The Court of Justice of the European Union has once again spoken about the limits of the right to be forgotten. This time, it answered requests for a preliminary ruling in the case of Google v CNIL (Commission Nationale de l’Informatique et des Libertés, the French public authority responsible for regulating personal data processing). The case concerned a fine of EUR 100,000 which the CNIL imposed on Google after it refused to remove, in the exercise of a data subject’s right to be forgotten, links from all language versions of its search engine.
Recently, the Swedish supervisory authority responsible for compliance with the General Data Protection Regulation imposed a fine of approximatively EUR 20,000 for the use of technology to monitor students’ attendance. Importantly, the processing of personal data in the form of images of students was not carried out on a permanent basis, but was a short-term test to assess the usefulness of such a solution in the schools’ activity.
We wrote several months ago about the imposition of fines by the French data protection authority CNIL (Commission Nationale de l’Informatique et des Libertés) for data protection breaches. Recently CNIL has imposed more fines, including for violation of standards for secure processing of personal data on a website.
The case involved an auto insurance broker. On the broker’s website, users could request a calculation of insurance premiums, conclude an insurance contract, and log on to their account, where various types of personal data were accessible, such as bank statements and information about driving-licence suspensions or convictions for traffic violations.
After a proceeding lasting two years, the Office of Competition and Consumer Protection (UOKiK) issued a decision on 30 May 2019 in the case of the Polish telecom Netia concerning the method of collecting marketing consents, and the wording of the consents, obtained for Netia by its business partners. UOKiK found that a substantial showing was made that Netia’s practice of making telephone calls to consumers who were not Netia subscribers, and had not given prior consent to contacts by telephone, violated the collective interests of consumers.
On 17 June 2019 the president of Poland’s Personal Data Protection Office (UODO) issued the Communication on the List of Personal Data Processing Operations Requiring an Assessment of the Impact of Processing on the Protection of Personal Data. The legal basis for issuance of the communication is Art. 35(4) of the EU’s General Data Protection Regulation, under which each member state’s supervisory authority must establish and publish a list of the kinds of processing operations which are subject to the requirement for a data protection impact assessment. At the same time, the prior list, enclosed with the communication of 17 August 2018, was repealed. The new list reflects the opinion issued by the European Data Protection Board and covers personal data processing activities connected with offering of goods and services to data subjects or monitoring of their behaviour in multiple EU member states.
Ireland’s Data Protection Commissioner has commenced the first proceeding against the US giant Google since the General Data Protection Regulation entered into force. The case involves processing of users’ personal data for delivery of profiled ads.
The case was launched following numerous complaints, primarily from the makers of the Brave web browser, whose main selling point is built-in ad-blocking tools. The allegations against Google Ireland Ltd boil down to the issue of forwarding users’ personal data (particularly involving their online activity), without their knowledge, to an indefinite number of entities for the purpose of delivering profiled advertising materials.