Editorial Director: Giusella Finocchiaro
Web Content Manager: Giulia Giapponesi

posted by admin on ottobre 23, 2017

Events

(No comments)

More than 20 speakers will discuss cybersecurity at the 2017 China-EU School of Law Conference “Personal Data Protection in Times of Big Data” which will be held in Beijing on the 3rd of November 2017. Gao Hongbing, Vice President of Chinese internet giant Alibaba, is one of them.

At the 2017 China-EU School of Law Academic Conference, legal scholars and entrepreneurs from China and Europe will examine the legal challenges massive data collection poses to the protection of personal data. In speeches and panels, they will ask questions such as: Who owns collected data? How safe are databases? How can personal data be protected? What data can be analysed? Which legal framework can regulate this? China’s 2017 Cybersecurity Law and the EU’s 2018 General Data Protection Regulation play a key role in this debate.

Zhang Fusen, Former Minister of Justice of the People’s Republic of China, Hinrich Julius, Professor of Law and Project Coordinator of the China-EU School of Law Consortium Office are slated to open the conference. Giusella Finocchiaro is one of the panel speakers.

The conferece will start at 9 a.m., it will end at 5 p.m.. Conference venue is the Jingyi Hotel, No. 9 Dazhongsi East Road, Hai Dian District, in Beijing.

 

posted by Giusella Finocchiaro on ottobre 17, 2017

Privacy

(No comments)

Here is the article by Giusella Finocchiaro and Laura Greco, published in Agenda Digitale on 1st September 2017.

Much has already been said on the new data protection requirements introduced by Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (and coming into full force from 25th May 2018).

At first reading, the stringent and precautionary nature of the new legislation was already evident, being characterised by an approach based on the risk assessment of data processing and the accountability of the processing subjects.

As confirmation, it is enough to take a look at the considerable number of obligations the Regulation imposes on data controllers and processors. Compliance with the Regulation particularly aims to organise the entire data processing procedure on the principles of privacy by design and default, with the objective of ensuring that both technological and organisational security measures are adequate compared to the potential risks to which data are exposed during processing.

In the framework of the obligations directed at measuring the risks relating to processing activities, one (particularly) stands out for its relevance and challenging nature, namely, the so called Data Protection Impact Assessment (DPIA), a preventive measure that obliges controllers to verify whether processing might expose personal data to high risk, taking into consideration the specific characteristics of the processing itself involved: namely, its nature, subject, context and purpose as well as the use of new technologies. Although strongly recommended for all types of processing, the DPIA is not mandatory except in cases specifically indicated in the Regulation or in the legislation of Member States.

One particular field in which the DPIA appears not only to be suitable but also essential for data controllers is the work sector. In fact data processing carried out in a work environment seems to fall into under the heading of systematic monitoring of data regarding vulnerable subjects.

The term “vulnerable” is not used at random. Working Party art. 29 uses this term to define employees in the “Guidelines on Data Protection Impact Assessment (DPIA)” adopted on 4th April 2017, where the work environment is considered at risk for the rights of data subjects when taking into account the imbalance of bargaining power in favour of the data controller. Working Party art. 29, which had already given indications in the past with regard to the rights of employees in the field of data protection (see opinion 8/2001, WP48 and working document WP55 of 2002) dedicates its recent opinion 2/2017 to the subject of data processing in the work environment.

In this document the Group of European DPAs updated its considerations on the subject matter in light of the new provisions and in particular, of the new obligations introduced by the Regulation.

Confirming that data processing in the work environment must necessarily comply with the principles of transparency, necessity and minimisation, the Group underlines that consent cannot be considered a requirement for safe and reliable legitimacy since workers cannot consider themselves completely free to give consent to or oppose data processing due to the contractual relationships that bind them to their employer. Hence, in the Group’s opinion, other legal bases would be preferable such as the implementation of the work contract, the controller-employer’s compliance with a legal obligation or his legitimate interest.

However, identifying the conditions which make data processing legal is not sufficient where employee monitoring is concerned: there is the need for a clear, understandable and comprehensive policy – the Group confirms – which keeps employees fully informed of monitoring activities and their related purposes.

And it is right here, between the pillars of lawfulness of data processing and transparency that the DPIA fits in, the risk-based safeguard measure, which combines a proportionality test of the legitimate interest of the employer, the technologies used to assure protection of this and the rights of privacy and secrecy of employee communications. According to the Working Party, the introduction of any technology designed to monitor and control workers should be preceded by a DPIA in order to verify whether the data processing (and the ways in which it is carried out) are commensurate with the risk the employer must face.

Following a theoretical presentation of the framework of the Regulation, its fundamental principles and innovations, the Group of DPAs closely examines a series of data processing scenarios that may occur in an organisation’s routine procedure, with particular reference to the use of new technologies. The Group focuses in particular on those technologies that permit the monitoring of employees not only at their work place but also at their homes and, more generally, in their private lives. This happens for example where BYOD (Bring Your Own Device) technologies are used, which allow workers to use their own personal devices for work purposes. The mixed use of such devices might create the risk of processing information outside the work sphere. Therefore, in order to avoid such an eventuality, the Group recommends adopting appropriate measures which would make identifying the use of the device possible.

Finally, in outlining the protection afforded to workers, the European DPAs not only take into account the advanced technological context but also the business world: processing carried out by a business group based in different Member States may mean the transfer of employee data to third countries. In such cases – as well as in the case of the use of applications and cloud-based services that imply a cross-border flow of personal data – data transfer will be legal on condition that the third country data importer assures an adequate level of data protection.

To summarise: legality, transparency, proportionality, balancing of interests, minimisation. These are the key words (and the pillars) of data processing in the work environment.

In addition, it is worth keeping in mind that art. 88, paragraph 1 of the Regulation provides that Member States may “by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context”. This leads to a further reflection on the adequacy of the modifications made to law no. 300, 20th May 1970, (“Workers’ Statute”) by the recent Jobs Act reform. Therefore, there needs to be evaluation of whether the new provisions are in effect sufficient in light of the Working Party recommendations and given the scenarios envisioned, or whether further action by the Italian legislator will be necessary.

 

 

posted by admin on ottobre 2, 2017

Privacy, Right to oblivion

(No comments)

Time is not the only element which needs taking into consideration when examining cases concerning the right to be forgotten, since in addition to which, the public role of the parties involved and the current relevance of the news itself are also important factors that need taking into account.

Although the time elapsed since the facts reported in the press is the most important element in evaluating whether an application for the “right to be forgotten” will be successful, in a recent decision the Italian DPA has pointed out that other circumstances also need to be evaluated.

The decision concerns the appeal made by a high-ranking public official who requested Google to remove certain search results obtained by typing in his name. The point in question was a link to articles reporting news of a court case dating back 16 years, which had terminated with the conviction of the official, whose name had then been fully cleared in the course of the following years. One of the articles, the removal of which had been requested, had been published at the time of the facts while other more recent ones had picked up the story again at the time of the public official’s appointment to an important new post.

The Italian DPA stated that in evaluating a case involving the right to be forgotten it is necessary to take into account all search results found by typing in the first name and second name of the data subject concerned, which are also associated with other descriptive terms, such as the office held or the circumstances of the conviction.

This is an interpretation in line with the widely known decision by the European Court of Justice of 13th May 2014, known as “Google Spain”, in which the judges handed down a ruling ordering the search engine to remove from the list of results of a search made starting with the name of a person, those links to web pages published by third parties and containing data relating to that person, also in the case in which the name or the data are not previously or simultaneously withdrawn from the web pages and also when their being made available on those web pages is legal to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.

According to the ruling all urls reachable through a search “starting from the name” must be considered, and so without excluding the possibility that other descriptive terms may be linked to the name in order to find more specific results.

Once this important point had been clarified, the DPA ordered Google to deindex the url with the single direct link to the only article carrying the news of the plaintiff’s criminal conviction. In fact, the DPA considered that, due to the time elapsed and the fact that the plaintiff’s name had been cleared, the news was no longer relevant to the current situation.

Conversely, with regard to the other articles indicated by the applicant, the DPA recognised that, although referring to the same court case, these “contain the story in a broader context of information, in which other information is also provided”, which is connected to the public role held by the interested party and that those results were without doubt of public interest “in addition due to the role in public life held by the applicant”. Therefore, with regard to the request for their removal, the DPA dismissed the complaint as unfounded.

 

 

posted by admin on settembre 15, 2017

Privacy

(No comments)

On July 18th, Quotidiano Nazionale, the Italian daily newspaper that groups together three other dailies, Il Resto del Carlino, Il Giorno and La Nazione, published an analysis by Professor Giusella Finocchiaro of the legal implications relating to the unauthorised online publication of photographs taken from an email box.

It is neither possible nor right to comment on the technical-legal aspects of a sentence, the motivations of which are still not known and which will only be filed within the next 90 days. This is the reason we must wait. We have read that the Court of Milan has acquitted three bloggers accused by the Public Prosecutor of illegally stealing photographs of George Clooney and Elisabetta Canalis’s party from the email account of one of the party’s guests. But we have no further details. The precise nature of the charges concerned unauthorised access to an IT system, illegal interception of communications and violation of correspondence. From the first press leaks we read that on the one hand the judge appears to have partly opted for acquittal because the case was unfounded and on the other hand has deemed the conduct of the accused to constitute the less serious offence of disclosure of other parties’ correspondence, consequently acquitting the accused, since, in the absence of a formal complaint from the aggrieved parties, the offence would not have been prosecutable.

Thus, partly (at least), basically technical reasons. We do not even have any knowledge of the evidence produced in court and the presentation of electronic evidence in the trial is still ground to be fully explored. Of course a general consideration does need to be made: the Internet is not the Wild West and all the rules including procedural rules are also valid online. The same rules that apply outside the Web also apply on the Web, with the difficulties that this at times entails (we only need to remember the case of Tiziana Cantone). So, if the judges have decided on acquittal we can be in no doubt that there is appropriate legal reasoning. But certainly, unauthorised distribution of photographs or a violation of correspondence, which have been satisfactorily proven during the proceedings, are illegal both on and outside the Internet.

 

 

posted by admin on luglio 18, 2017

E-commerce and contracts

(No comments)

The United Nations Commission on International Trade Law (UNCITRAL) adopted the UNCITRAL Model Law on Electronic Transferable Records (the “MLETR”) on 13 July at its fiftieth session in Vienna.

The MLETR legally enables the use of electronic transferable records that are functionally equivalent to transferable documents and instruments including bills of lading, bills of exchange, promissory notes and warehouse receipts.

The use of electronic transferable records may bring a number of benefits to electronic commerce including speed and security of transmission as well as the possibility of reusing the information contained therein. Electronic transferable records may be particularly relevant for certain business areas such as transport and logistics and finance (fintech). Moreover, their use allows for the establishment a fully paperless trade environment.

The MLETR sets forth the requirements for the use of an electronic transferable record. In particular, it defines control as the functional equivalent of possession of a transferable document or instrument. The MLETR also provides guidance on the assessment of the reliability of the method used to manage the electronic transferable record, on change of medium (electronic to paper and the reverse), and on cross-border aspects, among other items.

The MLETR builds upon fundamental principles underlying existing UNCITRAL texts in the area of electronic commerce. In particular, the adoption of the principle of functional equivalence allows the MLETR to operate without affecting the substantive law applicable to transferable documents and instruments, and the adoption of the principle of technology neutrality allows to accommodate the use of all methods and technologies, including distributed ledgers (blockchain).

The MLETR is accompanied by an Explanatory Note that provides background information to assist States in enacting its provisions and to offer guidance to other users of the text.

The work on the preparation of the MLETR was undertaken by UNCITRAL Working Group IV (Electronic Commerce) from its 45th session in 2011 until its 54th session in 2016. The final version of the MLETR will be made available at UNCITRAL website.

 

 

posted by admin on luglio 16, 2017

E-commerce and contracts

(No comments)

At its fiftieth session the UNCITRAL Commission adopted the Model Law on Electronic Transferable Records. This is the result of work done by Working Group IV on Electronic Commerce.

The Model Law represents a significant further step forward in the development of electronic commerce and removes the legal obstacles to the international circulation of electronic transferable records. The Model Law is based on the UNCITRAL technology neutrality principle and on the functional equivalent approach.

Professor Giusella Finocchiaro is the current Chair of the Working Group on Electronic Commerce.

The Working Group has dealt with the definition and regulation of electronic transferable records from 2011 to 2016. On the 13th of July 2017, the Commission approved and adopted the Model Law.

 

 

 

The 50th annual session of the UNCITRAL Commission will be held in Vienna from the 3rd to the 21th July 2017. During the session the Commission will consider the deliberations and decisions of its Working Group IV on Electronic Commerce regarding the finalization and adoption of a Model Law on Electronic Transferable Records.

In 2011, the Commission mandated the Working Group IV to undertake work on electronic transferable records. The Working Group has worked on that subject from its forty-fifth session (Vienna, 10-14 October 2011) to its fifty-fourth session (Vienna, 31 October-4 November 2016). At its fifty-fourth session, the Working Group asked the Secretariat to revise both the draft model law on electronic transferable records and explanatory materials contained in document and to transmit the revised texts to the Commission for consideration at its fiftieth session. For these reasons, the Working Group invited the UNCITRAL Secretariat to forward the text to all Member States and international organisations for their opinions, in order to submit their comments to the UNCITRAL Commission at its 50th session.

Meanwhile, in 2016, the UNCITRAL Commission assigned to the Working Group a new project regarding new identity management and trust services, as well as cloud computing, underlying that it would have been premature to prioritize between the two topics. Therefore the Commission asked the Secretariat and the Working Group to continue updating and conducting preparatory work on the two topics, assessing their parallel execution and reporting back to the Commission so that it could make an informed decision at a future session, including the priority to give to each topic. In that context, it was mentioned that priority should be based on practical needs, rather than on how interesting the topic was or upon the feasibility of work.

 

 

 

posted by admin on giugno 15, 2017

Privacy

(No comments)

The Article 29 Working Party of the European Data Protection Authorities (DPAs) has published a report on the public consultations held inside the Working Group in particular regarding critical aspects of the Privacy Regulation such as the concept of “consent”, compliance with notification of data breach and the profiling process.

As we know, the European Regulation 2016/679 on the processing of personal data, which has been in force since 24th May 2016, will take full effect from 25th May 2018. So, with the aim of taking prompt action to put in place the implementation of the GDPR, the Article 29 Working Party has organized a number of Fablab workshops with the objective of opening up dialogue with  representatives of European industry, the civil society, relevant associations and the academic world. More than 90 participants took part in the last Fablab session, which took place on April 5th and 6th in Brussels, where they discussed the priority issues of the European Regulation with the European DPAs.

With regard to the subject of “consent”, which constitutes the main legal basis for the processing of personal data, it emerged from the workshop that in certain cases the definition of “consent” contained in the Regulation might not in fact be a reliable basis for the use of personal data. Specific concerns have been raised about the processing of the personal data of a minor, since there is currently no way to either verify the exact age of individuals who give their consent online, or to confirm the identity of persons who declare online that they have parental responsibility.

With regard to consent for the processing of personal data for scientific research purposes, uncertainty was expressed about the secondary use of these data.

Participants also expressed uncertainty about the possibility of the withdrawal of already given consent and the possible consequences faced by those who refuse to grant it. Specific concerns were expressed about the situations in which those individuals who do not give their consent are not able to avail themselves of a particular service.

Further issue concerns have been raised about deals with data breach notifications. Participants asked for greater flexibility on the contents of notifications given the damage to their reputations companies which are victims of such attacks might suffer. They also asked for greater clarity both about methods of notification and the recipients of the notification in cases concerning data of data subjects from different Member States. Is notification required to be given to the Authorities of each Member State involved?

In addition, the workshop participants discussed the question of profiling as a particular form of processing of personal data. There are numerous types of profiling which differ from sector to sector and which cannot be subject to the same provision. For this reason, specific guidelines for each type of profiling have been requested. In addition the guidelines will have to take into account the different objectives for which profiling is made. On this subject, doubts have been expressed about whether there should be limitations to the types of data that can be used. In particular  regarding the personal data of minors. Participants also raised objections about there being no clear distinction between profiling processes based on human intervention and those which are completely automated.

The complete meeting report is available on the European Commission webpage dedicated to WP29.

 

In a piece published on the 15th April 2017 in the Quotidiano Nazionale (a daily which features articles from three Italian newspapers, Il Resto del Carlino, Il Giorno and La Nazione), Giusella Finocchiaro offered her thoughts on data protection and minors.

“Can children and adolescents sign up to Facebook or other social network accounts?

If being of age is a legal requirement for concluding a contract, then, why should it not be the case for signing up to a social network account? What is the age required for giving valid consent to the processing of personal data? Under Facebook regulations it is 13 years of age and under Italian law it is 18.

Then, why are so many Italian children and adolescents signed up to social networks? The answer is simple: according to the majority of subscription contracts, it is not Italian law which is applicable but the law governing the social network, which means, in the case of Facebook, the law of the United States of America and of the State of California.

Which law takes precedence? This is the most classical legal problem on the Internet, namely, determining which law is applicable and the jurisdiction. The new European Regulation n. 2016/679 on the Protection of Personal Data, which represents the new European law on data protection and is directly applicable from 25th May 2018, solves the problem with a partial compromise. It provides that European law takes precedence and that 16 is the minimum age to sign up (with an option for each Member State to set a lower age, provided that it is not below 13 years). Where the child is below the age of 16, parental consent is given or authorised.

According to certain recent Italian decisions in similar cases (the posting of pictures of their own children on social networks), the consent of both parents is needed. It is clear that it will not be very difficult to get round this provision. However, as the European Regulation provides for, it is the social network itself which will need to keep a check on things, by using available technology”.

 

 

posted by Laura Greco on maggio 15, 2017

Privacy

(No comments)

The Italian Court of Cassation has recently been called on to deal with the issue of whether payment descriptions for bank transfers qualify as sensitive data, in cases in which they specify indemnity payments for illness or disability using the wording “allowance ex L. 210/1992”, (the law which grants allowances to parties who have suffered irreversible complications due to mandatory vaccination and blood transfusions, or in cases of decease, to their families).

The Supreme Court judges have expressed conflicting decisions in several such cases. In all the examined cases, the matter concerned the relations between the Region, which issues the allowance and authorizes the bank transfer, and the ill or disabled party’s bank, which is the recipient of the allowance on behalf of its current account holder.

In the case of the first decision dating from 2014 (judgement n. 10947 of 19th May 2014), the Court considered the payment description, which quoted the above-mentioned legislative references, as sensitive data and thus determined that both the Region and the bank had unlawfully processed personal data since they had not adopted security measures for the transmission and dissemination of said data, such as encryption techniques and non-identifiable codes, as provided for by Art. 22, 6° par. of the Personal Data Protection Code.

In the second decision (judgement n. 10280 of 20th May 2015), which is clearer and better developed than the previous one, the Supreme Court judges overturned their first approach and followed a quite different decision-making process. Firstly, they rejected the concept that payment descriptions for allowances filled out in such a way constituted sensitive data, as the law quoted provided that the recipients of these allowances could either be the parties directly affected or otherwise their families. Since the payment of the allowance did not depend on the illness of the party who actually received it, the judges concluded that the information was not sufficient to reveal the recipient’s state of health and, therefore, did not constitute sensitive data.

Secondly, according to the Supreme Court, it was not a question of the Region rendering the data transferred to the bank public, as this would have implied – in conformity with Art. 4, lett. m) of the Code – disclosure of the data to unspecified parties, whereas in this case the disclosure was only made to the bank of the current account holder who was the beneficiary of the allowance.

Furthermore, the judges considered that references to Art. 22, 6° par. of the Code were groundless, since, as correctly quoted, the adoption of encryption techniques is only required in specific cases where the data originate from directories or registries and the aim is to manage and consult them. Neither could the bank be considered to have the responsibility for adopting these measures for three different reasons: firstly, the provision is only applicable to public bodies; secondly, private entities are only obliged to adopt encryption measures in relation to sensitive data which would reveal a state of health and were processed with electronic systems, both of which conditions are missing in the present case; finally, communicating to a client of the bank’s his/her personal data does not constitute processing of personal data.

Finally, in the opinion of the Court, the role of the bank was that of the current account holder’s representative and it received the payment from the Region on his/her behalf: thus, the payment was to be considered as being directly effected by the debtor (the Region) to the creditor (the recipient of the allowance). Therefore, the Supreme Court considered both the Region’s and the bank’s conduct to be within the law and acknowledged there had been no illegal processing of personal data.

This question has recently once again been deliberated by the 1st Civil Division of the Court of Cassation, which has issued two interlocutory orders (no. 3455 and no. 3456 registered on 9th February 2017) delegating the “Sezioni Unite” (the Joint Divisions), the task of devising a solution to this conflict of case law. On this occasion the Supreme Court has abstained from expressing its own opinion one way or the other with regard to the different interpretations of case law regarding this issue, and has simply commented on the nature of payment descriptions as “sensitive data”. The Court has pointed out that, even if payment can be made both to the family and the ill or disabled party, only the latter would receive payment in instalments (whereas family would receive a lump sum). This particular method of payment would clearly identify the recipient of the payment as the victim of illness or disability and for this reason the indication of a payment in instalments would constitute sensitive data.

We will have to wait to see how the Joint Divisions will solve this conflict of case law we have just described and in particular whether they opt for a broad or restrictive interpretation of the concept of sensitive data.

 

 

  • Recent comments

  • Popular posts

    • None found