Photo of Davinia Brennan

At its plenary meeting this month, the WP29 adopted the final version of its Data Protection Impact Assessment (DPIA) guidelines.

It also adopted draft guidelines on data breach notification and profiling, and administrative fines, which will be open for public consultation for 6 weeks before their final adoption. The guidelines are expected to be published shortly on the European Commission’s WP29 webpage.

Each WP29 subgroup provided a state of play of its work on the WP29’s priorities on the GDPR, including guidelines on consent, transparency, and update of data transfer tools which are to be adopted between November 2017 and February 2018.

On certification, the discussions are continuing and the guidelines should be proposed for adoption at the February 2018 WP29 plenary.

The WP29 also worked on the organization and structure of the EDPB and of the cooperation system to be ready for May 2018.

The Government has published its legislation programme for Autumn 2017.  The programme lists priority legislation, legislation due to undergo pre-legislative scrutiny, and all other legislation it is working on. Listed below are the data protection, cyber-security and IP-related Bills coming down the track.

Priority legislation

  • Data Protection Bill – This Bill will give effect to and provide for derogations from the GDPR, and transpose the Law Enforcement Directive (2016/680). The Heads of Bill were published in May 2017, and pre-legislative scrutiny was completed on July 2017.  The legislation programme lists the Bill as “priority legislation for publication” this Autumn, but there is no indication as to when exactly the Bill is expected to be finalised and start its passage through the Oireachtas. See our blog post on the Heads of Bill here.

Continue Reading Data Protection, Cyber-Security & IP legislation coming down the track

The UK Information Commissioner’s Office (ICO) is consulting on draft GDPR guidance on contracts and liabilities between controllers and processors. The guidance seeks to help organisations understand what must be included in contracts under the GDPR, and the new responsibilities and liabilities of processors.

Continue Reading ICO opens consultation on draft guidance on controller/processor contracts and liabilities

The Data Protection Commissioner (DPC) has called for submissions on issues of Transparency and International Data Transfers under the GDPR. The submissions received by the DPC from its consultation will be shared with the Article 29 Working Party (WP29), at its third Fablab in Brussels on 18 October 2017 to inform the preparation of new guidelines on transparency under the GDPR and the updating of existing guidelines on international data transfers.

Continue Reading DPC consultation on international transfers & transparency under the GDPR

The EU Council has proposed amendments to the draft ePrivacy Regulation (the Regulation). The Presidency points out that work on the text will be incremental and this is only its first redraft.

Proposed amendments include:

Scope – The Presidency clarifies the precise material and territorial scope of the Regulation, as including:

  • the processing of electronic communications content in transmission, and of electronic communications metadata carried out in connection with the provision of electronic communications services to end-users in the EU;
  • information related to, processed by, or stored in the terminal equipment of end users located in the EU;
  • the placing on the market of software permitting electronic communications, including the retrieval and presentation of information on the internet;
  • the offering of a publicly available directory of end-users of electronic communications services located in the EU, and
  • the sending or presenting of direct marketing communications to end users located in the EU.

Continue Reading EU Council proposes revisions to the draft ePrivacy Regulation

The U.S. Federal Trade Commission (FTC) announced on 8 September that three U.S. companies have agreed to settle FTC charges that they misled consumers, by falsely claiming they were certified to participate in the Privacy Shield. In separate complaints, the FTC alleges, all three companies failed to complete the certification process for the Shield.  As part of their settlements with the FTC, the three companies are prohibited from misrepresenting the extent to which they participate in any privacy or data security program sponsored by the government or any self-regulatory or standard-setting organization, and must comply with FTC reporting requirements. The actions against the three companies are the first cases the FTC has brought to enforce the Shield, which was adopted last July 2016.

Continue Reading Three U.S. companies charged for falsely claiming compliance with Privacy Shield

Employee monitoring versus privacy rights is back in the spotlight due to today’s decision by the Grand Chamber of the European Court of Human Rights (ECHR) in Bărbulescu v. Romania.  The Grand Chamber held there had been a violation of Article 8 of the European Convention on Human Rights, where an employer monitored and accessed personal emails sent by an employee during work hours from his Yahoo Messenger account, using a company computer, without notifying the employee in advance of such monitoring.

Continue Reading ECHR rules employees must receive prior notice of email monitoring

Stakeholders have written a joint letter to Article 29 Working Party (WP29) expressing their concerns about the GDPR consultation process. ​ They believe that the GDPR consultation processes which have taken place so far with 30-day deadlines to respond were much too short, and that a reasonable consultation period (for example 8 weeks) should be set.

An additional concern is that the WP29 guidelines effectively introduce additional rules. The WP29 guidelines are non-binding, but can still be introduced as compulsory requirements at national level.  The stakeholders therefore point out that whilst it is important that they provide clarity and help facilitate implementation, they should not undermine the GDPR’s provisions.

To date, the WP29 have issued guidelines on data portability, data protection officers and lead supervisory authorities, as well as draft guidelines on data protection impact assessments.  Further guidance is being prepared by the WP29 on:

  • Administrative fines
  • Certification
  • Consent
  • Profiling
  • Notification of personal data breaches
  • Transparency
  • Tools for international transfers

 

Joint letter to express concerns about the stakeholder consultation for Article 29 Working Party data protection guidelines

In Aldi Stores (Ireland) Limited and Aldi GMBH & Co. KG v Dunnes Stores [2017] IECA 116, Dunnes Stores (Dunnes) succeeded in its  appeal against a High Court ruling that its 2013 comparative advertising campaign against Aldi was contrary to EC (Misleading and Comparative Advertising) Regulations, 2007 (the 2007 Regulations) and the Consumer Protection Act, 2007 (the 2007 Act).

In essence, the Court of Appeal determined that the High Court applied the wrong test.  It did not make a decision as to whether the 2013 campaign was lawful, but criticised a number of adverse findings made by the High Court.

Continue Reading Comparative Advertising in the Court of Appeal

The Article 29 Working Party (WP29) (consisting of data protection regulators from the 28 Member States) has adopted an Opinion 01/2017 on the proposed e-Privacy Regulation, which will repeal and replace the e-Privacy Directive. Whilst the WP29 welcomes the proposal, it identifies several points of concern, and sets out how the proposal can be improved.

Continue Reading WP29 gives lukewarm welcome to proposed e-Privacy Regulation