Data Protection Law Database

in case you miss updates from this account, beware i am now mainly updating the 'History of #dataprotection: An online anthology' here: glgonzalezfuster.blog/history-of-dat…

@PolicyR Kitchin

🇪🇺 🇧🇷 🌎 Join us on Tuesday 21 May for a day of discussions on ‘The Global Impact of EU’s Regulations on Platform, #AI, and #DataGovernance: The Case of Brazil - Empowering digital policies beyond EU borders’! Register for free lsts.research.vub.be/international-… & see you at Tour & Taxis

@gabrielazanfir @RobertJBateman i am really afraid you are extrapolating in a wrong way. but it's Friday evening in Europe so I'll disconnect myself, at the risk of giving you the last word 😁

@DPL_rewind @RobertJBateman Well, that’s nice. But the wording of the judgment is broad enough to cover such scenarios. And as you know, the Court doesn’t decide in a specific case, but it decides on how a legal obligation must be interpreted. So now this interpretation is binding throughout the EU.

What just happened in that Endemol Shine Finland case? 😱 Apparently speaking one's name out loud is now "processing of personal data" covered by the GDPR. Wait What Now? curia.europa.eu/juris/document…

@gabrielazanfir @montezumachavez @RobertJBateman perhaps the key point is that "it could", but it wasn't. and my intuition is that if a case like that would end up in Luxembourg, they will make the boundaries clear. so i would suggest not to panic. i do take the point that an alternative argumentation might have been possible

@DPL_rewind @montezumachavez @RobertJBateman In this case they could at least bother to mention "transmission of information through electronic communications". The way the whole reasoning is drafted can be easily applied to a discussion between 2 people face to face, which is what makes it absurd.

@gabrielazanfir @RobertJBateman is the fact that data protection applies to (some) written words "policing literature"? i trust the CJEU has no intention to silence EU residents, or people reading out loud from other countries

@DPL_rewind @RobertJBateman this reasoning of the Court sets us to a very dangerous path of policing the spoken word through data protection law; breaching confidentiality by disclosing information through voice can very well be sanctioned in relation to the processing operation in the file.

@gabrielazanfir @RobertJBateman the truth is that it would have been interesting to see that argument put forward to the Court. here the Court, consistently with itself, simply takes the route that the prior covid app case had started to trace.

@DPL_rewind @RobertJBateman besides the fact that I doubt any words spoken by a person are spoken in the absence of thoughts, even when a person reads out loud information from a file: the information captured in the file is the processing operation for data protection law purposes, not the reading

@gabrielazanfir @montezumachavez @RobertJBateman you seem to ignore that things like prosecutors calling internet service providers from another country to receive this or that data is something that has been happening (was one of the problems they wished "to solve" with the e-Evidence package). this is not about random chats

@montezumachavez @RobertJBateman @DPL_rewind Luis, I'm looking forward to seeing your register of processing operations under Article 30 gdpr to see if it includes all these oral information transmissions :))

@gabrielazanfir @RobertJBateman in relation to disclosure of data. it is not about "expressing thoughts". this was not an interview, or chatting with someone to hear their voice. disclosure = processing = interference with art7/art8, this is how the CJEU has been reasoning.

@DPL_rewind @RobertJBateman ... in relation to thoughts expressed through words spoken by other individuals? Doubtful. There are many other legal protections for such issues. We don't need to mock data protection to deal with such cases, we need to explore it more re: what is covered by DMAs/DSAs/AIAs et al

@gabrielazanfir @RobertJBateman thank God, data protection is not a religion... anyway, OF COURSE if you go back to the very origins it's all about computers, but data protection has been evolving beyond just computers, for decades now, precisely to provide effective protection to individuals

@RobertJBateman @DPL_rewind And see here what data protection was actually conceived to do, a short explainer. I am perhaps the strongest believer in data protection that I know, that’s why absurd solutions like this bring me to the edge. linkedin.com/posts/dr-gabri… 2/2

@gabrielazanfir all is "flying"... electronic data are also "flying"... i do hope this is not too traumatic indeed 🙃

@DPL_rewind breach of confidentiality of the controller of a filing system or automated process; or it can breach other subjective rights protected by civil codes in a personal liability regime, let's say. The logic that held this all system in my mind is now broken. 2/2

@montezumachavez @gabrielazanfir not really... i'd say the best known and traditional example and problem are public authorities calling companies on the phone asking for data that cannot be given otherwise... imagine if that was not falling under data protection for some reason

@DPL_rewind @gabrielazanfir The best example is: "please prevent gossip in the lift or corridor."

@gabrielazanfir it's quite like the one about the covid app... the point is one can't start separating little actions, saying "this is processing, now this is not processing but a side thing we do"...

@DPL_rewind Still "speaking"/"oral"/"reading" from a filing system where the data is processed. And who is the controller of the "speaking"? Do they need to provide rights of access, erasure to the spoken processed personal data? 🥲

@montezumachavez @gabrielazanfir a good start is to remind people they might be covered by data protection...

@DPL_rewind @gabrielazanfir My big concern is how to control such disclosures.

@l_dallacorte @gabrielazanfir but people we always knew processing is anything you do to data! imagine if destroying data was processing but not reading data...

The second in-person event of the DPSN this year will take place in Leiden! Make sure to get in touch if you will be there and would like to present your work and learn from others in a chilled environment. Check the link below for more information: dataprotectionscholars.network/post/leiden-sy…

@mikarv @grahamgreenleaf much later but in a similar area & underrated this one classic.austlii.edu.au/au/journals/Pr…

Interested in exploring how to use data rights in education for understanding digital infrastructures and their impacts? Join us for a 1-day workshop in BXL, 9feb lsts.research.vub.be/call-for-parti…