convergence. Nonetheless, the DPC builds from a position of confidence: we are a Regulatory office with ambition, a clear sense of purpose, a history of achievement, and a future of considerable promise”. This last sentence will be questioned by many and it will  irritate even more. It can hardly be stated with any conviction  that the DPC builds from a position of confidence and a history of achievement.  If anything, maybe it has underachieved, but that is for another time and forum. Another sentence,  “The DPC is of the belief that compliance in general will be greatly improved when stakeholders are clear in their understanding of how the law is enforced”, holds the essence of much of the criticism levelled at the DPC. Stakeholders are not clear in their understanding of how the law is enforced and  many of these stakeholders are other EU Data Protection authorities who have their own  expertise in knowing and applying the GDPR, in particular. A stated goal in the new strategy is to bring clarity to stakeholders. This is  easily stated as a goal to aim for, but again, sure to irritate many . Data protection law experts GDPRXPERT .ie  take the view that  the direct and primary  strategy to achieve this goal will not be stated as easily. Two aspects will be key: having a clear goal, and knowing the most effective route to get to that goal. Compromises will  be needed along the way as there are so many stakeholders involved.  Ultimately, although the most effective route may well be signposted, there will be necessary diversions along the way in the interest of overall stakeholder consensus. Pragmatism has to guide any strategy where there are legitimate and valid  competing interpretations of any regulation. In this context, the co-operation and consistency mechanism under GDPR is a clear example of necessary deviation from a legitimate route to a destination. GDPRXPERT previously looked at issues in relation to the workings of the  office of the DPC ( see https://www.gdprxpert.ie/the-dpc-is-not-infallible/). We can say that some  of the more recent  criticism levelled at the office of the DPC  is unjustified, some is justified, and more is premature. There is premature criticism because  the CJEU still is going to have to interpret some aspects of the GDPR  so that at least there is more clarity ,if not 100% certainty,  in relation to some contentious aspects of the GDPR. It is not surprising that some of the criticism of the DPC  consistently emanates from the same sources, and one has to consider the possibility that some of these sources have their own particular agendas. Some of these  agendas  have very little to do with bolstering the  data protection environment  for any data subject. These agendas are more  to do with  using supposed concerns about  data protection as a  shallow conduit to increase their own profiles.  Repetitive sources that spring to mind include Max Schrems and his NOYB organisation, The Irish Council for Civil Liberties , and  some Euro MEPs who are sceptical about everything, including  their own fellow sceptics. Recent Criticism. From the inception of the GDPR  it became clear that the role of the Irish DPC would be central in the overall enforcement of the Regulation. There was no way it could be other than central, having so many global tech companies head quartered here. Indeed, there is much anecdotal evidence of regulators in other jurisdictions not exactly wishing the office of the DPC the best in their GDPR enforcement endeavours. Unquestionably, some regulators in more populous  countries  felt slighted by the stronger role the DPC here was destined to play. This was shared by many MEPs with nationalistic fervour, as opposed to  European commitment . There was a similar sentiment expressed for years in relation to Ireland’s corporation tax regime. It may be that criticisms that gained media attention at the end of 2021 had their origins in similar nationalistic contexts. For example, several members of the European Parliament (MEPs) recently wrote to the EU authorities and Minister for Justice Helen McEntee accusing the Irish DPC of lobbying for lower standards for big tech. This was vehemently denied by the DPC. It seems to expert data protection consultants, GDPRXPERT, that these criticisms were outlandish. At the core is an allegation that the DPC was acting in bad faith and devoid of objectivity. This was particularly the case in relation to the criticism directed at the DPC concerning some of its interactions with Facebook. DPC response The DPC responded by stating, “ There has been considerable media coverage in recent days, alleging that the Data Protection Commission (DPC), acting in bad faith on foot of meetings it held with Facebook as part of its regulatory role, “lobbied” the European Data Protection Board (EDPB) with a view to achieving the adoption of guidelines by the EDPB on Article 6(1)(b) GDPR (‘necessity for the performance of a contract’), in the best interests of the company. These allegations are utterly untrue. Issuesrelating to the proper legal interpretation of the necessity for the performance of a contract are presently the subject of an ongoing regulatory procedure. That procedure is currently being conducted under  Article 60 of the GDPR. (Art. 60 GDPR sets out the scenarios for co-operation between the lead supervisory authority and other supervisory authorities concerned over the same issue.) More significantly and separately, Article 6(1)(b) is the subject of proceedings before the Court of Justice of the European Union.”   As referenced earlier, the objective in going to the CJEU is to get clarity on an issue where it may not be possible to get certainty. There is not always going to be ‘a one size fits all’ decision. From  a pragmatic perspective, often the best that can be expected is clarity, as opposed to certainty. Circumstances change from case to case and so much within the GDPR  has valid differing interpretations. Differing interpretations are consistent with a  regulation that has to be interpreted and applied in light of other competing rights. It has also  been alleged that the DPC approved/ negotiated/ jointly developed Facebook’s position in relation to the legal basis for its processing operations. “This is absolutely incorrect and without basis in fact. To be clear, the DPC does not and never has, endorsed, jointly developed, approved or in any other way assented or consented to a controller’s or processor’s policies or position in relation to compliance with its data protection obligations”( DPC statement, 7th December, 2021). Form of the criticism A central tenet of the criticism in relation to the DPC’s dealings with Facebook on the issue of contract as a lawful basis for processing is that the DPC sought to subvert the procedures of the EDPB with a view to achieving the adoption of guidelines by the EDPB on Article 6(1)(b), favourable to the interests of a particular controller. As a long established data protection advisory service, GDPRXpert.ie  would reject that  immediately. What can be accepted is that issues relating to the proper legal interpretation of the necessity for the performance of a contract are presently the subject of an ongoing regulatory procedure. The outcome of the procedures to which reference is made above will of course bind controllers and regulators alike, and may determine whether, when, and in what circumstances Article 6(1)(b) may be relied on by controllers as providing a legal basis for certain of their personal data processing operations. Some critics of the DPC seem unaware themselves of the process that precedes the issuance of any  guidelines from  the European Data Protection Board on the interpretation of any concepts inherent in the GDPR. Amongst other things, according to the DPC, the criticism  also “reveals a lack of any kind of basic understanding of the workings of the EDPB, and how, through an iterative process, divergent views relating to complex issues of principle are typically reconciled through dialogue, and through respectful and mature engagement”. ( DPC statement, 7 December, 2021) It is a common sense expectation that stakeholders’ compliance level will improve when they are clearer in their understanding of how the law is enforced. This is especially so when regulations such as the GDPR are based on some very broad principles, ( See Art.5 GDPR) rather than specifics, thus making regulations more open to  interpretation than, for example , road traffic legislation. No wonder then that the DPC is involved in so much discussion with other Supervisory Authorities in other EU countries, and other stakeholders, with the goal of increasing certainty and stability in how data protection law is to be applied. If  the DPC is doing this  in good faith, then can any criticism be justified? Increased certainty and stability is to the benefit of all stakeholders. This has been a consistent prong of attack for critics of the DPC but what is often ignored or denied is the complex nature of many of the issues involved. As with all EU regulations the CJEU is the final arbiter in the case of dispute, and the journey to that final point is long and arduous. Along the way, many  opinion writers  are guilty  of unprofessionalism in  simply repeating the same sources and quoting incorrect statistics. One of the most vocal critics of the DPC before and since the GDPR has been Max Schrems. Schrems  No:1 and No: 2 dragged on for years, but through no fault of the DPC. A closer look at these cases may  enable a clearer understanding of the legal obstacles to be overcome in order to avoid the procedural pitfalls embodied in much of the GDPR.  They also should  demonstrate the complicated nature of the legal and regulatory remit of the office of the DPC. Warranted criticism? The painstaking nature of the legal processes that must be gone through to make prudent adjudications on data protection law issues leads to unfair criticism being directed at the DPC. Such criticism usually takes the form of hastily made statements to the press citing inaction by the DPC. These statements are often perceived as facts by some journalists who lack  an  understanding of both  the depth of data protection  issues involved and the consequences of a misapplication of the facts. Criticism is often then repeated without any objective analysis. Some  analysis that is carried out is done by those least qualified to do it.  Again, data protection law advisers GDPRXPERT.IE  would reject such criticism as ill-informed at best and strategically devised at worst.  If one takes the High Court judicial review taken by FBI, , the judgment runs to 200 pages and  is deserving of more than a cursory perusal by some commentators who later claimed to be expertly knowledgeable. What was clear from their comments was that,  in all likelihood , they  had hurriedly  skimmed through a few pages. Schrems  seems to have  taken matters somewhat personally  and accused the DPC of failing to make a decision.  In fact, much of his criticism seems to take the form of personality based attacks rather than legal or principles based formats. He seems to never have forgotten that his original complaint  was dismissed on grounds of frivolity  by the DPC. This seemed a reasonable view at the time, and it was only in the aftermath of the full revelations by Edward Snowden that the scenarios took on a different texture.  However, what was lost on Schrems,  who is himself a lawyer, was that, as pointed out by Bermingham  J in O’N v McD  IEHC 135, “the words frivolous and vexatious are terms of the Article, they are legal terms and they are not used in a pejorative sense. They merely mean the plaintiff has no reasonable chance of succeeding, and that , because there is no reasonable chance of success, it is frivolous to bring the case”. Defensive position A position  taken by the DPC was that once an adequacy decision (here, the Safe Harbours Agreement) had been issued, the office had no part in investigating a complaint. This has always been the accepted view in relation to Commission decisions . For example, in Schrems No. 1  the CJEU stressed that while national authorities retained the ability to examine EU decisions, the CJEU alone retained the authority to declare an EU act (such as a Commission decision) invalid. It was clearly not within any legal remit of the DPC to act as a quasi court of last resort.  Safe Harbours itself stood as testament to the adequacy of the protection of transfers of personal data to the US.  Mr Justice Hogan in the High Court thought Schrems was objecting more ‘to the terms of the Safe Harbour regime itself’, than to the DPC’s application of it. (Schrems v DPC IEHC 310 (18 June 2014) Para.69).  Another position taken by the DPC was that the complaint ( the original) was essentially speculative and hypothetical in nature.  However, Mr. Justice Hogan took the view that there was no need to establish that the applicant had even grounds to suspect such a breach had occurred. It was enough to believe the mere absence of controls might lead to a breach of the applicant’s rights. If the matter was solely governed by Irish law significant issues would have arisen under the constitutional right to privacy. Mr Justice Hogan referred the case to the CJEU partly on the basis that, ‘in reality, on that key issue Irish law has been pre-empted by general EU law in the area…’  Facebook appealed this  referral to the CJEU but the Supreme Court did not find reason to block  it. The Court held it could not entertain an appeal over the fact of a referral itself. There had to be inconsistencies with the   ‘facts’ found by the High Court . The Court held  (through Clarke J.)  it  could only overturn those if it could  be established they were not sustainable in accordance with the relevant Irish jurisprudence. Having reached the CJEU ,the decision known as Schrems I, was finally made in Oct. 2015.  In that ruling, the CJEU quashed the Commission’s Decision, meaning that the US Safe Harbours could no longer be relied on as providing a legal basis for transfers of personal data to the US. It was in fact to enable a decision to be made that the DPC referred the case to the High Court in the first place. The idea was to get a decision  for once and for all from the  CJEU. This course of action has been assessed as rational, prudent and proper by EU Justice Commissioner  Didier Reynders. Indeed, the action was widely praised although some ( including some MEPs) did not agree but Commissioner Reynders was categorical in stating,  “the DPC faces “complex” matters, including in an issue over the targeting of ads by social media companies. Support for DPC The Irish regulator has supported the idea of allowing social media companies to target users with adverts without their consent, on the basis of rules governing the performance of a contract. Many other European national data regulators oppose this stance and some have criticised the DPC’s position. However, Mr Reynders reminded the MEPs that the issue of advert targeting as it pertains to Facebook has already been referred to the EU’s court of justice in the context of contract law, essentially backing the Irish regulator’s decision to weigh the issue carefully. Remember this;  at the very start Hogan J in the High Court had stated that the DPC had “demonstrated scrupulous steadfastness to the letter of the 1995 Directive and the 2000 Decision”. Commissioner Reynders  also backed the DPC by dismissing criticism that it is running late in its handling of 98 per cent of cross-border privacy cases: “The figure about the proportion of cases dealt by the Irish DPC mentioned in your letter appears to be a misinterpretation of the statistic.” Any criticism of the bona fides of the DPC regarding the original  Schrems case was, and is ,unjustified and cannot be legitimately upheld. Meanwhile, Facebook Inc. switched to “standard contractual clauses” to transfer EU data to the U.S., to which Schrems responded by updating his complaint with the DPC to include this new transfer mechanism which launched Schrems No:2. Although apparently not known by Mr Schrems at the time, FBI had identified three legal bases for ongoing transfers to the US. These were standard contractual clauses (SCCs), transfers with the consent of the data subject and transfers under the contractual necessity derogation in the then Directive.  In fact, it was the DPC that had  invited Schrems to reformulate his complaint in light of the judgment in Schrems 1 and in light of the fact that Safe Harbours had been found to be invalid. On Dec.1  2015 Schrems submitted a reformulated complaint using the validity of the standard contractual clauses as the prong of attack. End in sight In May 2016, the DPC issued a draft decision stating that the DPC had formed the view on a “preliminary basis” that Max Schrems’s contention that the SCCs could not be relied on was well founded. However, in the DPC’s view, questions as to the validity of the SCCs could only be determined by the CJEU, not by the DPC, or by national courts. The DPC therefore immediately commenced further proceedings in the Irish High Court seeking a reference to the CJEU. Following an unsuccessful appeal by Facebook Ireland Ltd. (FBI) against the High Court’s decision to refer a range of questions to the CJEU, these proceedings   ultimately led  to the CJEU’s Schrems II ruling in July 2020. It is worth noting that in the meantime the European Commission had adopted a Decision that the Privacy Shield, as a replacement for the Safe Harbor, now ensured an adequate level of protection for personal data transferred from the EU to the US. Furthermore the GDPR had replaced the former Data Protection Directive, coming into force in May 2018. The Schrems II ruling established that, although the SCCs remained valid, a data exporter in the EU making use of them is nevertheless required to verify, on a case by case basis, and taking into account their terms, whether the law and practice in the destination country ensures essentially equivalent protection for any transferred data . At particular issue was the ability of public authorities in the destination country to conduct surveillance on the transferred data.  The CJEU had specially concluded that EU citizens had no effective way to challenge American government surveillance of their personal data after it had been sent to the U.S.  Such surveillance was legal under U.S. law. If the data exporter is not, as far as is necessary, able to put in place sufficient supplementary measures to guarantee essentially equivalent protection, the data exporter, or, failing that, the relevant data protection authority, is required to suspend or end the transfers. In the ruling, the CJEU also went on to quash the Commission’s Decision on the Privacy Shield. Getting closer In August 2020 , the month following the CJEU’s ruling in Schrems 11,  the DPC wrote to FBI enclosing the PDD that was subsequently the subject of the FBI’s judicial review application. This gave FBI 21 days to respond and stated that the DPC was now undertaking an “own-volition” inquiry into FBI’s data transfers after which it would return to Max Schrems’ original, reformulated complaint. At that stage the situation was that if the Preliminary Draft Decision of the DPC  was translated into a final decision , then Facebook would be required to suspend its data transfers to the US.  However Max Schrems appears to have taken exception to his apparent exclusion from proceedings and submitted his own application to the Irish High Court for judicial review of the DPC’s approach. Settlement was subsequently reached between the DPC and Max Schrems on this judicial review application in which the DPC agreed, upon the Court’s lifting of the stay of its investigation, to progress the handling of Max Schrems complaint and its “own-volition” inquiry as expeditiously as possible. FBI took exception to the issuing of the PDD on several grounds relating to unfairness including procedural unfairness and instigated judicial review proceedings against the DPC with a consequential stay on the DPC’s “own-volition” inquiry. The case was heard by the Irish High Court in December. What we now know We now know that on 14  May 2021  the Irish High Court handed down its judgment in the judicial review case brought by Facebook Ireland Ltd (FBI)against the DPC, finding substantially in favour of the DPC. Although not entirely uncritical of the DPC, the judgment accepts the validity of the approach adopted by the DPC in its investigation of FBI’s data transfers. The Court did agree with FBI that the issuing of the PDD and the surrounding procedures were open to judicial review and therefore went on to consider, in some depth, each of the grounds of challenge advanced by FBI. In the course of proceedings, FBI dropped two of these grounds. The remaining grounds were all rejected by the Court, the overall conclusion being that FBI had not established any basis for calling into question the validity of the DPC’s processes. It is reported that on 20 May and with consent of the parties, the Irish High Court formally lifted the stay on the DPC’s “own-volition” inquiry. FBI  still had the opportunity at that time  to respond to this PDD but, unless it could  satisfy the DPC as to the safeguards in place for its international transfers to the US, it seems likely that, following the application of the GDPR’s cooperation and consistency mechanism, FBI would  be ordered to suspend these transfers. Judgment time The High Court judgment when it came was lengthy and detailed, running to nearly 200 pages. For the most part, it addressed procedural points which, given that that the findings went against FBI, are unlikely to be particularly instructive for other businesses. The picture is also made more complex by the involvement of Max Schrems himself as a participant in the hearing and by his own application for judicial review against the DPC. This application was settled between the date of the High Court hearing and the date of the delivery of its judgment and is referred to in the judgment. There is thus little to be gained from an in depth analysis of all aspects of the judgment. It might nevertheless be of value to recap just where we are now, and how we have arrived there, in the long running saga of Max Schrems and his challenges to FBI’s international data transfers. Some high level insights can also be drawn about the conduct of major investigations by data protection authorities which might be instructive. Finally, there remains an open question as to where this now leaves other businesses that are continuing to transfer personal data to the US on the basis of the European Commission’s Standard Contractual Clauses (SCCs). It was  clear from the judgment that the DPC’s preliminary view, as set out in its PDD, was that; US law did not provide a level of protection that is essentially equivalent to that provided by EU law; SCCs cannot compensate for the inadequate protection provided by US law; FBI did not appear to have in place any supplemental measures which would compensate for the inadequate protection provided by US law. More support for DPC The High Court judgment was  undoubtedly welcome news for the embattled Irish Data Protection Commissioner, Helen Dixon. She had, and continues to, come under fire from many sides, including the European Parliament’s LIBE Committee, for what is perceived to be a reluctance to take sufficiently strong enforcement action against major tech companies that have their European headquarters in Ireland and for her office’s long processing times. The LIBE Committee even expressed disappointment with her decision to initiate the Schrems II case rather than triggering enforcement action against FBI. Furthermore, the Committee  has called on the European Commission to launch infringement proceedings against Ireland for a failure to enforce the GDPR effectively. Against this background, the judicial review case makes clear that DPC was right to have proceeded cautiously. When faced with enforcement action that seeks to significantly restrict their business models or when faced with multi-million euro fines businesses will understandably look for legitimate avenues to challenge the actions of data protection authorities, whether through more conventional appeals against sanctions or by means of judicial review. Any data protection authority needs to have a defensible position that it can put before the courts when challenged. The DPC has survived an examination by the Irish High Court and there can be no denying that it was a comprehensive and searching examination. Had the DPC been found to have jumped to conclusions without a thorough investigation, not to have been offering FBI a proper opportunity to state its case, otherwise followed procedures that were unfair to any of the parties involved or had not been sufficiently transparent about those procedures, it would almost certainly have come a cropper. Ensuring the necessary procedural fairness requires time and effort by a data protection authority whatever the political pressures on it might be. At the time there was a concerted and shallow choreography of criticism directed at the DPC. The High Court did  recognise that there has to be some flexibility. A data protection authority can legitimately be expected to continue a well-established practice of following a particular procedure but, provided that it stays within the law, it does not have to do so rigidly. It can adapt its approach to the circumstances of particular cases. It is just that any procedural variation by the data protection authority has to be based on objective reasons and must not create unfairness or be unjust to the party under investigation. Nothing was written in stone. An earlier  annual report, detailing inquiry  procedures that Facebook sought to rely on, did state  ( at p.28) things were “subject to changes”. ( See DPC Annual Report 2018) Rebuke for DPC The DPC did not entirely escape criticism though. The High Court judge, whist finding in favour of the DPC in relation to an allegation of premature judgment, suggested that it might have been wiser for the Commissioner, Helen Dixon, to have been more circumspect in remarks she made in a conference address to the effect that the Schrems II ruling by the CJEU had given her no room for manoeuvre in relation to EU-US data transfers. Again, whilst finding in favour of the DPC in relation to an allegation of a failure to respect the duty of candour, the judge expressed some misgivings about the DPC’s failure to respond more fully to requests for information from FBI and suggested that it had acted in an overly defensive manner. The Judge was actually at his most critical in relation to an allegation by the DPC that FBI’s issuing of its proceedings amounted to an abuse of process and had been done for an improper purpose, that of buying time. Here the Judge said that this was a serious allegation, that there was no basis for it and that it ought never to have been made.   Data protection commissioners have a difficult path to steer. On the one hand they operate in an increasingly political environment and are expected to be champions of privacy and of data subject rights. On the other hand, when considering sanctions, they carry out quasi-judicial functions and have to act, and be seen to act fairly and without bias. The High Court judgment confirms that Helen Dixon has managed to keep to the straight and narrow so far in the case in question but the same might not have been true had she conceded more ground to her critics. What is clear though is the extent to which commissioners, when acting in their quasi-judicial capacity, can now be held accountable to the courts, and the extent to which affected businesses may be willing to exercise their rights to give effect to this accountability. As the UK Commissioner, Elizabeth Denham was also reminded of when seeking to defend the ICO’s imposition of a fine on Facebook in the wake of the Cambridge Analytica scandal, commissioners need to be very careful not to risk giving any appearance of rushing to premature judgment, to stick to their published procedures unless there are objective and fair reasons for departing from these and not to otherwise risk bringing unfairness or injustice into their deliberations whatever the wider pressures on them might be. Back to the SCCs It was the question of supplemental measures that  attracted most interest from other businesses. Here it needs to be borne in mind that Facebook Inc in the US qualifies as an electronic communications service provider and can therefore be ordered to make transferred data about specified non-US persons in its stored communications directly available to US public authorities. It is not just liable to have its communications to and from the EU intercepted in transit by such authorities. Although, in an effort to be helpful, the EDPB had produced recommendations on supplemental measures that could be adopted to enhance the SCCs, there remained  a question in relation to EU-US transfers as to how to sufficiently compensate for the inadequate protection provided by US law in practice. We now know that the DPC went on to prepare a full draft decision and submitted it via the co-operation and consistency mechanism. The DPC had simultaneously  been working on an inquiry into Facebook  Ireland( now Meta Platforms) concerning a series of data breaches between 7 June 2018 and 4 December 2018.  The inquiry examined the extent to which Meta Platforms complied with the requirements of GDPR Articles 5(1)(f), 5(2), 24(1) and 32(1) in relation to the processing of personal data relevant to the twelve breach notifications. As a result of its inquiry, the DPC found that Meta Platforms infringed Articles 5(2) and 24(1) GDPR.  The DPC found that Meta Platforms failed to have in place appropriate technical and organisational measures which would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, in the context of the twelve personal data breaches. Final destination in sight? Given that the processing under examination constituted “cross-border” processing, the DPC’s decision was subject to the co-decision-making process outlined in Article 60 GDPR and all of the other European supervisory authorities were engaged as co-decision-makers.  While objections to the DPC’s draft decision were raised by two of the European supervisory authorities, consensus was achieved through further engagement between the DPC and the supervisory authorities concerned.  Accordingly, the DPC’s decision represents the collective views of both the DPC and its counterpart supervisory authorities throughout the EU. On 15 March 2022 the DPC imposed a fine of €17 million on FBI( Meta Platforms). To any fair minded neutral observer, any criticism of the DPC on the basis of inactivity is certainly  unsustainable. Remember, in the content of the FBI/Schrems saga the DPC had to prepare its draft decision and submit this to the cooperation and consistency mechanism, which ultimately  involved the need for an EDPB opinion. This process seldom results in a quick outcome, despite the time limits in the GDPR.Because of a sort of  stalemate on the issue going back to February this year, there were movements by some national supervisory authorities to take a  stand on the case. Some  adopted  a literal interpretation of the ruling. The French privacy regulator CNIL ruled that an unnamed website could not use Google Analytics because doing so involves the transfer of personal information from Europe to the U.S. in violation of the 2020 Schrems II decision. The French decision came  hot on the heels of a decision by Austria’s data protection authority to also ban a website from using the popular Google web analytics tool for the same reason, and presages a raft of decisions by other European data protection authorities on the use of these tools. The Dutch privacy agency warned last December  that using Google Analytics may soon be illegal. Elsewhere, the Norwegian data watchdog has advised companies to start looking for alternatives to Google’s tools. Almost there! Data protection authorities, including the CNIL, are also expected to rule soon on the use of Facebook’s analytics tool, known as Facebook Connect. These decisions mark a significant clamp-down on data transfers, which form the lifeblood of the digital economy and represent billions of euros’ worth of transatlantic trade.   GDPR and data protection advisory services, such as GDPRXPERT.ie, have had  large volume of enquiries from businesses regarding the future of transfers to the US. Much from the preceding paragraphs has been reported through https://www.politico.eu/article/us-eu-data-transfers-on-life-support-after-french-google-decision/ Once the landmark decision began to bite, regulators across the bloc were left with few  alternatives or choices in adhering to the new rules. That began to prompt companies like Google, Microsoft and TikTok to consider the once unthinkable: storing ever more data in Europe. The potential negative effects of such moves may also have spurred the DPC to continue efforts to resolve the issue.  After the 2021 High Court ruling against Facebook the DPC was able to continue efforts to bring a conclusion to the protracted affair. This meant publishing a full draft decision and taking it all through the cooperation and consistency mechanism under Art. 60 GDPR in order to set out a final decision. This is exactly what the DPC did. Throughout all of this, proper procedures were followed. Finally, the stage was reached where it was imperative the Commission  reached a decision on transfers. Some measure of substantive adjustment to existing Standard Contractual Clauses, or an entirely new mechanism, was needed to ensure uninterrupted data flows to the US.  On 22nd March 2022 the European Commission and the Biden administration reached an agreement in principle, the Trans-Atlantic Data Privacy Framework Agreement. While the agreement is still “in principle” and specific details have yet to be determined, if approved, this agreement will reimplement an important legal mechanism necessary to facilitate data transfers between the European Union and the United States. Some have urged caution, “From a purely technical perspective, there’s no path forward for data transfers. That’s why we need durable EU-U.S. data pact that can stand the test in court,” said Rob van Eijk, Europe managing director for the Future of Privacy Forum think tank. More still to come Very soon we will return to the issue to report on the evolving  position on transfers to the US. We also note the DPC has attempted to clear the air on the criticisms directed at it and has issued a report on cross border complaints where it sets out the actual statistics, instead of some alternative ones, that to an objective observer were  clearly  distorted, biased and misleading. See https://www.dataprotection.ie/en/news-media/press-releases/dpc-publishes-statistical-report-handling-cross-border-complaints-under-gdprs-one-stop-shop-oss   The actual report is here.   Here at GDPRXPERT.ie we are GDPR and data protection law experts  offering businesses our  vast expertise in addressing compliance issues. GDPRXPERT.ie are located in Carlow/Kilkenny and Mayo, offering a  nationwide service. Call 0858754526 or 0599134259 to discuss your particular need. Patrick Rowland, GDPRXPERT.ie [...]
11/11/2021Latest NewsThere are very few organisations that  at some stage in the business relationship will not encounter some form of personal data breach and the data controller will have to respond .  Preparing for, and anticipating a  breach, are  the proactive parts. Encountering an actual  breach is only the start.  An active response must be diligent and prudent. This response must include  an integral and strategic risk assessment, leading to  mitigation of those risks in a timely manner. GDPR and data protection consultants, GDPRXpert.ie, have advised extensively on data breaches.   Art.12 GDPR defines “a personal data breach as a breach of security leading to the accidental or  unlawful  destruction , loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored  or otherwise processed.”  Recital 85, GDPR,  warns that the breach may, if not addressed in an appropriate and  timely fashion, result in physical, material or non-material damage. Examples abound but include : financial loss (high risk); identity theft (high risk); damage to reputation (high risk); loss of confidentiality of personal data protected by professional secrecy; Fraud and other economic or social disadvantages. There are three broad types of breaches first outlined by the Art. 29 Working Party. The Working Party was a European Union data protection  advisory group, prior to the European Data Protection Board (EDPB) and the GDPR. The ‘confidentiality breach‘ where personal data are disclosed or accessed in an unauthorised or unlawful manner; The’integrity breach‘ where personal data are altered in an unauthorised or unlawful manner; The ‘availability breach‘where personal data are lost or destroyed in an unauthorised or accidental manner. Looking at something like “accidental or unlawful destruction” of personal data will lead one to discover that here the data no longer exist . If the data are in existence at all, they no longer exist in a form accessible to the data controller. This is consistent with an ‘availability breach’. In a  “loss’” scenario the data controller lacks control of , or no longer has access to, the data or the data. Think of ransomware with data encrypted, or the loss of an encryption  key. The personal data are no longer in the possession of the controller at all and so there is an ‘availability breach’. With “alteration” of data the integrity of the data has been compromised, hence an ‘integrity’ breach. “Unauthorised disclosure of, or access to, personal data” is most commonly seen where data are disclosed to recipients not authorised to receive such data and the result is a clear ‘confidentiality’ breach. Whatever the type or form of breach, action is required in a timely fashion. Under the GDPR two primary obligations are placed upon the controller; (a)Notification of any personal data breach to the DPC, unless the data controller can demonstrate the breach is unlikely to result in a risk to data subjects; and (b) communication of that breach to data subjects, where the breach is likely to result in high risk to  data subjects. GDPRXpert.ie, acting as outsourced DPO ,have conducted  many data breach analyses . This experience leads to the solid conclusion that very few breaches  are the same. However, one aspect that does not change is the breach notification procedure, as this is clearly set out in GDPR and Data Protection Act 2018. First of all, let’s look at the procedure where the breach is to be notified to the DPC. Data Breach Notification to the DPC The controller is compelled to notify the DPC of a personal data breach unless the breach is unlikely to result in  a risk to the rights and freedoms of a natural person. GDPR and data protection consultants GDPRxpert.ie can attest to the tricky subjective nature of the  assessment  of what is ‘unlikely’. Should the decision be that a risk is not unlikely, then the controller has to notify the DPC. Notification to the DPC has to take place without undue delay and where feasible, no later than 72 hours once the controller has become aware of the breach. In a situation where the DPC is not notified within the 72 hour time frame, reasons for any delay must  be given. Accountability requirements under Art.5 (2) GDPR will kick in, meaning that the controller in the context of a data breach will have to demonstrate compliance  with the other principles of data processing including Art. 5 (1) (f), ‘integrity and confidentiality’, i.e., “been processed in a manner that ensures appropriate security of personal data”… On top of this, under Art.33(5) ,controllers must under Art.33(5) document all information relating to the breach so that the DPC can have evidence of their compliance with the notification obligations under Art.33. A controller should be regarded as having become ‘aware’ of the breach when they have a reasonable degree of certainty that a security incident has occurred and compromised personal data.  Don’t forget, that in order to comply with their obligations under the Article 5(2) (principle of accountability) , as well as the requirement to record relevant information under Article 33(5), controllers should be able to demonstrate to the DPC when and how they became aware of a personal data breach. Controllers, as part of their internal breach procedures, should  have a system in place for recording how and when they become aware of a breach. Allied to this is the necessity for being able to show their methodology in assessing the potential risks posed by the breach. Controllers need to show a coherent  methodology to  explain their decision making. N.B. It does not mean the DPC will accept it as being sound or reasonable, but the controller will , in all likelihood be seen to have at least been  acting in good faith. The default position for controllers is that all data breaches should be notified to the DPC, except for those where the controller has assessed the breach as being unlikely to present any risk to data subjects. The controller MUST show why they reached this conclusion.   Documentation should include the details of how the controller assessed the likelihood of risk and severity of risk to the rights and freedoms of the data subject. In all situations of recognised breaches , even  ones that do not require notification to the DPC, the legal onus is always  on the controller to record at least the basic details of the breach, the assessment thereof, its effects, and the steps taken in response, as required by Article 33(5) GDPR. (This is often forgotten by controllers and missed by many more. Be careful!!!) To state the patently obvious ;  to know whether or not  the breach is one that should be notified to the DPC, the controller must first be aware of the data breach itself.  Once aware of the breach, the clock is ticking. As we just touched on, before deciding on  whether there is a  need to notify the DPC concerning a breach,  the controller must make an adequate assessment of the risks posed by the data breach. This is not an exact science,  but more a judgement process. In this process there are some factors and particular aspects that demand scrutiny. The assessment has to be set in the knowledge that there are  risks  that impact negatively  not just  on the right to data protection and privacy , but  often many other rights such as free speech and freedom of movement. Factors that controllers should take into account when engaging in such an assessment include, but are not limited to: the type and nature of the personal data (including whether it contains sensitive, or ‘special category’ personal data); the circumstances of the personal data breach; whether or not personal data had been protected by appropriate technical protection measures, such as encryption or pseudonymisation; the ease of direct or indirect identification of the affected data subjects; the likelihood of reversal of pseudonymisation or loss of confidentiality; the likelihood of identity fraud, financial loss, or other forms of misuse of the personal data ; whether the personal data could be, or are likely to be, used maliciously; the likelihood that the breach could result in, and the severity of, physical, material or non-material damage to data subjects; and whether the breach could result in discrimination, damage to reputation or harm to data subjects’ other fundamental rights. Once the controller has made the risk assessment and concludes there is a need to notify the DPC, the notification must at least: describe the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; communicate the name and contact details of the data protection officer (DPO) or other contact point where more information can be obtained; describe the likely consequences of the personal data breach and;  describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. To assist the DPC in assessing compliance with the requirement to notify ‘without undue delay’, as well as the principle of accountability, the DPC recommends that controllers include, in their initial notification, information on how and when they become aware of the personal data breach, along with an explanation for any delay, if applicable. Where, and in so far as , it is not possible to give all the foregoing information at the same time , the information may be provided in phases without undue further delay.   Data Breach Notification to Data Subjects As referenced earlier, there is also an obligation placed on controllers to notify the data subject of a data breach: “where that personal data breach is likely to result in a high risk to the rights and freedoms of  natural persons” ( Art.34 (1) GDPR). Where the risk is immediate and needs to be mitigated  prompt action is required in communicating with the data subject  (See Recital 86). The need to implement appropriate measures against continuing or similar personal data breaches may justify more time ( Recital 86). Where there is a need a need for notification to the data subject Art. 34(2) mandates the communication must describe in clear and plain language the nature of the  personal data breach and contain at least ( i.e. at a minimum) the information contained in points (b) (c) and (d) of  Art. 33 (3). Where a controller has not notified the data subject, the supervisory authority, having considered the likelihood of a high risk resulting from the breach, may either require the controller to communicate a breach or decide that any of  the conditions (a) (b) or  (c) of Art.34(3) outlined below have been met. The controller has implemented appropriate technical and organisational protection measures, such as rendering the data unintelligible to any person not authorised to access it, e.g. encryption; The controller has taken subsequent measures so that the high risk is no longer likely to materialise and ; It would involve disproportionate effort to communicate directly to every data subject. Here a public communication suffices. In a case where the controller deems it necessary to communicate  the breach to the data subject , the controller will also be communicating it to the DPC. This is on the logical basis that if it is ‘likely to result in a high risk to the rights and freedoms of natural persons’, (must  notify Data Subject)  by implication,  the same breach cannot be ‘unlikely to result in a risk to rights and freedoms’ ( also  notify DPC). If it is likely to pose a high risk then  it can hardly be unlikely to pose a risk, which is lower than a high risk. Any  ‘risk’, or ‘risk simpliciter’, as some like to call it, must be of a type that is lower than a ‘high risk’. There is clearly a higher threshold  for notification to the data subject. Whilst there is no obligation on controllers to communicate a personal data breach to affected data subjects where it is not likely to result in a high risk to them, controllers are nevertheless free to communicate a breach to data subjects where it may still be in their interests or appropriate to do so anyway, in the context of that particular breach. While the notification should be made to the data subject as soon  as reasonably feasible,  sometimes it may be advisable  to delay  notification. A common example is where a controller is made aware a criminal investigation may be pending and early notification may prejudice such an investigation.  In this scenario ,a delay on the advice of law enforcement authorities would be justifiable. Once it becomes clear that any notification is no longer prejudicial to an investigation ,  the data subject should be promptly informed. We have seen  earlier that once the breach has been detected and  the risks assessed the controller may be obliged to notify the DPC and the data subject. This depends most of all on  the conclusion reached after the risk assessment. We also looked earlier  at some factors to be taken into account when conducting the risk assessment. The  risk assessment has to be an objective assessment. It must judge the severity and likelihood of the risks. As part of the ePrivacy Directive , the EU Agency for Network and Information Security (ENISA) produced recommendations for a data  breach severity  assessment. Within this, the severity of three different factors  is to be considered. Assessing the severity of the risk. Factor A: The type of data that was breached can have a value of 1-4; Factor Y: The ease with which a data subject can be identified is assigned a value of 1 or lower ; Factor Z: The specific circumstances of the breach  can have a value of 0.5 or lower. No assessment modality has yet been adopted for  the GDPR, but this method is a useful guide to help quantify Risk Severity. Despite all this, any  risk assessment  remain more of an art than a science. (Consequently, a key element of any data security policy is being able, where possible, to prevent a breach and, where it nevertheless occurs, to react to it in a timely manner).   Record Keeping Obligations. Regardless of whether or not a breach needs to be notified to the supervisory authority, the controller must keep documentation of all breaches, as Article 33(5) explains: “The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.” Therefore,  controllers must bear in mind the onus is on them to ensure that they continue to document how any personal data breaches that arise are dealt with. This is linked to the accountability principle of the GDPR, contained in Article 5(2). The purpose of recording non-notifiable breaches, as well notifiable breaches, also relates to the controller’s obligations under Article 24, and the supervisory authority can request to see these records. Controllers are therefore encouraged to establish an internal register of breaches, regardless of whether they are required to notify or not. Whilst it is up to the controller to determine what method and structure to use when documenting a breach, in terms of recordable information there are key elements that should be included in all cases. As is required by Article 33(5), the controller needs to record details concerning the breach, which should include its causes, what took place and the personal data affected. It should also include the effects and consequences of the breach, along with the remedial action taken by the controller. The old Art. 29 WP guidelines recommend that the controller also document its reasoning for the decisions taken in response to a breach. In particular, if a breach is not notified, a justification for that decision should be documented. This should include reasons why the controller considers the breach is unlikely to result in a risk to the rights and freedoms of individuals . Alternatively, if the controller considers that any of the conditions in Article 34(3) are met, then it should be able to provide appropriate evidence that this is the case. (The conditions under Art. 34(3) are those that make notification to data subjects unnecessary, as seen above earlier) Where the controller does notify a breach to the supervisory authority, but the notification is delayed, the controller must be able to provide reasons for that delay; documentation relating to this could help to demonstrate that the delay in reporting is justified and not excessive. Where the controller communicates a breach to the affected individuals, it should be transparent about the breach and communicate in an effective and timely manner. Accordingly, it would help the controller to demonstrate accountability and compliance by retaining evidence of such communication. To aid compliance with Articles 33 and 34, it would be advantageous to both controllers and processors to have a documented notification procedure in place, setting out the process to follow once a breach has been detected, including how to contain, manage and recover the incident, as well as assessing risk, and notifying the breach.   In this regard, to show compliance with GDPR it might also be useful to demonstrate that employees have been informed about the existence of such procedures and mechanisms and that they know how to react to breaches. It should be noted that failure to properly document a breach can lead to the supervisory authority exercising its powers under Article 58 and, or imposing an administrative fine in accordance with Article 83. Much of the foregoing information is also available on this link at the DPC website. The DPC has also recently updated a data breach notification form. At the same site you will find useful tips on avoiding data breaches.   Here at GDPRXpert.ie we are  GDPR and data protection consultants with vast expertise helping businesses first fully recognise, and then properly react to , data breaches . GDPRXpert.ie are located in Carlow/Kilkenny and Mayo, offering a  nationwide service. Call 0858754526 or 0599134259 to discuss your particular need. Patrick Rowland, GDPRXpert.ie [...]
02/09/2021Latest NewsA Data Protection Impact Assessment ( DPIA) is one  of the most responsible tasks that, in certain circumstances,  is prescribed under the GDPR. Non compliance with DPIA requirements can lead to the imposition of fines by the DPC. Any reputable data protection consultancy should have qualified, certified and experienced data protection professionals available to carry out DPIAs on your behalf. At GDPRXpert.ie we routinely undertake DPIAs as part of our services. This service is available nationwide. Data protection consultants GDPRXpert.ie have found that even  in the cases where a DPIA is not mandatory, it is always an advisable course of action. What is a data protection impact assessment? A Data Protection Impact Assessment is a process specifically designed to identify, quantify and mitigate the risks involved in the processing operation. It does this primarily by assessing the necessity and proportionality of the processing and putting a strong emphasis on managing the risks to the rights and freedoms of all natural persons resulting from the processing of personal data. Therefore, an essential ingredient in any DPIA mix is a measured assessment of the risks to those rights and freedoms, and a determination of the appropriate measures to address them. At the heart of the DPIA is its role as a conduit of accountability that works to enable controllers to comply with their requirements under GDPR. By using this accountability tool a controller can demonstrate that all appropriate measures have been taken to ensure compliance with the Regulation. In essence, the DPIA is the building block to construct and demonstrate compliance. Data protection consultants GDPRXpert.ie will provide the foundation for you to build and construct a compliant business  structure. DPIA Content Article 29 Working Party elaborates on the details. The GDPR does not formally define the concept of a DPIA as such, but – its minimal content is specified by Article 35(7) as follows: “(a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller; (b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; (c) an assessment of the risks to the rights and freedoms of data subjects ; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data, and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned”. Recital 84 goes on to clarify the role in the following terms; “In order to enhance compliance with this Regulation where processing activities are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate in particular, the origin, nature, particularity and severity of that risk”. The same Recital continues; “The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation”.   Is a Data Protection Impact Assessment Mandatory?   A DPIA is not mandatory for every personal data processing operation. Indeed, the risk-based approach inherent in the GDPR requires only that a DPIA be carried out when the processing is “likely to result in a high risk to the rights and freedoms of natural persons” (Article 35(1)). There is no necessity for a certainty, but inherently high risk should attract more scrutiny. Article 35 (3) states a DPIA “shall in particular be required in the case of: “(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person ; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10 ; or (c) a systematic monitoring of a publicly accessible area on a large scale”. The words above, ‘in particular’ (in bold), from Art.35 (3), signify that the list is deliberately non-exhaustive. One practical consequence is that there will be cases that do not fall neatly into any ‘high risk’ category, but yet they pose a quantifiably high risk.  To make the assessment on whether a DPIA is mandatory or not, in itself, involves a risk assessment or a sort of mini DPIA. What is ‘likely to result in high risks…?’ How is the ‘high risk’ to be assessed? Recital 84 places emphasis on evaluating the ‘origin, nature, particularity and severity of the risk.’ A general backdrop to the high risk potential includes aspects such as the nature, the context, the scope and the purposes of the processing. Prudent advice from the Art. 29 WP Guidelines is that where it is not clear whether a DPIA is required, a DPIA should nonetheless be carried out to help data controllers comply with data protection law. Some Other Criteria for A DPIA. There is then, what might be called, ‘an assessment before an assessment’. Art. 35(4) envisages the establishment of a list of processing operations that would guide controllers in their scrutiny of operations that may require a DPIA. Art. 29 WP lays out the relevant criteria to be considered in this regard: Evaluation or scoring, including profiling and predicting, especially from “aspects concerning the data subject’s performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements” (Recitals 71 and 91). Examples of this could include a bank that screens its customers against a credit reference database, or a biotechnology company offering genetic tests directly to consumers in order to assess and predict the disease/health risks, or a company building behavioural or marketing profiles based on usage or navigation on its website; Automated-decision making with legal or similar significant effect: processing that aims at taking decisions on data subjects producing “legal effects concerning the natural person” or which “similarly significantly affects the natural person” (Article 35(3)(a)). For example, the processing may lead to the exclusion or discrimination against individuals. Processing with little or no effect on individuals does not match this specific criterion; Systematic monitoring: processing used to observe, monitor or control data subjects, including data collected through “a systematic monitoring of a publicly accessible area” (Article 35(3) (c)). This type of monitoring is a criterion because the personal data may be collected in circumstances where data subjects may not be aware of who is collecting their data and how they will be used. Additionally, it may be impossible for individuals to avoid being subject to such processing in frequent public (or publicly accessible) space(s); Sensitive data: this includes special categories of data as defined in Article 9 (for example information about individuals’ political opinions), as well as personal data relating to criminal convictions or offences. An example would be a general hospital keeping patients’ medical records or a private investigator keeping offenders’ details. This criterion also includes data which may more generally be considered as increasing the possible risk to the rights and freedoms of individuals, such as electronic communication data, location data, financial data (that might be used for payment fraud). In this regard, whether the data has already been made publicly available by the data subject or by third parties may be relevant. Where  personal data is publicly available, this aspect   may be considered as a factor in the assessment if the data was expected to be further used for certain purposes. This criterion may also include information processed by a natural person in the course of purely personal or household activity (such as cloud computing services for personal document management, email services, diaries, e-readers equipped with note-taking features, and various life-logging applications that may contain very personal information), whose disclosure or processing for any other purpose than household activities can be perceived as very intrusive; Data processed on a large scale: the GDPR does not define what constitutes large-scale, though Recital 91 provides some guidance. In any event, the WP29 recommends that the following factors, in particular, be considered when determining whether the processing is carried out on a large scale: (a)the number of data subjects concerned, either as a specific number or as a proportion of the relevant population; (b)the volume of data and/or the range of different data items being processed; (c)the duration, or permanence, of the data processing activity; (d)the geographical extent of the processing activity. 6.Datasets that have been matched or combined, for example originating from two or more data processing operations performed for different purposes and/or by different data controllers in a way that would exceed the reasonable expectations of the data subject.; (7)Data concerning vulnerable data subjects (Recital 75): the processing of this type of data can require a DPIA because of the increased power imbalance between the data subject and the data controller, meaning the individual may be unable to consent to, or oppose, the processing of his or her data. For example, employees would often meet serious difficulties to oppose to the processing performed by their employer, when it is linked to human resources management. Similarly, children can be considered as not able to knowingly and thoughtfully oppose or consent to the processing of their data. This also concerns more vulnerable segment of the population requiring special protection, such as, for example, the mentally ill, asylum seekers, or the elderly, a patient, or in any case, where an imbalance in the relationship between the position of the data subject and the controller can be identified; (8)Innovative use or applying technological or organisational solutions, like combining use of finger print and face recognition for improved physical access control, etc. The GDPR makes it clear (Article 35(1) and Recitals 89 and 91) that the use of a new technology can trigger the need to carry out a DPIA. This is because the use of such technology can involve novel forms of data collection and usage, possibly with a high risk to individuals’ rights and freedoms. Indeed, the personal and social consequences of the deployment of a new technology may be unknown. A DPIA will help the data controller to understand and to treat such risks. For example, certain “Internet of Things” applications could have a significant impact on individuals’ daily lives and privacy; and therefore require a DPIA; (9)Data transfer across borders outside the European Union (Recital 116), taking into consideration, amongst others, the envisaged country or countries of destination, the possibility of further transfers or the likelihood of transfers based on derogations for specific situations set forth by the GDPR; ( put in link to my article ) (10)When the processing in itself “prevents data subjects from exercising a right or using a service or a contract” (Article 22 and Recital 91). This includes processing performed in a public area that people passing by cannot avoid, or processing that aims at allowing, modifying or refusing data subjects’ access to a service or entry into a contract. An example of this is where a bank screens its customers against a credit reference database in order to decide whether to offer them a loan. The WP29 considers that the more criteria are met by the processing, the more likely it is to present a high risk to the rights and freedoms of data subjects, and therefore to require a DPIA. As a rule of thumb, a processing operation meeting less than two criteria may not require a DPIA due to the lower level of risk, and processing operations which meet at least two of these criteria will require a DPIA. However, in some cases, a processing meeting only one of these criteria will require a DPIA. Conversely, if the controller believes that despite the fact that the processing meets at least two criteria, it is considered not to be “likely high risk”, he has to thoroughly document the reasons for not carrying out a DPIA. In addition, a data controller subject to the obligation to carry out the DPIA “shall maintain a record of processing activities under its responsibility”( Art. 30 (1), including, inter alia, the purposes of processing, a description of the categories of data and recipients of the data and “where possible, a general description of the technical and organisational security measures referred to in Article 32(1)”, and must assess whether a high risk is likely, even if they ultimately decide not to carry out a DPIA. Note: supervisory authorities are required to establish, make public and communicate a list of the processing operations that require a DPIA to the European Data Protection Board (EDPB) (Article 35(4)). The criteria set out above can help supervisory authorities to constitute such a list, potentially with more specific content added in time if appropriate. For example, the processing of any type of biometric data or that of children could also be considered as relevant for the development of a list pursuant to Article 35(4). The DPC has issued guidelines on processing operations that require a DPIA. Where a documented screening or preliminary risk assessment indicates the processing operation is likely to result in a high risk to the rights and freedoms of individuals pursuant to Art.35 (1) the DPC has determined a DPIA will also be mandatory for the following types of processing operations: 1) Use of personal data on a large-scale for a purpose(s) other than that for which it was initially collected pursuant to GDPR Article 6(4); 2) Profiling vulnerable persons including children to target marketing or online services at such persons; 3) Use of profiling or algorithmic means or special category data as an element to determine access to services or that results in legal or similarly significant effects; 4) Systematically monitoring, tracking or observing individuals’ location or behaviour; 5) Profiling individuals on a large-scale; 6) Processing biometric data to uniquely identify an individual or individuals or enable or allow the identification or authentication of an individual or individuals in combination with any of the other criteria set out in WP29 DPIA Guidelines; 7) Processing genetic data in combination with any of the other criteria set out in WP29 DPIA Guidelines; 8) Indirectly sourcing personal data where GDPR transparency requirements are not being met, including when relying on exemptions based on impossibility or disproportionate effort; 9) Combining, linking or cross-referencing separate datasets where such linking significantly contributes to or is used for profiling or behavioural analysis of individuals, particularly where the data sets are combined from different sources where processing was/is carried out for difference purposes or by different controllers; 10) Large scale processing of personal data where the Data Protection Act 2018 requires “suitable and specific measures” to be taken in order to safeguard the fundamental rights and freedoms of individuals. This list does not remove the general requirement to carry out proper and effective risk assessment and risk management of proposed data processing operations nor does it exempt the controller from the obligation to ensure compliance with any other obligation of the GDPR or other applicable legislation. Furthermore, it is good practice to carry out a DPIA for any major new project involving the use of personal data, even if there is no specific indication of likely high risk.(From DPC Guidelines available here). Ultimate responsibility rests with the controller, as it is the controller who must decide whether or not a ‘high risk’ exists.  Such a decision must take a host of factors into account. When two or more of these factors combine in the processing operation, the risk is sure to increase. For example, a processing operation could involve new technology, the processing of sensitive data and profiling/evaluation. The factors are not prescriptive but the office of the DPC has identified some that warrant special attention. These factors include: Uses of new or novel technologies; Data processing on a large scale; Profiling/Evaluation – Evaluating, scoring, predicting of individuals’ behaviours, activities, attributes including location, health, movement, interests, preferences; Any systematic monitoring, observation or control of individuals including that taking place in a public area or where the individual may not be aware of the processing or the identity of the data controller; Processing of sensitive data including that as defined in GDPR Article 9, but also other personally intimate data such as location and financial data or processing of electronic communications data; Processing of combined data sets that goes beyond the expectations of an individual, such as when combined from two or more sources where processing was carried out for different purposes or by different data controllers; Processing of personal data related to vulnerable individuals or audiences that may have particular or special considerations related to their inherent nature, context or environment. This will likely include minors, employees, mentally ill, asylum seekers, the aged, those suffering incapacitation; Automated decision making with legal or significant effects (see below). This includes automatic decision making where there is no effective human involvement in the process; and Insufficient protection against unauthorised reversal of pseudonymisation. Under Art. 35(5) it is open to any Supervising Authority, in our case the DPC, to set out a list of the kind of processing operations for which no data protection impact assessment is required. A definitive list pursuant to Art. 35(5) has not been issued by the DPC. A general rule is that any processing that is not ‘likely to result in a high risk to the rights and freedoms of natural persons’ will be exempt from a DPIA.  However, deciding what is, ‘likely to result in a high risk…’ demands the carrying out of a ‘mini DPIA’. Despite the absence of a comprehensive definitive list, the office of the DPC, in a publication on DPIAs, lays out some examples of processing operations not requiring a DPIA: A previous DPIA was carried out and found no risk; Processing has been authorised by the DPC; Processing is being done pursuant to (c) or (e) of Art. 6(1) of the GDPR. Point (c) refers to processing necessary for compliance with a legal obligation. Point (e) refers to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In both cases there must be a clear legal basis under EU or Member State law AND a DPIA must have already been conducted under Art. 35(10). On balance it is advisable to have a Data Protection  Impact Assessment carried out. In many cases, the minimum content of the assessment as set out under Art.35 (a) to (d) GDPR will be sufficient to ensure compliance and bring peace of mind to an  organisation conducting the processing operations. Here at GDPRXpert.ie we are  GDPR and data protection consultants with vast expertise in conducting DPIAs. GDPRXpert.ie are located in Carlow/Kilkenny and Mayo, offering a  nationwide service. Call 0858754526 0r 0599134259 to discuss your particular need. Patrick Rowland, GDPRXpert.ie   [...]
24/06/2021Latest NewsMost people have had concerns other than ePrivacy , GDPR and cookies over  these past few months.  Over this same period and longer, this data protection blogger’s waistline has increasingly  hinted at affection for cookies of the baked variety. To be more accurate: it is evidence of such affection. It stands as an affection that, whilst not a direct consequence of the pandemic, nevertheless has been predominantly encouraged, facilitated and maximised by this global pandemic. We all need some kind of excuse! During the last few months thoughts around the architecture of other cookie types have also taken on a more reflective mode. These cookies are the cookies we encounter when we browse the internet. Some announce themselves immediately; others seek to delay announcing their presence, while more adopt a strategy of hide and seek. In the context of data protection generally, and GDPR more specifically, this raises many concerns. As data protection consultants , many queries we receive relate to uncertainties and doubts about cookies that have made their way onto user devices. This blog will outline the data protection ramifications for the proliferation of the various cookie types.  It will also  outline the associated compliance requirements for their use under the GDPR and the old ePrivacy Directive, which was given effect in Ireland by the European Communities Privacy and Electronic Communications Regulations, S.I. 336 of 2011 . There is still no definitive answer as to when the long awaited EU ePrivacy Regulation will be finally agreed upon and become law. What are Cookies? Many will be all too familiar with the question above, and the ubiquitous presence of cookies on the internet, but still how many truly understand or bother to learn more? How many times have we all as internet surfers just ignored cookie notices and clicked ‘accept boxes’ in order to quickly access the information we are seeking? Definitions of cookies abound and vary. The aim of  this blog post is to  offer clear   information in a manner that  avoids  the strictly technical descriptions, especially those that often confuse more than they enlighten or explain. Cookies are small pieces of information, stored in simple text files, placed on your computer by a website. These cookies can then be read by the website on your subsequent visits. Some of the information stored in a cookie may relate to your browsing habits on the web page, or a unique identification number so that the website can ‘remember’ you on your return visit. In general, cookies do not contain personal information from which you can be identified, unless you have specifically furnished such information to the website. Historically, cookies were conceived to make up for the web protocols’ inability to record preferences (e.g. languages) or actions already performed on website (such as the articles already in the shopping basket of an ecommerce website). Later on, their use was extended to enabling user authentication during a session, recording browsing behaviour for web service improvement purposes, or for tracking and profiling users, e.g. to serve targeted advertising. For example, Google Analytics is Google’s analytics tool that helps website and app owners to understand how their visitors engage with their properties. It may use a set of cookies to collect information and report site usage statistics without personally identifying individual visitors to Google. Most commonly, cookies store user preferences and other information. We will see later how much of the information is aggregated and anonymised so as not to readily identify individual users. However, it is not quite as simple as that, and with some cookie types there are hidden dangers for a person’s privacy and data protection rights. Cookie Classifications. Duration Some cookies are defined by the length of time they remain active. For example cookies are most often referred to as ‘session’ or ‘persistent’. ‘Session’ cookies are most usually stored temporarily during a browsing session and are deleted from the user’s device when the browser is closed. ‘Persistent’ cookies are saved on your computer for a fixed period, and are not deleted when the browser is closed, allowing them to conveniently and quickly manage return visits to a website. (Consent is not required by the law when cookies are used to enable the communication on the web and when they are strictly necessary for the service requested by the user.) Source/Origin Third Party cookies These cookies may be set through a site by that site’s advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not directly store personal data, but act to uniquely identify your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. For example, many website owners use social media platforms, such as Facebook, Twitter or Instagram et cetera, as tools to enhance their own website, but these cookies are set by the social media companies. Primarily, such cookies are set by third parties for their own specific purposes and such purposes are predominantly purely of a commercial nature, e.g. advertising. Such third party advertising cookies may be used by those third parties to anonymously target advertising to you on other websites, based on your previous visit to an entirely unrelated website. These cookies cannot be used to identify an individual; they can only be used for statistical purposes, for example, in providing you with advertisements that are more relevant to your interests. One of the reasons Facebook’s ads are so successful is that they track and target the user across websites. If you’re an advertiser, third party cookie data allows you to learn about your web visitors’ overall online behaviours, such as websites they frequently visit, purchases, and interests that they’ve shown on various websites. Users are being tracked across the entire  web within a specific browser, and not just on the site on which cookies might have been installed. With this detailed data, you can build robust visitor profiles. Armed with  this, you can then create a retargeting list that can be used to send ads to your past visitors or people with similar web profiles. First party cookies These are the opposite of third party cookies. First party cookies are directly stored by the website or domain you visit. They are set and controlled by a website itself and are set with the purpose of giving the website information about the usage of its site. The usual goal is to allow the website owner provide as good a user experience as possible. With that in mind, the cookies can collect analytics data, remember language settings, and perform a myriad of useful functions. The architecture and design of modern websites is focused on optimising the ability to gain as much (relevant) information as possible about the operation of specific websites. Functional, performance and targeting cookies may be first party cookies, but not in all cases. First party cookies are directly stored by the website or domain you visit. A first-party cookie is a code that gets generated and stored on a website visitor’s computer by default when they visit the same website. This cookie is often used for user experience as it is responsible for remembering passwords, basic data about the visitor, and other preferences. With a first-party cookie, you can learn about what a user did while visiting your website, see how often they visit it, and gain other basic analytics that can help you develop or automate an effective marketing strategy around them. However, you can’t see data related to your visitor’s behaviour on other websites that aren’t affiliated with your domain. Purpose Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. No opt outs are permissible on these cookies, and as they are necessary for the proper functioning of the website the user does not have to consent to these. It is a ‘take them or leave them’ type of choice. While it is not required to obtain consent for these cookies, what they do and why they are necessary should be explained to the user. Preferences cookies — Also known as ‘functionality cookies’, these cookies allow a website to remember choices you have made in the past, like what language you prefer, what region you would like weather reports for, or what your username or password is so you can automatically log in. These cookies, therefore, enable a website to provide enhanced functionality and personalisation. They may be set by a website or by third party providers whose services a website adds to its pages. No information is gathered or stored unless you interact with these features. Statistics cookies — Also known as ‘performance cookies’,  these cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions. This includes cookies from third-party analytics services as long as the cookies are for the exclusive use of the owner of the website visited. Blocking these cookies means the site will not know when you have visited the site, and will not be able to monitor its performance. Marketing cookies — These cookies track your online activity to help advertisers deliver more relevant advertising or to limit how many times you see an ad. These cookies can share that information with other organizations or advertisers. These are persistent cookies and almost always of third-party provenance. When people complain about the privacy risks presented by cookies, they are generally speaking about third-party, persistent, marketing cookies. These are the main ways of classifying cookies, although there are cookies that will not fit neatly into these categories or may qualify for multiple categories. When people complain about the privacy risks presented by cookies, they are generally speaking about third-party, persistent, marketing cookies. These cookies can contain significant amounts of information about your online activity, preferences, and location. The chain of responsibility (who can access a cookies’ data) for a third-party cookie can get complicated as well, only heightening their potential for abuse. Related/Used in conjunction with cookies Browser web Storage: Browser web storage enables websites to store data in a browser on a device. When used in ‘local storage’ mode, it enables data to be stored across sessions. This makes data retrievable even after a browser has been closed and reopened. One technology that facilitates web storage is HTML 5. IP address Every device connected to the Internet is assigned a number known as an Internet protocol (IP) address. These numbers are usually assigned in geographic blocks. An IP address can often be used to identify the location from which a device is connecting to the Internet. Pixel tag A pixel tag is a type of technology placed on a website or within the body of an email for the purpose of tracking certain activity, such as views of a website or when an email is opened. Pixel tags are often used in combination with cookies Referrer URL A Referrer URL (Uniform Resource Locator) is information transmitted to a destination webpage by a web browser, typically when you click a link to that page. The Referrer URL contains the URL of the last webpage the browser visited. Server logs Most websites automatically record the page requests made when you visit those particular sites. These ‘server logs’ typically include your web request, Internet Protocol address, browser type, browser language, the date and time of your request, and one or more cookies that may uniquely identify your browser. Google gives an example below of how a simple search for “cars” might look like as a server log file. A typical log entry for a search for “cars” looks like this: 123.45.67.89 – 25/Mar/2003 10:15:32 – http://www.google.com/search?q=cars – Firefox 1.0.7; Windows NT 5.1 – 740674ce2123e969 • 123.45.67.89 is the Internet Protocol address assigned to the user by the user’s ISP. Depending on the user’s service, a different address may be assigned to the user by their service provider each time they connect to the Internet. • 25/Mar/2003 10:15:32 is the date and time of the query. • http://www.google.com/search?q=cars is the requested URL, including the search query. • Firefox 1.0.7; Windows NT 5.1 is the browser and operating system being used. • 740674ce2123a969 is the unique cookie ID assigned to this particular computer the first time it visited Google. (Cookies can be deleted by users. If the user has deleted the cookie from the computer since the last time they’ve visited Google, then it will be the unique cookie ID assigned to their device the next time they visit Google from that particular device). Unique identifiers A unique identifier is a string of characters that can be used to uniquely identify a browser, app, or device. Different identifiers vary in how permanent they are, whether they can be reset by users, and how they can be accessed. Unique identifiers can be used for various purposes, including security and fraud detection, syncing services such as an email inbox, remembering your preferences, and providing personalized advertising. For example, unique identifiers stored in cookies help sites display content in your browser in your preferred language. You can configure your browser to refuse all cookies or to indicate when a cookie is being sent. Unique identifiers may also be incorporated into a device by its manufacturer (sometimes called a universally unique ID or UUID), such as the IMEI-number of a mobile phone. For example, a device’s unique identifier can be used to customize a website’s service to your device or analyze device issues related to that service. Some Cookie Problems. There is a close relationship between ePrivacy and cookies. Cookies do not exist in a vacuum, but rather interact in both negative and positive manners with internet users on a daily basis. This interaction is regulated by both the ePCR and the GDPR. The ePCR supplements (and in some cases, overrides) the GDPR, addressing crucial aspects about the confidentiality of electronic communications and the tracking of internet users more broadly. One aspect that overrides all others in the day to day interactions is the concept of consent. It is the absence of any cookie consent mechanism, or the dilution of the consent mechanism, that primarily causes problems. While cookies are specifically regulated under the auspices of the ePCR, consent in relation to cookies is governed by the very strict standards under the GDPR. Under the ePCR consent is required to either store information, or gain access to information stored, on an individual’s device. This is the essence of the cookies rules. The two exceptions to this general rule are where: 1. The sole purpose is for carrying out the transmission of a communication, or 2. It is strictly necessary in order to provide an online service explicitly requested by that individual These rules apply regardless of whether personal data is processed. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge. In a report in 2019, the DPC noted that many controllers categorised the cookies deployed on their websites as having a‘necessary’ or ‘strictly necessary’ function, where the stated function of the cookie appeared to meet neither of the two consent exemption criteria set down in the ePrivacy Regulations/ePrivacy Directive. These included cookies used to establish chatbot sessions that were set prior to any request by the user to initiate a chatbot function. In some cases, it was noted that the chatbot function on the websites concerned did not work at all”. The GDPR speaks more to the nature of the concept of consent. It is specific as to the quality of consent, as it is the quality that sets it apart. The Notion of Consent under the GDPR. One of the most common problems alluded to above is the absence of, or the strategic manipulation of, the nature and essence of consent. The GDPR always foresaw how the promulgation of many of its objectives was to be inextricably linked to a full understanding of the attendant concept of consent. Trample upon or weaken the nature of true consent and you simultaneously trample upon data subject rights. Article 4 (11) GDPR The article defines consent of the data subject as ‘ any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. We know  in the context of the ePCR that the data being processed does not necessarily have to be personal data. Nevertheless, the standard of consent is the GDPR standard. Art. 7 GDPR expands on the concept and gives the general conditions to be met to validate consent. At the outset where a controller is using consent as a basis for processing that controller has to be able to demonstrate that the data subject has indeed consented (Art.7 (1) GDPR). Where consent is given in the context of a written declaration and is juxtaposed or mixed in with other items, any request for consent has to be clearly distinguishable from those other items (Art. 7 (2) GDPR). Consent may be withdrawn at any time. Even before consent is given, the data subject must be informed it shall be as easy to withdraw as to give consent. Any withdrawal of consent subsequent to the processing of personal data shall not affect the lawfulness of processing prior to the withdrawal of consent Art.7 (3) GDPR). In regard to the concept of ‘free consent’, and especially in relation to consent given as a contractual term for the provision of a service, account will be taken as to whether that provision is conditional on consent to processing of personal data that is not necessary for the performance of that contract ( Art.7 (4) GDPR). Recital 32 is most instructive on the consent concept and relates more directly to consent in the cookie sphere. It emphasises consent ‘by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her…’ Common examples are written statements including by electronic means or oral statements. (Note: controller needs to be careful with oral statements as he/she needs to demonstrate the data subject has consented) Other examples could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover processing activities for the same purpose or purposes. If multiple purposes are involved then consent has to be given for all purposes . Of most relevance in the cookie consent context is that any consent given following a request by electronic means must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. (cookie walls)  The standard of consent that controllers must obtain from users or subscribers for the use of cookies must now be read in light of the GDPR standard of consent: i.e. it must be obtained by means of a clear, affirmative act and be freely given, specific, informed and unambiguous. ( See DPC cookie sweep report here) Planet49 case In this case, a lottery website had required users to consent to the storage of cookies in exchange for access to play a promotional game. The Court (CJEU) decided that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a prechecked checkbox which that user must deselect to refuse his or her consent. That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge. The Court notes that consent must be specific. Merely  selecting the button to participate in a promotional lottery is not sufficient for it to be concluded that the user validly gave his or her consent to the storage of cookies. Furthermore, according to the Court, the information that the service provider must give to a user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies. So, to sum up, pre-checked consent boxes (or cookie banners that tell you a cookie has already been dropped and pointlessly invite you to click ‘ok’) aren’t valid under EU law. Furthermore, cookie consent can’t be bundled with another purpose (in the Planet49 case the promotional lottery) — at least if that fuzzy signal is being used to stand for consent. There’s also an interesting new requirement which looks set to shrink the ability of service operators to obfuscate how persistently they’re tracking Internet users. For consent to cookies to be legally valid,  the court now says the user must be provided with some specific information on the tracking, namely: How long the cookie will operate, and with whom their data will be shared. The proposed new ePrivacy Regulation. Earlier we mentioned that the debate over the new Regulation is still continuing. Remember!  A regulation is a  more powerful legislative instrument for EU lawmakers as it’s binding across all EU Member States. It immediately comes into  legal force on a pre-set date , without any need to be transposed into national laws. A regulation is self -executing. On the other hand, Member States have more discretion and flexibility with a directive because it’s up to them as to exactly how they implement the substance of any  directive. For example, they could adapt an existing law or create a new one. With the regulation all deliberation happens among the EU institutions and, once that discussion and negotiation process has concluded, the agreed text becomes law across the bloc. As a rule,  it is more difficult to get agreement and consensus on a regulation. In the case of the GDPR, some articles specifically made provisions for Member States to be able to vary the substantive application of parts of the regulation . In Ireland, for example, the age of a child under the DPA 2018 for the purposes of the application of the GDPR is 18years. ( DPA 2018, s.29)  However, GDPR Art. 8 allows Member States to set a lower age in relation to the offering of information society services to a child.  Accordingly, S.31, DPA 2018 sets this at sixteen. Nevertheless,  the GDPR has the final say in  stipulating  that no Member State can lower the age to less than 13years in the same context. ( Art.8 (1) GDPR) Because a regulation is usually so precisely and uniformly applied once enacted,  the debate beforehand may be long technical and arduous. Member States and lobby groups attempt to bring  influence to bear on  the final draft. It will be too late once the final draft is agreed and it becomes law. It is hardly surprising then that the debate on the ePrivacy regulation has taken so long. There are many contested issues and what view one has is predicated upon individual interests.  Media ,and the publishing industry associations in general, remain entrenched in opposition to the new ePrivacy regulation. Their fears centre on the potential for the regulation to wreak financial havoc on their ad- supportd business models. Such models rely heavily on cookies and tracking technologies , strategically  utilising them to try to monetise free content via targeted ads.  Empowering ordinary  ‘users’  to opt in to being tracked represents a step too far! Anything that could impede adtech’s ability to track and thus behaviourally target ads at web users is clearly enemy number one, given the current modus operandi. So ePrivacy is a major lobbying target for the likes of the IAB who don’t want it to upend their existing business models. Key content of the ePrivacy Regulation The ePrivacy Regulation regulates the use of electronic communications services within the European Union and is intended to replace the Directive on Privacy and Electronic Communications (Directive 2002/58/EC). The ePrivacy Regulation is primarily aimed at companies operating in the digital economy and specifies additional requirements they need to meet in relation to the processing of personal data. Originally, the ePrivacy Regulation was intended to apply from 25 May 2018 together with the General Data Protection Regulation (GDPR). Unlike with the GDPR, however, the EU Member States have not yet been able to agree on the draft legislation. The negotiations of the ePrivacy Regulation are still ongoing now in 2021. In view of the fact that there are some points of contention regarding the current text of the Regulation, however, these may not progress as quickly as the Portuguese presidency has recently been pushing forward ePrivacy. The ePrivacy Regulation is certainly not expected to enter into force before 2023. A potential transitional period of 24 months means that any new regulations would then not come into effect before 2025. Techcrunch has outlined some sources of disagreements. “There are many contested issues, depending on the interests of the group you’re talking to. Media and publishing industry associations are terrified about what they say ePrivacy could do to their ad-supported business models, given their reliance on cookies and tracking technologies to try to monetize free content via targeted ads — and so claim it could destroy journalism as we know it if consumers need to opt-in to being tracked. The ad industry is also of course screaming about ePrivacy as if its hair’s on fire. Big tech included, though it has generally preferred to lobby via proxies on this issue. Anything that could impede adtech’s ability to track and thus behaviourally target ads at web users is clearly enemy number one, given the current modus operandi. So ePrivacy is a major lobbying target for the likes of the IAB who don’t want it to upend their existing business models. Even telcos aren’t happy, despite the potential of the regulation to even the playing field somewhat with tech giants — suggesting they will end up with double the regulatory burden, as well as moaning it will make it harder for them to make the necessary investments to roll out 5G networks. Plus, as I say, there also seems to be some efforts to try to use ePrivacy as a vector to attack and weaken GDPR itself.” Google announces suspension of third party cookies. The way we use cookies could change dramatically with Google’s announcement that it will phase out 3rd party cookies on Chrome browser by 2022. A Google blog post announcing the phaseout explains, “Users are demanding greater privacy–including transparency, choice, and control over how their data is used–and it’s clear the web ecosystem needs to evolve to meet these increasing demands.” What is also clear is that users are becoming increasingly frustrated with cookie banners designed to pressure them into  accepting  ad tracking cookies. Firefox and Safari have already phased out the third party cookie but Google has decided to wait until 2022. It has done this on the basis of wishing to work with advertisers ‘to ensure this pivot does not destroy the online advertising business’. Google also takes the view that ”by undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. We believe that we as a community can, and must, do better.” This is also something the new ePrivacy Regulation should address. Patrick Rowland, GDPRXpert.ie. We are GDPR and Data Protection consultants based in Carlow/Kilkenny and Mayo. Visit www.gdprxpert.ie for more details and any queries. [...]
15/09/2020Latest NewsA recently published report shines light on the GDPR and the work of the  DPC 2018-2020.  In a previous blog we looked at the GDPR and the work of the DPC a year into the operation of the regulation.  Following that, we discussed in another blog how, although the early awareness of the new regulation had waned, GDPR had not gone away. Now it has been two years since the regulation came into effect and time to re-examine some aspects of this novel regulation. Unfortunately the Covid-19 pandemic continues. We will return to data protection issues within this context in an upcoming blog post, and a focus will be some  recent developments and updates  from the DPC in relation to transfer of data to the US. The DPC has released a report which sheds light on trends and patterns that are emerging since the introduction of the GDPR. “Given its role as Lead Supervisory Authority to the various multinational organisations that are headquartered here, much attention is naturally given to Ireland’s regulatory activities in the realm of ‘big tech.”(DPC, 2018-2020 report at p.5). So, what has been the focus of the work of the DPC under the new regulatory regime? Have there been issues that have predominated? “Though the same themes frequently re-occur – access issues, for example, being a consistent area of contention – there are nuances within each case that impact greatly on timescales and the resolution process”. The same is true of breach notifications, which the DPC also receives in consistently high numbers month-on-month.  In the two years since the GDPR came into effect, the DPC has received almost 12,500 breach notifications, of which 93% were found to be in scope of the GDPR. The DPC has processed and closed out almost 95% of these breach notifications. Despite the high volumes, the cases that have been assessed give no indication that organisations are over reporting. Rather, they suggest that many of the breaches that the DPC examines could have been prevented by more stringent technical and organisational measures at source… It is important to bear in mind that “The DPC’s remit is not limited to regulation of the GDPR. It encompasses all data protection legislation currently in force in Ireland, which includes a significant but declining volume of legacy work falling under the 1988 and 2003 Data Protection Acts”. The rate of old “act cases” that come before the DPC is diminishing, relative to the rates that were seen in May 2018, and the expectation is that this natural decline will continue in accordance with the passage of time. This DPC report is intended to assess the range of regulatory tasks of the Data Protection Commission for the period 25 May 2018 to 25 May 2020. It is distinguishable from the Commission’s Annual Reports in that it does not focus on the administration of the office. The report takes stock of the DPC’s experience of its mandated functions under the GDPR; its legal activities and the allocation of its resources in support of Article 57.1 (b)(d). To note, while the report refers in shorthand to “the GDPR”, it is in fact intended to cover the substantive roles of the DPC under the three main pieces of data protection legislation – the GDPR, the e-Privacy Directive and the Law Enforcement Directive as transposed in the Data Protection Act 2018. Since 25 May 2018, the most frequent GDPR topics for queries and complaints have consistently been: Access Requests; Fair processing; Disclosure; Right to be Forgotten (delisting and/or removal requests); Direct marketing and Data Security. Total breach notifications received between 25 May 2018 and 25 May 2020: 12,437. 93% classified as relating to GDPR (11,567 notifications). Of the 12,437 total recorded breach cases, 94.88% concluded (11,800 cases). The most frequent cause of breaches reported to the DPC is unauthorised disclosure (80%). The purpose of this two-year assessment is to provide a wider-angled lens through which to assess the work of the DPC since the implementation of the General Data Protection Regulation; in particular, to examine wider datasets and annual trends to see what patterns can be identified. While the DPC – as is the case for many other stakeholders – could already make some observations about aspects of the GDPR and the one-stop-shop procedures that work less well, the purpose of the document is not to offer a critique at this juncture but rather to showcase what has – and is – being delivered. Total breach notifications received between 25 May 2018 and 25 May 2020: 12,437. 93% classified as relating to GDPR (11,567 notifications). Of the 12,437 total recorded breach cases, 94.88% concluded (11,800 cases). The most frequent cause of breaches reported to the DPC is unauthorised disclosure (80%) Regulating. Since May 2018, the DPC has opened 24 cross-border inquiries and 53 national inquiries. In May 2020 the DPC issued its first fines under the GDPR, levying two separate fines against an Irish state agency. Also in May 2020, the DPC issued a reprimand to the agency and ordered it to bring its processing into compliance. In the same month, the DPC sent its first major-scale Article 60 Draft Decision to the EDPB. The DPC has concluded nine litigation cases since GDPR came into effect. Through Supervision action, the DPC has brought about the postponement or revision of six planned big tech projects with implications for the rights and freedoms of individuals. Enforcing An Garda Síochana – reprimand and corrective powers applied in accordance with the Data Protection Act, 2018. Tusla; The Child and Family Agency – reprimand and fine applied in accordance with the Data Protection Act, 2018. Tusla; The Child and Family Agency – reprimand and fine applied in accordance with the Data Protection Act, 2018. Twitter – Inquiry completed and draft decision forwarded to EU concerned data protection authorities in accordance with Article 60 of the GDPR. DEASP – Enforcement notice issued regarding the use of the Public Services Card (currently under appeal). 59 Section 10 decisions issued. 15,000 breach notifications assessed and concluded. · 9 litigation cases concluded in the Irish Courts. Hearing in CJEU Standard Contractual Clauses case brought by DPC to Irish High Court. 80% of cases received under the GDPR have been concluded. Mainstreaming Data Protection Staff of the DPC have presented at over 330 stakeholder events since May 25 2018. Since the Coronavirus restrictions have been in effect, the DPC has continued to support stakeholder events through online participation. The DPC has committed to driving awareness of data protection rights and responsibilities, including over 40 guidance notes covering technological advice, GDPR compliance and direct marketing/electoral constraints. Other Activity Since May 2018: The DPC has opened 282 new direct marketing complaints and concluded 247. There have been  11 successful  prosecutions against companies  for a combination of 42 offences under S.I. No. 336/2011. The office handled 66 Law Enforcement Directive complaints. The DPC has successfully completed the EDPB consistency opinion process for both Code of Conduct monitoring bodies and for the additional requirements for INAB. A Data Protection Officer Network has been established. Irish DPC has partnered with the Croatian Data Protection Authority and Vrije University on an EU funded project specifically targeting SMEs. Most Frequently Queried GDPR Topics Since 25 May 2018, the most frequently raised GDPR topics for queries and complaints have consistently been: Queries relating specifically to Access Requests; General queries (unclassified) ; Fair processing (including fair obtaining and further processing); Disclosure (data shared with a third party); Right to be Forgotten (delisting and/or removal requests); Direct marketing; and Data Security. The single most cited data protection issue was access request with a total of 3,398 or 22.62% of all cases. Not far behind lies the field of ‘general query’ which accounted for 3245 cases or 22% of the total. Issues of fair processing and disclosure followed, with 15% and 12% of the total respectively. Breaches  Any organisation or body which makes use of personal data as part of its business – regardless of whether the data pertains to customers or staff – is deemed to be a data controller and ultimately accountable for the safeguarding of the personal information in its possession. Article 33 of the GDPR introduced several obligatory actions for data controllers, including mandatory notification of breaches to the appropriate data protection authority within 72 hours. In the two years since the introduction of this provision, the DPC has seen an exponential increase in the breaches being notified to it. Total breach notifications received between 25 May 2018 and 25 May 2020: 12,437 93% have been classified as relating to GDPR (11,567 notifications). Of the 12,437 total recorded breach cases, 94.88% have been concluded (11,800 cases) and 5.12% are currently active (637 cases). With the exception of a seasonal decline in December 2018, the number of breaches being reported to the DPC remained broadly consistent over the first 18 months of GDPR implementation. Q2 of 2020 shows an overall trend towards reduced breach notifications. It is not possible to attribute this decline to a particular cause, though it is likely that the number of breach notifications has been impacted by the Coronavirus crisis. We saw earlier that by far the most frequent cause of breaches reported to the DPC is unauthorised disclosure (80%); whether by digital, verbal or other manual means. Manual processing – and consequently an inferred lack of robust processing procedures – is at the root of far more reported breaches than phishing, hacking or lost devices (5.6% collectively). As with the trends observed earlier in the queries and complaints that the DPC receives, the patterns within the recorded breach notifications indicate that there is also a significant volume of work that falls to the DPC, which could be mitigated by more robust technical and organisational measures being introduced by the data controller and the processes for testing, assessing and evaluating these measures being overseen by the data protection officer going forward. At present, the DPC workload in the breach area is heavily influenced by the need to engage with organisations to address elementary processing liabilities, which are occurring at a very basic level. As we move forward in time, the DPC expects to see changed behaviours amongst its regulated entities, resulting in a reduction in the volume of breach notifications that can be attributed to a lack of due care and attention. Some examples are instructive. Insufficient organisational and technical measures in place to secure data. An organisation responsible for providing care to both children and adults with a range of support requirements notified the DPC of a breach in which it outlined that a wheelie bin containing the personal data of residents and staff of the facility had been removed from their premises and discarded on a neighbouring property. The individual who discovered the contents of the wheelie bin fly tipped on their property contacted the organisation after first inspecting the records to establish their origin. Following contact from the individual, the organisation arranged to retrieve the records and disposed of them in an appropriate manner. Based on the information provided by the organisation, the DPC raised a number of queries focusing on whether the organisation had policies and procedures for confidential disposal, and whether they were in place at the time of the incident. The organisation advised that it did not have a specific confidential disposal policy in place; however, it did advise that the premises had shredding facilities in place to assist with the confidential disposal of records. On this occasion, these facilities were not utilised. The DPC highlighted that – as a data controller – it was the organisation’s responsibility to ensure that both appropriate organisational and technical measures are employed to ensure that the processing of personal data is done in a secure manner. The DPC also highlighted that the processing of personal data also encompasses both its erasure and/or destruction. The DPC recommended that the data controller undertake the following actions: Complete a GDPR self-assessment to identify areas where immediate remedial actions are required in order to ensure compliance with GDPR. Review their obligations as a data controller, in particular their obligation centering on the security of data. Undertake an exercise to produce adequate policies and procedures in relation to the appropriate disposal of personal/sensitive records both in hard and soft copy. Based on the recommendations of the DPC the data controller has initiated a data protection compliance project to address the areas highlighted. The data controller committed to providing the DPC with updates in relation to the progress of this project and making available the necessary evidence of actions undertaken based on the recommendations provided. This is being monitored on an ongoing basis. Data Processor Accounts Compromised In October 2019, the DPC was notified by an Irish public sector body of a personal data breach, which had occurred as a result of a compromised email account which was being used by a data processor. This exposed the public sector body to the liability that personal data – including data subjects’ names, addresses, dates of birth, details of family relationships and biometric data – could be accessed by a malicious third-party while being sent to, or held in, the compromised account. The data processor was located outside the European Union and was using a locally hosted email provider. The DPC engaged with the public body in order to determine what measures it had in place at the time of the breach to ensure that the processor took all precautions required, pursuant to Article 32 of the GDPR (security of processing). The DPC also sought to determine whether the arrangement between the public sector body and the processor was such as to require the processor to assist it in ensuring compliance with data security and personal data breach notification obligations, and to make available to the controller all information necessary to demonstrate compliance with data security obligations, as required by Article 28 of the GDPR. Following extensive engagement between the DPC and the public sector body in question, the DPC issued specific recommendations to the entity, including recommendations for technical measures to be implemented by third-party processors engaged by the public sector body. In response to these recommendations, the public sector body informed the DPC that it is providing secure email addresses to relevant processors to replace locally hosted email accounts and is revising its conditions for the engagement of data processors, including specific requirements on data security and training. They have also provided the DPC with regular updates on the implementation of the DPC’s recommendations, including providing copies of relevant documentation. The DPC continues to engage on a regular basis with the relevant public sector body in order to monitor its implementation of these recommendations. Unsecured Data Storage In November 2019 the DPC, largely through media reports, was made aware of a potential data breach occurring in an Irish university. This potential breach could be traced to a manner in which large amounts of personal data, including payroll, bank details and PPS numbers, were in a location facilitating easy access by a very large number of people. The university was made aware of its obligations under Art.33 GDPR and following this quickly a breach to the DPC. The DPC engaged with the university to determine who had access to the data, the level of supervision of those who had access, the nature and sensitivity of the data and finally what the university had done to respond to the breach. To prevent a repetition and to ensure that data was processed appropriately in the future, the DPC made some specific recommendations. In particular the DPC advised the data controller: To review the level of physical security applied in respect of the personal data security facilities; To ensure adequate access controls are put in place and, in particular, access to personal data being placed on a strict ‘need to know’ basis, with extra special care given depending on the nature and sensitivity of personal data; To review its data retention policies taking care not to collect or retain unnecessary data and at the same time ensuring that the controller can record and track any archived data; To provide regular and up to date training on data security. The data controller took heed of all the recommendations and continues to engage with the DPC on a periodic basis.( at p.28 DPC report) The point evidenced by the foregoing examples is that the DPC has been busy since the introduction of the GDPR but it seems only the higher profile investigations attract attention. Behind the scenes, and away from public view, many investigations commence, and most are brought to an appropriate conclusion in a timely manner. Results vary and not all investigations lead to sanctions.  Many case examples above display a willingness by the DPC to take a proportionate response. Patrick Rowland, GDPRXpert.ie. We are GDPR and Data Protection consultants with bases in Carlow/Kilkenny and Mayo, offering a nationwide service. For more details visit www.gdprxpert.ie [...]