Technology and Brand Law Implementing The New EU Data Protection Regulations

2 Technology and Brand Law It might be a good idea if we implemented the old one.

3 Technology and Brand Law Summary Who is a data subject and what are their rights? Who has obligations to data subjects? What is excluded from scope of data protection? What isn’t? Subject access requests – what are they and what do they cover? The “right to be forgotten” and recent developments Data protection and the State The right to be compensated for breaches of the Data Protection Acts – Recent developments in Ireland, UK and Europe

4 Technology and Brand Law Scope Current exclusions – Activities falling outside scope of EU law (public security, defence, criminal) – Purely personal or household activity GDPR – Broadly similar – Territorial Established in EU Selling to or monitoring of EU data subjects

5 Technology and Brand Law Data Subject

6 Technology and Brand Law Indirectly? The Myth of anonymization Scope narrowed slightly in GDPR

7 Technology and Brand Law Subject access request Duty on controller Without constraint and excessive delay or expense – Confirmation of processing, purposes and categories of data and recipients to whom the data are disclosed – The data undergoing processing and their source – Information on automated processing Rectification erasure or blocking Expanded slightly in GDPR

8 Technology and Brand Law Example Case C-486/12 X SAR to Dutch municipality for details of subject’s previous addresses to contest a traffic fine Municipality requests fee of €12.80 Referred to ECJ Fees may be levied Not excessive and not exceeding the cost of communicating the personal data

9 Technology and Brand Law Example Dublin Bus –v- DPC SAR for video footage of alleged personal injury on a Dublin Bus Refused because of existence of proceedings Distinguished English DPA – discretion where litigation No Irish exemption where litigation in process SAR does not subvert the jurisdiction of the courts

10 Technology and Brand Law Right to be forgotten At the moment it doesn’t exist Google Spain –v- AEPD Case C-131/12 – Automatic processing of publicly available personal data is new act processing – Search engine is controller – Responsibility of controller in respect of erasure rectification and blocking – Economic interests of search engine cannot be used as justification of processing – Public interest of internet users may justify processing in particular circumstances New article 17 in GDPR – four grounds – No longer necessary – Consent withdrawn and no other legal ground – Objects pursuant to article 19 – Other non-compliance with GDPR

11 Technology and Brand Law Data Protection and the State Data protection rules apply to the State However there are limited circumstances where the state can restrict DP rights – 6(1) – DP Principles – 10 – Provision of information PD obtained from the DS – 11(1) – Provision of information PD not obtained from the DS – 12 - SAR – 21 – Publicizing of processing operations – register Necessary to safeguard – National security – Defence – Public security – Prevention of crime – Important economic interest of a MS or EU – Certain regulatory functions – Protection of DS or rights and freedoms of others

12 Technology and Brand Law Bara C-201/14 Data sharing by Romanian public bodies Article 10, 11 and 13 Public body must inform data subject Any restriction must be a legislative measure i.e. protocols etc cannot be used DPC guidance Charter of fundamental rights Article 52 GDPR more or less the same except the legislative measures have to have explicit provisions at least to the objectives

13 Technology and Brand Law Right to be compensated Collins –v- FDB Insurance [2013] IEHC 137 No automatic right or strict liability Must suffer loss Traditional tort principles applied CR19 –v- Chief Constable of the PSNI [2014] NICA 54 Nominal damages for distress but substantive damages for actual loss Vidal Hall –v- Google [2015] EWCA Civ 311 (now before UKSC) S13(2) of DPA 1988 Is there a tort of misuse of private information? Is UK law compatible with A23 of directive and Articles 7 and 8 of CFR

14 Technology and Brand Law GDPR – Explicit liability for processor – Joint and severable liability

(0) l