Editorial Director: Giusella Finocchiaro
Web Content Manager: Giulia Giapponesi

posted by admin on giugno 15, 2018

GDPR Regulation EU 2016/679

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will be soon directly applicable on the entire European territory. Companies, public administrations and private citizens are in the final rush to comply with the dispositions of the new legislation.

What is a supervisory authority?

A supervisory authority is defined as one or more independent public authorities to be responsible for monitoring the application of the GDPR (in every Member state), in order to protect the fundamental rights and freedoms of natural persons in relation to processing. An authority’s tasks also include contributing to facilitating the free flow of personal data within the Union. In Italy this authority is the “Garante per la protezione dei dati personali”.

What are the features of supervisory authorities?

The fundamental characteristic is their independence. The members of the authorities must remain free from external influence, whether direct or indirect, and can neither seek nor take instructions from anyone. To this end, Member States ensure that supervisory authorities established in their individual countries are provided with the financial and human resources, necessary for the impartial performance of their tasks.

Supervisory authorities are only authorised to exercise their powers within the boundaries of their own Member States. They are not qualified to supervise processing operations of courts acting in their judicial capacity. Requests for their intervention are usually free of charge for data subjects.

What are the tasks of a supervisory authority?

The main tasks of a supervisory authority include:

1) advising national institutions on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing;

2) handling complaints lodged by a data subject or his/her attorneys;

3) cooperating with and providing mutual assistance to other supervisory authorities;

4) monitoring relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;

5) encouraging the drawing up of codes of conduct and the establishment of data protection certification mechanisms.

What are the powers of a supervisory authority?

To fulfil its tasks a supervisory authority is granted a number of investigative, corrective, authorisation powers. The following are some examples of an authority’s diverse powers:

an authority has the investigative powers:

1) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

2) to carry out investigations and notify of alleged infringements of the Regulation;

3) to obtain access to any premises of the controller and the processor;

the corrective powers:

4) to issue warnings and reprimands to a controller or a processor where processing operations are likely to or have already infringed provisions of the Regulation;

5) to impose a temporary or definitive limitation including a ban on processing;

6) to impose an administrative fine

the authorisation and advisory powers:

7) to authorise processing and standard contractual clauses, approve codes of conduct and issue certifications.

What is the Lead Supervisory Authority (Lead SA)?

The Lead Supervisory Authority is competent for cross-border processing and is located in what is identified as the establishment where decisions are made about the purposes and means of personal data processing, the “main establishment” or the “single establishment” of the controller or processor. Working Party Art. 29, which includes the representatives of the national data protection authorities, has expressed its opinion on the role of the lead supervisory authority and has issued specific guidelines.

The Lead supervisory Authority coordinates all activities among the different “concerned” supervisory authorities involved in cross-border processing, both to facilitate the sharing of information and to reach unanimous agreement. Therefore, the lead supervisory authority may request supervisory authorities to provide mutual assistance and may conduct joint operations. Before a final decision, the Lead SA will submit the draft decision to the other “concerned” authorities for their opinion and take due account of their views. Should the Lead SA decide not to share an objection expressed by the other “concerned” authorities, it must submit the matter to the consistency mechanism. The mechanism provides for the involvement of the European Data Protection Board which must reach a decision on the matter within a month.

What does mutual assistance through the consistency mechanism mean?

Mutual assistance means that activity of cooperation and sharing of information which takes place both among national supervisory authorities and between these and the lead supervisory authority.

Mutual assistance includes, for example, requests to carry out prior authorisations and consultations as well as inspections and investigations.

Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. The requested supervisory authority cannot refuse to comply with the request unless it is not competent or compliance with the request would infringe the GDPR, EU or Member State law.



posted by admin on marzo 31, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which start from already well-known privacy concepts and give a brief guide to the new legislation.

Who is the Data Protection Officer?

The Data Protection Officer, more commonly known as the DPO, is appointed by the controller or processor and mainly plays a dual role: firstly, he/she is entrusted with the duty of monitoring and overseeing compliance with the GDPR within the organisation of the person who has appointed him/her; secondly, he/she acts as a point of contact between the organisation and GDPR authorities and interfaces with data subjects.

When should a DPO be appointed?

The appointment of the DPO is mandatory (Art. 37) when: a) the processing is carried out by a public authority or body (except judicial authorities); b) the core activities of the controller or processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale; or c) the core activities of the controller or processor consist of processing on a large scale of sensitive data (e.g. data relating to health, genetic data, biometric data, data relating to criminal offences or data relating to minors). However, Union or Member state law can provide for further cases of mandatory appointment.

Apart from these cases, the appointment of a DPO is discretionary but still strongly recommended, given the importance of the role in assisting and supporting compliance with the GDPR.

What skills are required to be appointed as DPO?

The DPO must have significant specialist knowledge commensurate with the sensitivity, complexity and amount of data processed by an organisation. In particular, he/she must have full command of national and European data protection laws and practices and be thoroughly knowledgeable of the GDPR as well as of the business sector and the controller’s organisation.

Lastly, he/she must have a significant degree of familiarity with the processing operations carried out, as well as the IT systems and data security and data protection needs of the controller.

What tasks does the DPO have?

Beside the roles of internal coordination and external contact point, the DPO will take charge of the ongoing (awareness-raising and) training of the controller’s or processor’s staff in the field of data protection, monitor compliance with the GDPR and play an advisory role, giving advice upon request on data protection impact assessments (DPIAs) and monitor their performance. This task list is by no means complete and the controller or processor may decide to assign further tasks to the DPO, such as for example the task of maintaining the record of processing activities.

Can the role of DPO be allocated to an employee of the controller/processor?

The controller or processor can either decide to appoint an internal member of staff of their own organisation as DPO (a new or existing staff member) or to contract the role externally (by means of outsourcing or a service contract). In both cases, the controller or processor must ensure that the DPO is in the position to be able to perform his/her duties and tasks in an independent manner and that any such tasks and duties do not give rise to a conflict of interest. For this reason, the controller and processor must ensure that the DPO does not receive any instructions and that he/she will not be dismissed or penalised for performing his/her tasks.

Can the DPO have his/her own team?

The controller or processor must provide all resources necessary for the DPO to be able to carry out his/her tasks, such as sufficient time, adequate financial resources, infrastructure (premises, facilities, equipment) and staff. The DPO can also have his/her own team to help him/her in performing his/her tasks. In such cases, the internal structure of the team and the tasks and responsibilities of each of its members should be clearly drawn up and there should be a designated lead contact.

Who is responsible for non-compliance with the GDPR ?

The DPO is not personally responsible for non-compliance with the GDPR during processing. Only the controller and the processor are responsible for any non-compliance with the Regulation when performing processing.

Is the controller/processor required to publish and communicate the DPO’s appointment?

The appointment of the DPO must be published and communicated both inside and outside the organisation of the controller or the processor. In particular, contact details of the DPO, such as for example a postal address, a dedicated telephone number, and/or a dedicated e-mail address (and possibly a dedicated contact form) should be published on the controller’s or processor’s website. The same contact details will be communicated to the relevant supervisory authority and to data subjects with the privacy notice (see, the first FAQ on privacy policies “link”).

Focus: the “large scale” concept

The GDPR does not define what large scale processing is. Working Party Art. 29, offers some criteria in order to clarify the concept in its Guidelines on DPOs of 5th April 2017 . When determining whether the processing is carried out on a large scale, the following factors can be considered:

• The number of data subjects concerned-either as a specific number or as a proportion of the relevant population;

• The volume of data and/or the range of different data items being processed;

• The duration, or permanence, of the data processing activity;

• The geographical extent of the processing activity.

Examples of large-scale processing include:

• processing of patient data in the regular course of business by a hospital;

• processing of travel data of individuals using a city’s public transport system (e.g. tracking via

travel cards);

• processing of customer data in the regular course of business by an insurance company or a bank.




posted by admin on febbraio 15, 2018


(No comments)

In view of the imminent deadline for the application of the European legislation on the protection of personal data, the Ministry of Justice has appointed a team of experts whose immediate task will be to assure that the current Italian Privacy Code complies with the new rules.

There are two European regulations which will need to be implemented in the Italian framework in May 2018. Regulation 2016/679 of the European Parliament and Council on privacy (GDPR), which repeals the previous 1995 Directive, will come into effect from May 25th 2018, while the deadline of May 6th has been set for publishing and implementing the legislative, regulatory and administrative dispositions of Directive EU 2016/680, which concerns the protection of personal data processed by the competent authorities for the purpose of the prevention, investigation, or prosecution of criminal offences.

In order that the Italian Code on personal data protection will comply with the new rules as quickly as possible, the Government has taken the decision to also utilise a team of qualified experts from outside the Administration and from different professional fields. On December 14th 2017, Professor Giusella Finocchiaro was appointed by the Ministry of Justice to lead the Working Group in charge of drawing up the Legislative Decrees to guarantee the prompt implementation and compliance of the internal framework with the European data protection requirements.

posted by admin on febbraio 1, 2018


(No comments)

The Swedish streaming music giant must contend with a lawsuit from the American company Wixen Music Publishing which is suing it for copyright infringement, specifically alleging Spotify is using thousands of its songs without a proper licence and compensation to the music publisher.

Spotify, the company which offers unlimited music streaming on subscription, is accused of failing to pay fair royalties to the right-holders of Wixen Music Publishing which manages the rights of 10,784 songs of artists such as Tom Petty, the Doors, Carlos Santana and Neil Young.

The music publishing company is seeking a damages award from Spotify for lump-sum compensation worth $ 150,000 per song, for a total of more than $ 1,6 billion.

Spotify is not new to this kind of legal action as in May 2017, after a drawn-out lawsuit, the Stockholm based company had already reached an agreement to settle a class action lawsuit led by the singer-songwriters David Lowery and Melissa Ferrick, to pay the authors $ 43 million in rights in view of the listing of their shares on the New York Stock Exchange (NYSE) expected for this year. In July 2016, songwriter Bob Gaudio and music publisher Bluewater Music Services in Nashville, took legal action filing lawsuits for the same reasons.

Meanwhile Spotify has filed documentation for DPO (direct public offering), namely direct listing of its shares on the New York Stock Exchange, to the Securities and Exchange Commission (SEC) which should take place by the first trimester of the year. Spotify, the clear worldwide-leader in music streaming, recently revealed that it had over 70 million paying subscribers. Its value was estimated at $8,5 billion last year, but it seems that the company’s value has risen to $20 billion after a recent equity shares swap with the Chinese social media giant Tencent Music Entertainment.



posted by admin on gennaio 8, 2018

New technologies

(No comments)

More than a half century ago, Bob Dylan’s “A hard rain’s a-gonna fall” reflected a dark and turbulent world facing a potential nuclear attack, the rising threat of environmental pollution, a rapid shifting of the international order, a growing divisiveness within society and the dawning of new socio-political paradigms and power centers. Does this sound like today? Or is the falling rain the source of new opportunities?

Nomisma asked prominent experts from around the world to share their views on major trends which will affect the global agenda in the next year. Giusella Finocchiaro is the author of the chapter regarding Internet Law in 2018. All contributions are collected in a book edited by Andrea Goldstein and Julia K. Culver.

The book can be freely downloaded by clicking HERE.

The presentation of the book will take place in Milan, on the 12th of January 2018. For more information, please visit NOMISMA website.


posted by admin on dicembre 15, 2017


(No comments)

The European Parliament has endorsed the opening of negotiations between the Parliament itself and the Council concerning the procedure for adopting the proposal for the Regulation on Privacy and Electronic Communications.

The current directive on e-Privacy was last reviewed in 2009 and the proposal for review, which was submitted on the 10th January 2017, replaces this directive with a Regulation which complements and particularises the European framework on data protection bringing it into line with the General Data Protection Regulation (“GDPR”) which will apply from 25th May 2018.

The Regulation on Privacy and Electronic Communications submitted by the Commission, will increase the protection of people’s private life and open up new opportunities for business. The measures presented aim at revising current rules, extending the scope to all communication service providers. The rules on privacy will now also apply to new operators who provide electronic communication services, such as WhatsApp, Facebook Messenger, Skype, Gmail, iMessage and Viber. The current e-Privacy Directive, which now only applies to traditional communication service providers, will be updated.

The objective is to increase trust in and the security of the Digital Single Market striking the right balance between a high level of protection for consumers and the opportunity for businesses to innovate. In addition, the proposal provides that personal data processing carried out by European institutions and bodies will ensure the same level of protection as that guaranteed by single Member States, as laid down in the General Data Protection Regulation (GDPR) and it defines a strategic approach to questions regarding the cross-border transfer of personal data.



posted by admin on novembre 15, 2017

Accountability, Privacy

(No comments)

The following is an analysis of a proposal for a regulation “for a framework on the free flow of non-personal data in the European Union”.

The objective of the regulation is the liberalisation of data flows. It is worth noting that this liberalisation suffers from two intrinsic limitations in the proposal: on the one hand it only refers to non-personal data, which, for clear reasons of consistency, are defined as “data other than those defined in art. 4, Regulation EU 2016/679”; and on the other hand it solely pertains to the movement of data within the European Union borders, whereas it in no way affects the exchange of data outside the Union.

The Commission identifies two main obstacles to businesses and public administrations having full freedom to choose the location where they store and manage their data.

The first obstacle is represented by the unjustified restrictions on data localisation imposed by public authorities in Member States. Over the years, the reasons which have moved Member States to impose the mandatory local storage of their data on national businesses and public administrations, include maintaining higher levels of security and facilitating easier monitoring by national authorities. For example, this includes the storage measures for financial statements and accounting data provided for in Germany, Denmark, Belgium and other northern European countries, which require that data be filed within national borders. In the same way, in countries such as Bulgaria, Poland and Romania data localisation requirements are imposed on winnings and user transactions. In Bulgaria for example, an applicant for a gaming license must assure that all data related to operations in Bulgaria is retained on a server located within the country. In addition, even when no specific territorial restriction is in place, business practice and common sense have in any case led in the direction of favouring localised data storage, turning down the chance of alternative cross- border offers.

The second obstacle to data liberalisation derives from private market limitations, which prevent data portability across IT systems by means of so-called vendor lock-in (aka proprietary lock-in or customer lock-in) practices. This widespread business phenomenon (e.g. Microsoft, Apple, Google, Nvidia, even hotels!) has its origin in providers wanting to create a condition of artificial dependence, which makes customers virtually totally dependent on them for the goods or services they provide. Customers are put in such a position that they cannot purchase goods or services from a competitor without incurring both the substantial costs and cumbersome and inconvenient organisational difficulties involved in switching to a new provider. Providers implement this sort of “forced loyalty” both by means of adopting technologies or standards differ from those used by competitors and the inclusion of contractual conditions which are particularly penalising in case of a switch.

Thus, in order to curb the spread of such practices and arrangements, with this proposal the Commission wants to tackle the problems through four lines of action.

Firstly, the proposal introduces a general principle of free circulation of data among Member States which allows businesses free choice of where to process or store their data. Legally provided restrictions will have to be be carefully scrutinised and will only be legitimate in cases when public and/or national security are at stake.

Secondly, with the intention of reassuring national legislators, the proposal guarantees that the competent authorities (of each Member State) will have access to data stored or processed in another Member State on the same conditions of access guaranteed nationally.

Thirdly, the proposal encourages the elaboration of self-regulatory codes of conduct which would smooth portability conditions and therefore, for example, switches of cloud service providers. The aim is that of also building a sort of “right to data portability” for non-personal data, in the same way as that provided for by the privacy Regulation for personal data. The need is to make sure that that customers’ freedom of choice is in place not only at the start of a contractual relationship, but that it is maintained and made technically possible for the entire duration of the relationship.

Lastly, the proposal establishes a central point of contact for each Member State, in order to guarantee the successful application of the new rules on the free flow of non-personal data.

In conclusion, there is no doubt that the regulation proposal is aimed first and foremost at businesses and public administrations, with significantly lower impact on individual citizens. However, if it is seen in the light of and in coordination with the European data framework, the proposal takes on much more general relevance. In fact, thanks to this new formulation, a number of the principles contained in the privacy Regulation, such as those regarding free data circulation and data portability, would be strengthened as a result of an extension of their scope of application.



posted by admin on ottobre 23, 2017


(No comments)

More than 20 speakers will discuss cybersecurity at the 2017 China-EU School of Law Conference “Personal Data Protection in Times of Big Data” which will be held in Beijing on the 3rd of November 2017. Gao Hongbing, Vice President of Chinese internet giant Alibaba, is one of them.

At the 2017 China-EU School of Law Academic Conference, legal scholars and entrepreneurs from China and Europe will examine the legal challenges massive data collection poses to the protection of personal data. In speeches and panels, they will ask questions such as: Who owns collected data? How safe are databases? How can personal data be protected? What data can be analysed? Which legal framework can regulate this? China’s 2017 Cybersecurity Law and the EU’s 2018 General Data Protection Regulation play a key role in this debate.

Zhang Fusen, Former Minister of Justice of the People’s Republic of China, Hinrich Julius, Professor of Law and Project Coordinator of the China-EU School of Law Consortium Office are slated to open the conference. Giusella Finocchiaro is one of the panel speakers.

The conferece will start at 9 a.m., it will end at 5 p.m.. Conference venue is the Jingyi Hotel, No. 9 Dazhongsi East Road, Hai Dian District, in Beijing.


posted by admin on ottobre 2, 2017

Privacy, Right to oblivion

(No comments)

Time is not the only element which needs taking into consideration when examining cases concerning the right to be forgotten, since in addition to which, the public role of the parties involved and the current relevance of the news itself are also important factors that need taking into account.

Although the time elapsed since the facts reported in the press is the most important element in evaluating whether an application for the “right to be forgotten” will be successful, in a recent decision the Italian DPA has pointed out that other circumstances also need to be evaluated.

The decision concerns the appeal made by a high-ranking public official who requested Google to remove certain search results obtained by typing in his name. The point in question was a link to articles reporting news of a court case dating back 16 years, which had terminated with the conviction of the official, whose name had then been fully cleared in the course of the following years. One of the articles, the removal of which had been requested, had been published at the time of the facts while other more recent ones had picked up the story again at the time of the public official’s appointment to an important new post.

The Italian DPA stated that in evaluating a case involving the right to be forgotten it is necessary to take into account all search results found by typing in the first name and second name of the data subject concerned, which are also associated with other descriptive terms, such as the office held or the circumstances of the conviction.

This is an interpretation in line with the widely known decision by the European Court of Justice of 13th May 2014, known as “Google Spain”, in which the judges handed down a ruling ordering the search engine to remove from the list of results of a search made starting with the name of a person, those links to web pages published by third parties and containing data relating to that person, also in the case in which the name or the data are not previously or simultaneously withdrawn from the web pages and also when their being made available on those web pages is legal to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful.

According to the ruling all urls reachable through a search “starting from the name” must be considered, and so without excluding the possibility that other descriptive terms may be linked to the name in order to find more specific results.

Once this important point had been clarified, the DPA ordered Google to deindex the url with the single direct link to the only article carrying the news of the plaintiff’s criminal conviction. In fact, the DPA considered that, due to the time elapsed and the fact that the plaintiff’s name had been cleared, the news was no longer relevant to the current situation.

Conversely, with regard to the other articles indicated by the applicant, the DPA recognised that, although referring to the same court case, these “contain the story in a broader context of information, in which other information is also provided”, which is connected to the public role held by the interested party and that those results were without doubt of public interest “in addition due to the role in public life held by the applicant”. Therefore, with regard to the request for their removal, the DPA dismissed the complaint as unfounded.



posted by admin on settembre 15, 2017


(No comments)

On July 18th, Quotidiano Nazionale, the Italian daily newspaper that groups together three other dailies, Il Resto del Carlino, Il Giorno and La Nazione, published an analysis by Professor Giusella Finocchiaro of the legal implications relating to the unauthorised online publication of photographs taken from an email box.

It is neither possible nor right to comment on the technical-legal aspects of a sentence, the motivations of which are still not known and which will only be filed within the next 90 days. This is the reason we must wait. We have read that the Court of Milan has acquitted three bloggers accused by the Public Prosecutor of illegally stealing photographs of George Clooney and Elisabetta Canalis’s party from the email account of one of the party’s guests. But we have no further details. The precise nature of the charges concerned unauthorised access to an IT system, illegal interception of communications and violation of correspondence. From the first press leaks we read that on the one hand the judge appears to have partly opted for acquittal because the case was unfounded and on the other hand has deemed the conduct of the accused to constitute the less serious offence of disclosure of other parties’ correspondence, consequently acquitting the accused, since, in the absence of a formal complaint from the aggrieved parties, the offence would not have been prosecutable.

Thus, partly (at least), basically technical reasons. We do not even have any knowledge of the evidence produced in court and the presentation of electronic evidence in the trial is still ground to be fully explored. Of course a general consideration does need to be made: the Internet is not the Wild West and all the rules including procedural rules are also valid online. The same rules that apply outside the Web also apply on the Web, with the difficulties that this at times entails (we only need to remember the case of Tiziana Cantone). So, if the judges have decided on acquittal we can be in no doubt that there is appropriate legal reasoning. But certainly, unauthorised distribution of photographs or a violation of correspondence, which have been satisfactorily proven during the proceedings, are illegal both on and outside the Internet.



  • Recent comments

  • Popular posts

    • None found