Photo of Davinia Brennan

The European Commission recently published its new draft Standard Contractual Clauses (SCCs) for international transfers of personal data to third parties located outside of the EEA.

The new SCCs have been expected for some time in light of the coming into force of the GDPR. The existing set of SCCs were implemented under the former Data Protection Directive 95/46/EC and still referenced that regime. The delay was due to the European Commission reconciling the new SCCs with the decision of the European Court of Justice in Schrems II.

Whilst the new SCCs align with the GDPR, address the Schrems II decision, and directly incorporate some of the European Data Protection Board (EDPB) Recommendations on Supplementary Measures (01/2020), they are not a catch-all solution for international data transfers. Parties will still be required to undertake a risk assessment, and adopt supplementary measures (where necessary), to ensure the effectiveness of the new SCCs in the third country concerned.  Where the new SCCs and supplementary measures do not provide an adequate level of protection in the third country, then companies will be obliged to suspend and/or terminate the transfer.

Continue Reading European Commission publishes draft new SCCs

Photo of Davinia Brennan

The European Commission recently published draft Article 28 Standard Contractual Clauses for use between controllers and processors located within the European Union.  The draft Article 28 Clauses are distinct from, and  should not be confused with, the European Commission’s new draft Standard Contractual Clauses (SCCs) for data transfers out of the EEA.  The latter SCCs contain their own set of Article 28 clauses.

Continue Reading European Commission publishes new draft Article 28 Standard Contractual Clauses

As we continue to adjust to new restrictions introduced by the government as a result of the pandemic, the world of trade marks has been business as usual.  In this blog, we discuss a recent decision relating to a high profile trade mark proprietor, Lionel Messi, who is widely regarded as one of the best footballers in the world.

The Court of Justice of the European Union (CJEU) recently dismissed appeals brought by the EUIPO and a Spanish company against the judgment of the General Court authorising Lionel Messi to register the trade mark ‘MESSi’ for sports equipment and clothing. The CJEU held that there is no likelihood of confusion between the word mark MASSI and a figurative sign containing the word MESSi.

Continue Reading No likelihood of confusion between MASSI and MESSi

Photo of Davinia Brennan

The Government has published its legislation programme for Autumn 2020. The programme includes: 30 priority Bills; 50 Bills that are expected to undergo pre-legislative scrutiny; 87 Bills where preparatory work is underway, and 14 Bills which are currently before the Oireachtas.

Key Bills of relevance to the data protection, commercial and technology sector include:

Priority Legislation 

  • Withdrawal of the United Kingdom from the European Union (Consequential Provisions) Bill – This Bill will provide for the legislative needs that will arise at the end of the Brexit transition period.

Bills expected to undergo pre-legislative scrutiny  

  • Online Safety and Media Regulation Bill – This Bill will provide for the establishment of a Media Commission (including an Online Safety Commissioner), the dissolution of the Broadcasting Authority of Ireland, a regulatory framework to tackle harmful online content, and implementation of the revised Audiovisual Media Services (AVMS) Directive 2018/1808. The general scheme of the Bill was published in January 2020, and the  legislative programme indicates that further heads are in preparation. Member States are expected to implement the AVMS Directive in national law by 19 September 2020, so Ireland will miss this deadline.
  • Consumer Rights Bill– This Bill will give effect to EU Directive 770/2019 on consumer contracts for the supply of digital content and digital services, EU Directive 771/2019 on consumer contracts for the sale of goods, and to update and consolidate the statutory provisions on consumer rights and remedies in relation to contracts for the supply of non-digital services, unfair contract terms, and information and cancellation rights.

Continue Reading Government publishes Legislation Programme for Autumn 2020

Photo of Davinia Brennan

On 7 September 2020, the European Data Protection Board (EDPB) issued draft guidelines on the concepts of controller and processor. The concepts play a crucial role in the application of the GDPR, as they determine who will be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice.

The concepts have not changed compared to the Data Protection Directive 95/46/EC (now repealed) and the general criteria for how to attribute the different roles remain the same. However, the EDPB acknowledges the necessity of providing clarification on these concepts under the GDPR.  Since the entry into force of the GDPR, many questions have arisen in relation to the implications of the concept of joint controllership (under Article 26 GDPR), and the specific obligations for processors (under Article 28 GDPR). The guidelines replace the previous Opinion of the Article 29 Working Party on the concepts of controller and processor (Opinion 1/2010).

In part I, the guidelines discuss the definitions of the concepts of controller, joint controllers, processor, and third party/recipient. Part II considers the consequences that are attached to the different roles. The guidelines also contain helpful examples of the circumstances when an entity is a controller, joint controller or processor.

Continue Reading EDPB publishes draft guidelines on the concepts of controller and processor

The Court of Justice of the European Union (CJEU) has made an important ruling for brand owners, online marketplaces and retailers alike, in finding that Amazon is not liable for unwittingly stocking trade mark infringing goods on behalf of third party sellers.

Continue Reading E-commerce operators not liable for trade mark infringement for mere storage of infringing goods

Photo of Davinia Brennan

The Irish Court of Appeal has held that while the definition of “personal data” is very broad, to interpret a document as constituting personal data for the sole reason that it was generated as a result of a complaint made by the data subject, would be to “overstretch” the concept of personal data.  In a related judgment, the Court found that the data subject was entitled only to a “copy of his personal data, and not the data in its “original form.

Continue Reading Court of Appeal warns against “overstretching” the concept of personal data

Photo of Davinia Brennan

On the 23 July 2020, the European Data Protection Board (EDPB) adopted FAQs on the Schrems II judgment. The FAQs provide answers to questions received by EU data protection authorities (DPAs) and will be developed and complemented by the EDPB in due course.

In brief, the EDPB clarifies:

  • No grace period – The Court of Justice of the European Union (CJEU) has invalidated the Privacy Shield with immediate effect. The judgment does not provide any grace period during which companies can keep transferring personal data to the US without assessing the legal basis for the transfer.
  • Use of SCCs for EEA-US transfers – US law (i.e. Section 702 FISA and EO 12333) does not ensure an essentially equivalent level of protection. Whether or not you can transfer personal data to the US based on the Standard Contractual Clauses (SCCs) will depend on the result of your adequacy assessment, taking into account the circumstances of the transfers, and supplementary measures you could put in place. The supplementary measures, along with SCCs, would have to ensure that US law does not impinge on the adequate level of protection they guarantee.

Continue Reading EDPB publish FAQs on Schrems II

Photo of John Cahir

The Court of Justice of the European Union has delivered its eagerly awaited decision, in Schrems II (Case C-311/18).

Why is the case important?

Schrems II calls into the question the ability of companies to lawfully transfer data from the EU to the United States (US) and other countries.

The GDPR contains strict rules on transferring data from the EU to third countries, and this case deals with the compatibility of these rules with surveillance laws in other countries.

What has the Court decided?

The headline outcome is that:

  • The Privacy Shield decision is invalid with immediate effect – this means that companies can no longer rely on a Privacy Shield certification when transferring personal data to the US.
  • Standard contractual clauses (SCCs) are valid – but their use is subject to certain pre-conditions and ongoing obligations.

Continue Reading Schrems II – The Verdict

In a recent case, the Court of Justice of the European Union (CJEU) considered whether a functional shape is precluded from copyright protection. The case was referred from the Commercial Court of Liège (Belgium) (C-833/18).

Background

The original case before the Commercial Court of Liège concerned a claim for copyright infringement brought by an English company, Brompton Bicycle Ltd (Brompton). Since 1987, Brompton has marketed and sold folding bicycles. The Brompton Bicycle, which was protected by a patent until 1999, has the distinct feature of having three different positions: (i) a folded position; (ii) an unfolded position; and (iii) a stand-by position enabling it to stay balanced on the ground.

When a South Korean company, Get2Get, started marketing a bicycle that could also be folded into the same three positions as the Brompton Bicycle, Brompton brought a claim for copyright infringement. In its defence, Get2Get claimed that the shape of the Brompton Bicycle could not be protected by copyright law because its appearance is dictated by the technical solution sought, which is to ensure that the bicycle can be folded into three different positions.

Continue Reading Is a functional shape precluded from copyright protection?