Kris Somers

Dutch DPA tackles algorithmic discrimination The scandal of 2023 highlighted a serious issue of algorithmic discrimination within government organizations in the Netherlands. In response to these challenges, the Data Protection Authority (AP) became the coordinating supervisor for algorithms and artificial intelligence starting January 2023. AP's collaboration with the European Data Protection Board (EDPB) is crucial for effective oversight, especially concerning major tech companies like TikTok. However, issues arise due to the hiring of private investigative firms to address confidentiality matters, leading to duplication and inefficiency. Increasing AP's budget is recommended to enhance oversight and protect personal data rights more effectively. This will enable a more robust fight against algorithmic discrimination and underscores the importance of regulatory bodies like AP in safeguarding citizens' rights in the digital age. Fighting algorithmic discrimination is key to protecting our rights in the digital world! Source: https://lnkd.in/exGAVZPE #algorythm #Holland #discrimination #EDRB #digitalspace #avitar #data_protection

9

Privacy expert Kenneth Sleijpen and Product Manager Herlinde Aerts bring you a comprehensive guide packed with practical tips for efficient and high-quality DPIAs. Discover: 🔹 6 stumbling blocks and common mistakes 🔹 How to manage expectations 🔹 Tailoring DPIAs to your organization 🔹 9 keys for success 🔹 3 essential tips for immediate success 🔹 Final thoughts Boost your data protection efforts today! 🚀🔍 #eBook #DPIA #DataPrivacy #GDPR #Compliance #DataProtection https://lnkd.in/eYWQMAWV

4

In the latest Employment Law blog, #TeamSPB reflect on an employee request for access to his full personnel file 5 years after leaving the school he worked at. This case highlights the Belgian Data Protection Authority's reminder to employers of the reach of the GDPR principle of right of access by the data subject. Read the full blog here ➡️ https://ow.ly/73s050RSkxW #BelgianDPA | #EmployeeRights | #EmployeeData

2

The EDPB adopted an opinion on the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. According to the EDPB, online platforms should give users a real choice when employing ‘consent or pay’ models. Controllers should take care at all times to avoid transforming the fundamental right to data protection into a feature that individuals have to pay to enjoy. https://lnkd.in/dJWBVDAX #gdpr #edpb #dataprotection #payorokay #consentorpay

3

A DPA review in 5 minutes? 🤔 Data privacy lawyers often spend hours pouring over agreements such as DPAs. With SpringLaw Wizards, now you can create a DPA reviewer using #naturallanguage and your firm’s best practices, meaning your next DPA review will take just 5 minutes 🔎 𝐁𝐮𝐭 𝐡𝐞𝐫𝐞’𝐬 𝐭𝐡𝐞 𝐫𝐞𝐚𝐥 𝐠𝐚𝐦𝐞 𝐜𝐡𝐚𝐧𝐠𝐞𝐫: 𝐲𝐨𝐮 𝐜𝐚𝐧 𝐭𝐮𝐫𝐧 𝐭𝐡𝐢𝐬 𝐢𝐧𝐭𝐨 𝐚 𝐜𝐥𝐢𝐞𝐧𝐭 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧 🤯 Say you have ten clients, each with differing needs. Once you’ve built your initial DPA review assistant, you can clone it, configure them and make each one hyper-specific to each client ✅ 𝐀𝐧𝐝 𝐣𝐮𝐬𝐭 𝐥𝐢𝐤𝐞 𝐭𝐡𝐚𝐭: 𝐲𝐨𝐮’𝐯𝐞 𝐜𝐫𝐞𝐚𝐭𝐞𝐝 𝟏𝟎 𝐜𝐥𝐢𝐞𝐧𝐭-𝐬𝐩𝐞𝐜𝐢𝐟𝐢𝐜 𝐫𝐞𝐯𝐢𝐞𝐰 𝐭𝐨𝐨𝐥𝐬💥 Watch Ed build, clone and customise the DPA Review assistant below ⬇️ Did you know that you can create ANY specialised Agreement Reviewer with SpringLaw Wizards? 🧙 We’ll be sharing regular examples over the coming weeks, follow along to see more! 👉 Join our waitlist today and get your first Agreement Reviewer implemented for free: www.springbok.ai - 👋 𝐒𝐩𝐫𝐢𝐧𝐠𝐋𝐚𝐰 𝐞𝐧𝐚𝐛𝐥𝐞𝐬 𝐲𝐨𝐮𝐫 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐞𝐬 𝐭𝐨 𝐭𝐫𝐚𝐧𝐬𝐟𝐨𝐫𝐦 𝐲𝐨𝐮𝐫 𝐤𝐧𝐨𝐰𝐥𝐞𝐝𝐠𝐞 𝐢𝐧𝐭𝐨 𝐩𝐨𝐰𝐞𝐫𝐟𝐮𝐥 𝐭𝐨𝐨𝐥𝐬 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲𝐝𝐚𝐲 𝐰𝐨𝐫𝐤𝐟𝐥𝐨𝐰𝐬 𝐚𝐧𝐝 𝐜𝐥𝐢𝐞𝐧𝐭-𝐟𝐨𝐜𝐮𝐬𝐞𝐝 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 – 𝐰𝐢𝐭𝐡𝐨𝐮𝐭 𝐧𝐞𝐞𝐝𝐢𝐧𝐠 𝐭𝐨 𝐜𝐨𝐝𝐞. #LegalTech #ContractReview #MakeGenAIWorkForYou

16

8 Comments

The Belgian Competition Authority has applied the Towercast case law in a first case in Belgium. It could possibly try do so again for certain hospital mergers that the legislator has recently exempted from merger filing in Belgium. Read more in the article by Peter Wytinck and Elisabeth Gabizon: https://stibbe.law/3VXlZJT

17

Our critical take on the Dutch DPA’s strict views and guidelines on data scraping. It is questionable whether these guidelines will persevere if challenged in court, given that the EC and Dutch Council of State already rejected the Dutch DPA's interpretation that data processing for purely commercial interests can never be based on a company’s legitimate interest. #datascraping #GDPR #AI #GenAI https://lnkd.in/g7b4KU58

21

2 Comments

𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲: 𝐩𝐮𝐛𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐭𝐡𝐞 𝐭𝐡𝐞 𝐁𝐞𝐥𝐠𝐢𝐚𝐧 𝐍𝐈𝐒 𝟐 𝐀𝐜𝐭 Today, the Belgian NIS 2 Act has been published in the Belgian Official Gazette with an entry into force on the 18th of October 2024. This act transposes the EU Directive 2022/2555 on measures for a high common level of cybersecurity (i.e., the NIS 2 Directive), and replaces the Belgian NIS 1 Act. It is of significant importance for employers to be aware that the NIS 2 Act has a much broader scope than its predecessor. For example, it expands the sectors covered by the act. In addition, it also imposes the obligation to implement certain minimum cybersecurity risk management measures. Members of the governing bodies in so-called ‘essential and important’ entities will be obligated to undergo cybersecurity training so that they may understand the measures they are adopting. Furthermore, the act requires the reporting of incidents to the competent national authority. In Belgium, this is the Centre for Cybersecurity Belgium. Failure to comply may result in administrative fines of up to 10,000,000 EUR or 2% of the total annual worldwide revenue, whichever is higher. In addition, natural persons representing essential entities may be held liable for failure to comply. At Claeys & Engels, we monitor these developments closely and are happy to assist you in preparing to meet the obligations set out in the NIS 2 Act. #claeysengels #cybersecurity #NIS2Act

14

The law establishing a framework for the cybersecurity of network and information systems of general importance for public safety (the NIS 2 Act) was published in the Belgian State Gazette on 17 May 2024. The NIS 2 Act requires certain essential and important entities to take appropriate measures to enhance their cybersecurity and provides for reporting obligations, strict penalties, and director liability.   👉 Find out more in this article written by Matthias Vandamme from our Silver Partner, Claeys & Engels: https://lnkd.in/e-JRdd3b

8

In this #privacyespresso episode, Stephan Mulders, lawyer at Van Diepen Van der Kroef Advocaten, PrivacyRules Law firm member from the Netherlands, shares with us invaluable insights on the new #guidelines on #DataScraping for private individuals and organizations recently published by the Dutch #dataprotection authority (#AP). What is Data Scraping? Data scraping involves the automated collection and recording of information from web pages, useful for: ·   Training algorithms ·   Collecting customer questions and complaints via online channels ·   Monitoring online messages for reputation management, sales, or marketing The guidelines clarify the distinction between data scraping and search engines, noting their application to both #data scraping and #webcrawling. When scraping personal data, organizations must comply with the #GDPR, requiring a legal basis under Article 6. Exceptions to GDPR scope include scraping for algorithm training by controllers established outside the EU, not offering goods or services within the #EU. Despite these exceptions, data scraping usually involves personal data, necessitating adherence to GDPR principles of data processing. Stephan highlights that processing sensitive #personaldata must align with GDPR requirements, needing explicit consent or another valid exception for such processing. Listen to this podcast episode to gain more valuable insights from Stephan Mulders on these new guidelines! 👉 bit.ly/3QMkuwt

8

Is France CNIL - Commission Nationale de l'Informatique et des Libertés style enforcement coming to a #CCPA violation near you? The California Privacy Protection Agency (CPPA) and the CNIL signed a declaration of cooperation allowing both authorities to collaborate on their efforts to safeguard personal information and advance privacy. The declaration establishes a general framework of cooperation to facilitate joint internal research and education related to new technologies and data protection issues, share best practices, and convene periodic meetings. Our Enforcement Division welcomes opportunities to learn from our international partners and share our US perspective, and we’re going to learn as much as we can from each other to advance our enforcement priorities.” - says Michael Macko, Deputy Director of Enforcement at the CPPA https://lnkd.in/eb-CnNS8 #dataprivacy #dataprotection #privacyFOMO

111

4 Comments

A few weeks ago, the Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive) was transposed into Belgian legislation. The Belgian NIS2 law will enter into force on 18 October 2024. If you need guidance on whether your organization falls under the scope of this law or on specific obligations applicable to your organisation, feel free to contact us. #NIS2 #cybersecurity #Belgianlaw

20

The 🇪🇺 Digital Service Act #DSA at work💪: 🔶 Last week a ‘DSA’ case was won in Amsterdam 🇳🇱 against X/twitter. It was concluded that X/twitter violated both (parts of) article 17 and article 12 of the DSA. ➡ The plaintiff shared a news article after which his account was unjustly shadow-banned. He found out only because others were telling him they could not find his account anymore. He tried to contact X/Twitter but was left in the blind on what happened and why. 🔸 Art 17: In violation with art 17 X/twitter has not communicated clearly about it and has not motivated it  🔸 Art 12: In violation with art 12, X/twitter has not offered a ‘contactpoint’ in a suitable enough way. The X/twitter defence that it is ‘impossible for them to comply (art 17)or that they are too big to comply (art 12) were not granted. Also X/twitter can not refer to their terms and conditions in this case, as the terms and conditions are deemed unfair if they authorize the trader to unilaterally change the characteristics of the product to be delivered or the service to be provided without valid reason. 🧡 Good news for EU citizens, as it means improved transparency.  ✴️ However as plaintiff points out in a LI post he’d appreciate a more proactive approach of the regulators as it is not a given everyone (else wo is shadow banned) has the time and 'is crazy enough' to go the legal way over these violations (link to Danny Mekić's post in comments) 👏 🙏 . NB: I tried to get the gist, but I’m not a legal person;  📙 For a comprehensive take please read the full ruling:  https://lnkd.in/e5aicmap #DataSovereignty #DigitalSustainability #ShadowBanning #EU

5

2 Comments

📢 DMA Enforcement: Call for Abstracts📢  Since the Digital Markets Act entered into force, questions around how to enforce the #DMA are joined by new ones, namely: is it working? How can compliance with the rules be assessed? What are the main procedural challenges?    ARTICLE 19, alongside the Amsterdam Centre for European Law and Governance, the Hertie School Centre for Digital Governance, and the Università di Trento, is proud to launch the second iteration of our call for abstracts on DMA enforcement. The call seeks to gather research that could help regulators in this crucial enforcement phase, as well as research that provides a better understanding of the legal, economic, and technical challenges and opportunities linked to current compliance moves.     Submit your abstract by 30 July. Selected researchers will be invited to discuss their findings with members of the European Commission in Brussels during a two-day symposium in November. More details:  https://lnkd.in/eC-BPeeu

59

3 Comments

🔍 Insights on Privacy Protection: New AP Guidelines on Scraping Activities The new guidelines on scraping issued by the Dutch Data Protection Authority (AP) is a significant step in protecting individuals' privacy rights in the digital age. Scraping, the automated collection and storage of information from the internet, has become increasingly prevalent, raising concerns about the unauthorized use of personal data and potential privacy risks.💡 The guidelines provide much-needed clarity on the legal framework surrounding scraping activities conducted by private parties and individuals. By emphasizing that scraping is almost always illegal and can constitute a violation of the GDPR, the AP underscores the importance of respecting individuals' privacy rights and ensuring compliance with data protection laws.🛡️ One key aspect highlighted in the guidelines is the requirement for a legal basis to justify scraping activities. While scraping may be permissible in exceptional cases, such as for domestic use or when conducted with explicit consent, it must adhere to strict conditions outlined in the GDPR. This includes ensuring that scraping is not solely aimed at commercial gain and that appropriate safeguards are in place to protect individuals' personal data. Furthermore, the guidelines debunk the misconception that information freely available on the internet can be scraped without consent. The AP rightly emphasizes that public availability does not equate to consent, and individuals have the right to control how their personal data is collected and used.🔒 Overall, the guidelines on scraping by the AP serve as a valuable resource for organizations and individuals engaging in online data collection activities. By promoting transparency, accountability, and respect for privacy rights, these guidelines contribute to building trust in the digital ecosystem and safeguarding individuals' fundamental right to privacy. https://lnkd.in/dftzncJf

10

FIOD press releases - necessary or just harmful? FIOD press releases often include sensitive information that can lead to public stigmatization of suspects before they have had a chance to respond. I this blog I argue for a more balanced approach that respects the privacy of individuals and avoids potential harm to their personal and professional lives. The FIOD should consider less invasive methods of keeping the public informed about their investigations, ensuring that the justice system retains its integrity while protecting individual rights! #Corruption #FIOD #NoTrialByMedia #Privacy #Vaklunch Hertoghs advocaten

35

1 Comment

EDPB issues opinion casting doubt on legality of pay-or-consent models: The European Data Protection Board issued a nonbinding opinion on the legality of pay-or-consent models in the context of obtaining valid consent to process personal data. The EDPB ruled, "in most cases," large online platforms offering a binary choice between paying to prevent personal data from being processed for behavioral advertising or consenting to targeted advertising does not align with the EU General Data Protection Regulation. IAPP Staff Writer Alex LaCasse reports on the major takeaways from the ruling. Full story #dataprotection #dataprivacy #privacy

2