Lorena Boix Alonso

New this week at INSTAR: 🔐 Your feedback wanted: help shape the European 🇪🇺 Digital Identity Framework through a public consultation launched by the European Commission 🗓️ Save the date on the ETSI/CEN Workshop on EU Digital Identity Framework #standards happening next week on 10-12 September 💫 INSTAR is invited to be at the Multi-Stakeholder Platform (MSP) Meeting next week in Brussels! These are the topics we're going to talk about this week. Curious to learn more? Keep following us on these channels and hit that follow button to always be notified when there's a new update! 

2

EDPB plenary meeting starting today! On the agenda: guidelines clarifying the rules on international data transfers, review of the adequacy decisions and the European data protection seal.

12

My preferred COA would be complete decoupling and closing EU markets to China. But given the degree of integration that is likely impossible. This at least ensures that IP exchange is not just a one way flow. It also may cause China to self decouple in certain areas rather then surrender their IP where it could be used by EU competitors to eventually squeeze China out of the EU markets and even compete internationally with them. In essence to do to China in some small way what China has been doing to western businesses for well over a decade or more.

12

1 Comment

🗣️ DORA is coming! Excellent post by Christopher Götz, LL.M. (New York) explaining the new supervisory requirements introduced by the DORA framework! ✨ More to come on this on Legal4Tech ✨

5

🗞 European Commission Vice President Věra Jourova told POLITICO Europe that the initiative to convert the voluntary Code of Practice on Disinformation into a binding Code of Conduct under the #DSA has officially begun. ✳ Once adopted by the Digital Services Coordinators and approved by the College of Commissioners, #VLOPs will be able to show in their Risk Assessments how they're implementing mitigation measures on different areas, such as demonetisation of disinformation, transparency of political advertising, integrity of services, empowerment of users and researchers, and cooperation during elections ❓ What does this mean for you? Whether you're a VLOP or a small platform, it's crucial to pay attention to codes of conduct. ↘ To learn more about their provisions and implications, check out this resource. https://lnkd.in/dTD94e48 

11

Maha Al-Saadi Great to see the European Commission taking proactive steps to establish a robust framework for the European Digital Identity Wallets. Ensuring interoperability, security, and proper certification will be key to building trust and fostering seamless cross-border digital interactions within the EU. #Regulations #Blockchain #Fintech #BuildWeb3 #Legal

1

The latest proposal by the Belgian Presidency on the #CSARegulation is dangerous:  ❌ Confronting users with a binary choice of either agreeing to having their private chats scanned for child sexual abuse or not allowing them to share and receive images, videos or URLs would de facto lead to the introduction of client-side scanning. This would severely undermine the robust protection that end-to-end encryption provides to people’s privacy and security, while increasing the likelihood of privacy breaches. With this proposal, the Belgian Presidency seems to have once again fallen into the trap of choosing safety over privacy rights, when the ultimate goal should be to balance both in a way that effectively protects children while guaranteeing the right to privacy of all users. This is why CCIA Europe and a coalition of other industry associations have issued an urgent call on Member States to protect both safety and privacy in the Council’s position, and to strongly preserve the integrity of end-to-end encryption and confidentiality of communications. You can read the joint call 👇 #privacy #CCIAeurope #EUvsChildSexualAbuse #CSAR 

21

The EU’s work on data acces for law enforcement risks undermining press freedom. With a broad media coalition and European Digital Rights we warn in an open letter of the #InsecurityByDesign agenda of the High- Level Group “#GoingDark” ⚠️ new EU data access rules ⚠️ risks on journalistic sources and digital security ⚠️ undermining #encryption https://lnkd.in/eEk2fTpQ

1

Court of Justice 9 January 2025, C‑394/23. Important judgement on General Data Protection Regulation and personalised communication. GDPR and rail transport: a customer’s gender identity is not necessary data for the purchase of a transport ticket The collection of data regarding customers’ titles is not objectively indispensable, in particular where its purpose is to personalise commercial communication. 1.      Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, read in conjunction with Article 5(1)(c) of that regulation must be interpreted as meaning that –        the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract; –        the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where: –        those customers were not informed of the legitimate interest pursued when those data were collected; or –        that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or –        in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity. 2.      Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679 must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of that regulation. [

23

⚠ Digital Services Act updates. The European Commission launched today a new investigation into potential risks to safety of minors using Meta's services Facebook and Instagram. The investigation is set to focus on 3️⃣ key areas: 📌 Assessing whether the platforms' designs exploit vulnerabilities of minors, leading to addictive behaviour or intensifying the 'rabbit hole' effect. 📌 Evaluating the effectiveness of mitigation strategies, including age-verification tools. 📌 Examining the adequacy of measures to ensure privacy and security for minors. 💬 Join our community to stay up to date with all the regulatory and enforcements developments: https://lnkd.in/eT7C9vCc #DSA #EuropeanCommission #MinorSafety

17

1 Comment

In response to many complaints from data subjects, the CNIL has issued orders to comply to website publishers to modify their cookie banners, which are considered to be misleading. See https://lnkd.in/d5S6qdsh. 

27

1 Comment

GPAI has released a timely blog on the Digital Services Act and the need for researchers to have access to the experimental protocols/methods employed by very large online platforms. Read more here: https://lnkd.in/gTFny3Ez Susan Leavy UCD School of Information and Communication Studies #UCDDigitalPolicy #DigitalPolicyIE #DigitalServicesAct

3

European Commission and national authorities urge TEMU to respect EU consumer protection laws. https://lnkd.in/eGXkzu58 The Consumer Protection Cooperation (CPC) Network of national consumer authorities and the European Commission notified the online marketplace @Temu of a number of practices on its platform that infringe EU consumer law. And the company now has 1 month to indicate how they will comply with EU consumer law. The CPC Network identified several types of problematic practices on Temu, such as: - Fake discounts, - Pressure selling, - Forced gamification, - Missing and misleading information, - Failing to inform consumers in advance that their order needs to reach a certain minimum value before they can complete their purchase, - Fake reviews, - Hidden contact details.

3

𝗘𝘂𝗿𝗼𝗽𝗲𝗮𝗻 𝗖𝗼𝗺𝗺𝗶𝘀𝘀𝗶𝗼𝗻 𝗮𝗰𝗰𝘂𝘀𝗲𝘀 𝗘𝗹𝗼𝗻 𝗠𝘂𝘀𝗸'𝘀 𝗫 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗼𝗳 𝘃𝗶𝗼𝗹𝗮𝘁𝗶𝗻𝗴 𝗘𝗨 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 𝗔𝗰𝘁 This is reported by the CBS News 🔍 More details here ➡ https://lnkd.in/e7HrPMxa #EURegulations #DigitalServicesAct #SocialMediaRegulations #XPlatform #OnlineSafety #OnlineRisks #SocialMediaCompliance #EUInvestigations #SocialMediaPolicy

1

📡🌍🛰️ #HU24EU As 2024 Body of European Regulators for Electronic Communications (BEREC) vice-chair, Laure de La Raudiere, Arcep chair has presented BEREC and the Authority’s work today during the workshop on sustainability in telecommunications and space, organised by the Hungarian Presidency of the Council of the EU to reducing the environmental footprint of the ICT sector. #Sustainability #spacesustainability #environment #telcos #Europe

38

1 Comment

🚨✨ Dive into the fascinating intersection of AI and policing with the latest report from Europol! Discover how cutting-edge technology is reshaping law enforcement practices, enhancing public safety, and addressing challenges in modern policing. This insightful analysis not only highlights the benefits but also sheds light on the ethical considerations we must navigate. A big shoutout to Europol for this invaluable resource! For more valuable insights like this, be sure to follow us. We regularly share updates on important topics. #AIPolicing #LawEnforcement #Innovation #CyberRescue

9

1 Comment

The European Commission has formally issued a request for information (RFI) to Meta under the Digital Services Act (DSA) to gather details about the measures Meta has implemented to comply with its obligations regarding the protection of minors online. Specifically, the Commission is interested in understanding Meta's risk assessments and mitigation strategies related to the mental and physical health risks that minors may face while using its platforms, such as Facebook and Instagram. The Commission's actions are part of a broader effort to ensure that very large online platforms adhere to stringent regulations designed to enhance user safety and protect fundamental rights. Next steps could include the formal opening of proceedings or imposing fines for any misleading or incomplete information provided. https://lnkd.in/dQmg4Q64

1

📢 📢 Would you like to get acquainted with the upcoming EU AI Act implementation and compliance milestones? Well.. look no further, this timeline is for you! 🤖

47

1 Comment

Recommended Reading: Frequently Asked Questions on the EU Data Act https://lnkd.in/egh5_ACn Art. 32 of the EU Data Act, entitled "International Governmental Access and Transfer," requires that, "providers of data processing services shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State..." Commentators previously sought clarification as to: (1) whether and when must data be localized or restricted in its transfer; (2) whether private-to-private sector data transfers are covered; (3) what circumstances would "create a conflict"; (4) which EU law and Member State law provisions are at issue; and (5) what "technical, organization, and legal measures" are envisioned. See https://lnkd.in/gXm3m6nB and https://lnkd.in/eHqTyEpW We provide our analysis of the FAQ below. Data Localization: In Q.56, the FAQ indicates that: (1) the Data Act does not limit companies' ability to transfer non-personal data internationally; and (2) that users of cloud services will continue to be free to choose a cloud provider of their liking and to decide where to store their data. Treatment of private sector data transfers: Q.58 states that "these Articles do not cover data transfers between private entities on both sides of the EU border. Rather, they prevent access to or transfers of non-personal data by non-EU public authorities that are contrary to EU or Member State law." When a Legal Conflict May Result in a Transfer Prohibition: Q.57 states, "An unlawful access to or transfer of data may occur when such access or transfer would *clash with* obligations under EU or Member State law..." The Article 32 statutory text refers to a legal "conflict." Legal conflicts arise only when it impossible to comply with two different obligations - i.e., one cannot comply with one without breaching the other. This implies an exacting analysis as to whether a legally irresolvable conflict exists. Circumstances That May Give Rise to a Conflict: Q.57 refers to potential conflicts with laws on "the protection of fundamental rights of the individual," or "the protection of commercially sensitive data, including trade secrets and IP rights." While the GDPR contains provisions that expressly restrict data transfers, the cited IP laws typically do not contain such express transfer prohibitions. We recommend that Q.57 be further clarified to state that a conflict would only arise if the EU or Member State law expressly prohibits data transfers absent the fulfillment of specific conditions.

24