EU General Data Protection Regulation

• Guidelines 01/2021 on examples regarding personal data breach notification
• Guidelines 9/2022 on personal data breach notification under GDPR

• Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) of the GDPR in the context of the provision of online services to data subjects
• Guidelines 3/2019 on processing of personal data through video device
• Guidelines 02/2021 on virtual voice assistants

• Guidelines 02/2022 on the application of Article 60 GDPR
• Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority
• Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

• Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
• Guidelines 04/2021 on codes of conduct as tools for transfers
• Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
• Guidelines 07/2022 on certification as a tool for transfers

• Guidelines 8/2020 on the targeting of social media users
• Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them

The French Data Protection Authority (CNIL) fined Amazon France Logistique (Amazon), which manages the Amazon group’s large warehouses in France, €32 million for breaches of the GDPR relating to employee monitoring using scanners and video surveillance processing.

The CNIL found that in giving scanners to its employees to document the performance of the tasks assigned to them in real time, Amazon has (i) failed to comply with the data minimisation principle (in contravention of Article 5(1)(c)); (ii) failed to ensure lawful processing in using indicators which are excessively intrusive illegal, including indicators which make it possible to constantly monitor any time an employee’s scanner is interrupted, potentially requiring employees to justify every break or interruption (in contravention of Article 6); and (iii) failed to ensure that the privacy policy of Amazon had been given to temporary workers before their personal data was collected using the scanners or processed (in contravention of Articles 12 and 13).  

Further, CNIL found that in using video surveillance processing, Amazon has (i) failed to properly inform employees and external visitors of the video surveillance systems by providing information on notice boards or in other media or documents (in contravention of Articles 12 and 13), and (ii) failed to comply with the obligation to ensure security of personal data in using weak access password and sharing access account among several users (in contravention of Article 32).

For further details, please refer to the press release and the decision issued by the CNIL dated 23 January 2024.

The Dutch Data Protection Authority (AP), in cooperation with the French Data Protection Authority (CNIL), issued a €10 million fine on Uber Technologies, Inc. and Uber B.V. (Uber) for breaches of the GDPR by (i) failing to provide the data requested under the right of access in a clear manner and an accessible format and only providing such information in English (in contravention of Article 12(1)); (ii) not making the online form for exercising rights within the application used by drivers sufficiently accessible, as the form was located deep within the app and spread across various menus, and it could have been placed in a more logical location (in contravention of Article 12(2)); (iii) providing incomplete information in their privacy statement about data transfers outside the European Union and the specific security measures regarding the data transfers (in contravention of Articles 13(1)(f) and 15(2)), as well as overly general information about data retention periods (in contravention of Articles 13(2)(a), 15(1)(a) and 15(1)(d)); and (iv) failing to explicitly mention the right to data portability in their privacy statement (in contravention of Article 13(2)(b)).

In determining the amount of the fine, AP considered the size of the organisation and the severity and gravity of the infringements. At the time of the infringements, about 120,000 drivers were working for Uber in Europe.

For further details, please refer to the press release issued by the AP and the press release issued by the CNIL, both dated 31 January 2024.

Court of Justice of the European Union clarifies conditions for awarding ‘non-material damage’

On 14 December 2023, the Court of Justice of the European Union (CJEU) ruled that the misuse of personal data following a cyberattack constitutes “non-material damage” under the GDPR. The case stemmed from a 2019 cyberattack of the Bulgarian National Revenue Agency, after which cybercriminals published personal data concerning millions of persons. The Bulgarian Supreme Administrative Court requested the CJEU to determine the conditions for awarding non-material damages, and the extent to which the data controller needed to demonstrate adequate security measures were in place.

In the judgment, the CJEU answered the referred questions as follows:

• In the event of unauthorised disclosure of or unauthorised access to personal data, courts must assess the appropriateness of the protective measures implemented in a concrete manner, and cannot infer from the unauthorised disclosure or unauthorised access alone that the protective measures implemented by the data controller were not appropriate.
• It is for the data controller to prove that the protective measures implemented were appropriate.
• In the event that the unauthorised disclosure of personal data or unauthorised access to those data is committed by a ‘third party’ (such as cybercriminals), unless the data controller can prove that it is in no way responsible for the damage suffered by the data subjects, the data controller may be required to compensate the data subjects concerned.
• The fear experienced by a data subject concerning a possible misuse of his personal data by third parties as a result of an infringement of the GDPR is, in itself, capable of constituting ‘non-material damage’.

For further details of the judgment, please refer to (1) CJEU’s Judgement and (2) Press Release issued by the CJEU dated 14 December 2023.

Court of Justice of the European Union rules on the lawfulness of credit scoring

On 7 December 2023, the Court of Justice of the European Union (CJEU) handed down two rulings to oppose two data processing practices by credit information agencies. The rulings against German credit information agency concerned its practice of automated establishment of a probability score regarding an individual’s ability to meet payment commitments in the future based on the personal data of that individual and its retention of customer insolvency data.

The CJEU was asked by the German Administrative Court of Wiesbaden to clarify whether credit scoring, a mathematical statistical method used to predict the probability of future behaviour such as the repayment of a loan, constituted “automated decision making” under Article 22 of the GDPR, and whether SCHUFA’s retention period of 3 years for information relating to the granting of a discharge from remaining debts was lawful.

The CJEU held that credit scoring must be regarded as an ‘automated individual decision’, which was prohibited in principle under Article 22, in so far as third parties (including SCHUFA’s clients, such as banks) attribute to it a determining role in the granting of credit. It was for the Administrative Court of Wiesbaden to assess whether the German Federal Law on data protection contains any valid exceptions to that prohibition in accordance with the GDPR, and if it does, whether the general conditions for data processing under the GDPR had been met.

As regards the retention of information on debt discharge, the CJEU considered that it was contrary to the GDPR for private agencies to keep such data for longer than the 6-month period mandated by German law for the public insolvency register. Since the retention of data beyond six months was held unlawful, the data subject has the right to have the data deleted and the agency is obliged to delete the data as soon as possible. Even where the storage for six months is lawful, the data subject will still have the right to object to the processing of his data and the right to have the data erased, unless the existence of overriding legitimate grounds can be demonstrated.

For further details of the judgment, please refer to (1) CJEU’s Judgments of Case C-634/21 and Joined Cases C‑26/22 and C‑64/22 and (2) Press Release issued by the CJEU adated 7 December 2023.

Court of Justice of the European Union rules on the imposition and calculation of administrative fines

On 5 December 2023, the Court of Justice of the European Union (CJEU) reaffirmed the conditions under which supervisory authorities could issue fines to data controllers under the GDPR and ruled that a data controller should not receive a fine unless the violation of the GDPR was committed “intentionally or negligently”. The decision stemmed from cases originating from Lithuania and Germany, which respectively dealt with the Lithuania National Public Health Centre processing citizens’ data for its COVID-19 monitoring app and a German real estate company retaining personal data to tenants for longer than necessary.

The CJEU was asked by a Lithuanian court and a German court to interpret the GDPR regarding the imposition and calculation of administrative fine on controller for infringements under Article 83.

Regarding the imposition of an administrative fine under Article 83, the CJEU ruled that a supervisory authority may not impose a fine on a data controller for an infringement of the GDPR unless that infringement was committed wrongfully, i.e. intentionally or negligently. A data controller may be fined for conduct falling within the scope of the GDPR where that data controller could not have been unaware of the infringing nature of its conduct, regardless of whether or not it was aware of the infringement.

In addition, the CJEU held that, where the data controller is a legal person, it is not necessary for the infringement to have been committed by its management body, or for that body to have knowledge of such infringement. On the contrary, a legal person is liable both for infringements committed by its representatives, directors or managers, and for those committed by any other person acting in the course of the business of that legal person and on its behalf. Further, the imposition of fines is not premised upon a finding of an infringement being committed by an identified natural person. A data controller may also be fined for operations performed by a data processor to the extent that the data controller may be held responsible for such operations.

As regards the calculation of an administrative fine under Article 83, the CJEU ruled that where the addressee of a fine is, or forms part of, an undertaking, a supervisory authority must take as its basis the concept of an “undertaking” under EU competition law, which defines an economic unit even if in law that economic unit consists of several persons, natural or legal. Accordingly, for the calculation of a fine, a supervisory authority must take into account the total worldwide turnover of the undertaking concerned, taken as a whole, in the preceding business year, as the basis for penalties.

For further details of the judgment, please refer to (1) CJEU’s Judgments of Case C-683/21 and Case C-807/21 and (2) Press Release issued by the CJEU dated 5 December 2023.

The European Commission Retains all its Existing Adequacy Decisions

On 15 January 2024, the European Commission concluded its review and evaluation of its 11 existing adequacy decisions under the 1995 Data Protection Directive and the GDPR.

In its published report, the European Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay, continues to benefit from adequate data protection safeguards. As such, the adequacy decisions adopted for these 11 countries and territories would remain in place and data can continue to flow freely to these jurisdictions.

The review has demonstrated that the data protection frameworks in these countries and territories have further converged with the EU’s framework and strengthened protection of personal data in their jurisdictions. The review also showed that public authorities in the 11 jurisdictions are subject to appropriate safeguards in the area of access to data by public authorities, notably for law enforcement or national security purposes.

For further details of the review, please refer to the European Commission’s full report dated 15 January 2024.

• limiting access to EU data subject's personal data by US intelligence services to what is necessary and proportionate to protect national security (under the US's Executive Order on ‘Enhancing Safeguards for United States Signals Intelligence Activities');
• providing EU data subjects whose data would be transferred to the US under the DPF with several new rights (i.e., to access their data, or to correct or delete inaccurate or unlawfully handled data); and
• establishing a two-tier redress mechanism for EU data subjects (i.e., EU data subjects' complaints would first be investigated by the Civil Liberties Protection Officer (CLPO) of the US intelligence community, and the data subjects may appeal the CLPO's decision before the independent and newly established Data Protection Review Court).

• Contracts concluded on or before 21 September 2022 on the basis of the Old SCCs shall continue to provide appropriate safeguards for the purpose of the UK GDPR (provided that the processing operations that are the subject matter of the contract remain unchanged) until 21 March 2024.
• From 22 September 2022, either the IDTA or the Addendum will have to be incorporated for new contracts concerning international transfers of personal data under the UK GDPR.
• From 22 March 2024, the old SCCs will no longer be deemed to provide “appropriate safeguards” for the purpose of the UK GDPR. All contracts that have incorporated the old SCCs will have to be substituted by either the IDTA or the Addendum by 21 March 2024.