PrivacyPod

A new year of PrivacyPod is kicked off with an episode covering the hottest topics and most intriguing privacy news so far!

Hosted by Milla and Laura, in this show our privacy DSARs speculate what the actual is up with Meta's consent or subscribe. And it would not be a 2024 privacy show if we would not dip in to what to expect in 2024 regarding recently leaked the EU AI Act.

We discuss a German case where the local court raised the bar high for answering data subject access requests (commonly known as DSARs) on time. Somewhat unexpectedly we find ourselves defending data brokers and cursing the difficulty of meeting those tough transparency requirements.

Meta decision coming: https://politico-tech.simplecast.com/episodes/an-exit-interview-with-europes-most-powerful-privacy-regulator

Leaked AI act:

https://iapp.org/news/a/eu-ai-act-draft-consolidated-text-leaked-online/

https://www.arbeitsrechtsiegen.de/artikel/bewerberanspruch-auf-auskunft-nach-art-15-dsgvo-und-schadensersatz-aus-art-82-dsgvo/

https://www.gegevensbeschermingsautoriteit.be/burger/gba-sanctioneert-gegevensbeheerder-black-tiger-belgium-wegens-gebrek-aan-transparantie

https://www.autoriteprotectiondonnees.be/citoyen/lapd-sanctionne-lentreprise-de-gestion-de-donnees-black-tiger-belgium-pour-manque-de-transparence

https://www.dataguidance.com/news/belgium-dpa-issues-174640-fine-black-tiger-unlawful

Poland Bisnode 2019:

https://iapp.org/news/a/polands-dpa-issues-first-gdpr-fine/

https://uodo.gov.pl/en/553/1572 (The Supreme Administrative Court upheld the decision of

the Personal Data Protection Office (UODO)

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this week's episode Milla discusses with Gabriel Silva from TravelPerk the best practices for using AI to enhance your work as a privacy professional. TravelPerk has recently started using a custom-built Legal Bot, which crunches through hundreds of privacy and other legal questions. What do you need to consider when you outsource legal work to a bot?

How do you finetune the model to make sure that the answers are relevant? Gabriel shares his practical experience on all of this. We also discuss other AI tools that are available for anyone. What kind of work tasks is AI good for? How to get started with prompting - and how to get better at it?

Gabriel is based in Barcelona and works as Legal Manager for privacy at Travel Perk which is a platform for business travel bookings. Gabriel has previously worked at Google at Google's legal operations.

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week on PrivacyPod: EDPB's guidelines on the infamous cookie article! EDPB published a couple of weeks back guidelines on the technical scope of Article 5(3) of the ePrivacy Directive (also known as the golden rule… no, sorry, the cookie rule).

Hannes (!), Heikki (!!), Laura (!!!!) and Milla (????) go through the guidelines, speculating why do we get guidelines on this topic right now, considering that the legislation is not exactly fresh out of the oven. What exactly is then the technical scope of the cookie article? And how will organizations go about implementing the new guidelines, once they have been adopted after the consultation period?

Also in this episode: Hannes, Heikki and Milla share reflections on the recent IAPP Brussels conference. Don't worry though privacy folks, we only discuss the official program - what happens in Brussels, stays in Brussels.

Links:

edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_en.pdf (europa.eu)

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this awaited and exciting episode Milla and Pilvi are experiencing a true fangirl moment as they welcome Tobias Judin, the Head of International Department at the Norwegian Data Protection Authority, Datatilsynet.

Accompanied by our new co-host Jyri they will dive into to discuss the Meta case on its rocky road with its legal basis for behavior based advertising. Norwegian DPA has not only talked the talk but it has also walked the walk: as Tobias states, they see that the GDPR has to be enforced now and that the GDPR does have tools to do that.

We discuss, among other things, how has the Norwegian DPA become the renegade DPA that takes such firm action? What has the road been like from 2018 to the EAA wide ban? What does Tobias think about the newest Meta solution: consent or pay? We also touch upon subjects such as does transparency matter at all? How do you measure it? What about the IAB case and advertising funding journalism? Is the new "consent or pay" just Meta buying time and gaslighting?

We also have a big scoop in the episode, which we recognize with "cool cool". This and much more awaits you.

Links: Datatilsynet 17.7.2023: "Midlertidig forbud mot adferdsbasert markedsføring på Facebook og Instagram" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/midlertidig-forbud-mot-adferds basert-markedsforing-pa-facebook-og-instagram/

Datatilsynet 8.8.2023: "Meta-saken opp i Oslo tingrett" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/tvangsmulkt-til-meta-hvis-forbu d-ikke-folges/

Datatilsynet 6.9.2023: "Datatilsynet vant mot Meta i Oslo tingrett" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/datatilsynet-vant-i-oslo-tingrett/

Datatilsynet 25.10.2023: "Meta går til ny sak mot Datatilsynet" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/meta-gar-til-ny-sak-mot-datatils ynet/

Datatilsynet 28.9.2023: "Meta-saken løftes til europeisk nivå" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/meta-saken-loftes-til-europeisk- niva/

Datatilsynet 31.10.2023: "Datatilsynets vedtak mot Meta utvides til EU/EØS og gjøres permanent" https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/datatilsynets-vedtak-mot-meta- utvides-til-eueos-og-gjores-permanent/

EDPB 1.11.2023: "EDPB Urgent Binding Decision on processing of personal data for behavioural advertising by Meta" https://edpb.europa.eu/news/news/2023/edpb-urgent-binding-decision-processing-persona l-data-behavioural-advertising-meta_en

Meta: "How Meta Uses Legal Bases for Processing Ads in the EU" https://about.fb.com/news/2023/01/how-meta-uses-legal-bases-for-processing-ads-in-the-eu/

TechCrunch 1.8.2023: "Meta says it will offer Europeans a free choice to deny tracking" https://techcrunch.com/2023/08/01/meta-says-yes-to-consent/

TechCrunch 3.10.2023: "Meta planning ad-free subscription or tracking ads 'choice' in EU, per WSJ — in latest bid to keep snooping" https://techcrunch.com/2023/10/03/meta-subscription-vs-consent/

Meta: "Facebook and Instagram to Offer Subscription for No Ads in Europe" https://about.fb.com/news/2023/10/facebook-and-instagram-to-offer-subscription-for-no-a ds-in-europe/

Case C‐252/21 Judgment: https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0& doclang=EN&mode=req&dir=&occ=first&part=1

Case C‐252/21Press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf DPC Meta decisions January 2023: https://www.dataprotection.ie/en/news-media/data-protection-commission-announces-con clusion-two-inquiries-meta-ireland

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this news episode, Milla and Pilvi jump into the most interesting news (in their opinion at least) of the recent weeks and that takes us to a journey that will include Googling, Star Wars, elderly millennials trying to exists in the world they don't understand, and Jean-Jacques Rousseau's book Émile ou De l'éducation from 1762.

But we also actually go through the recent privacy news, including the recent CANAL+ case from France, EDPB's coordinated action -action, an interesting case on legal bases legal obligation and public interest from Sweden that also include somewhat puzzling takes on CCTV and article 13..or 14 (there's the question!)? We also discuss Meta being sued by 41 states in the US, EU Commission's next DSA actions towards social media giants and the latest from the mysterious world of AI.

"So it seems like this internet thing is here to stay, huh?"

Chandler Bing

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this episode, Hannes and Milla welcome Jussi Leppälä, the of Valmet (a leading global developer and supplier of technologies, automation and services for the pulp, paper and energy industries) to delve into the interesting world of IoT -based data sharing of the future.

What is the underlying intent of the Data Act? How does it interact with other data laws? How will it be enforced?

Delving deeper into the Data Act, we look at the actual scope of data sharing obligations, how they would work in practice and alongside the GDPR's data subject or towards third parties.

Join us to get insights on whether Data Act will be effective in fostering European small and medium sized companies … or enterprises outside of the EU. Are your data related trade secrets also protected tomorrow? And much, much more!

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on harmonised rules on fair access to and use of data (Data Act)

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM%3A2022%3A68%3AFIN

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Meta is considering a move to cookie-paywall some listeners may know (and already hate) from German newspaper websites. As the legal basis for Meta's personalised ads (the company's main money-maker) is being pushed towards consent from all fronts, Meta is considering desperate means. But is it all just a ruse, as convincing as Meta's earlier threats about leaving the EU because of data transfer issues?

In other news, Pilvi and Milla discuss Irish Data Protection Commission's 345 MEUR fine to TikTok. We also discuss once more the Grindr case from Norway, where the appeals board upheld the earlier fine. We also cover UK Information Commissioner's preliminary enforcement notice against Snap, BBC blocking ChatGPT from using its content and lots more.

Links:

Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach (noyb.eu)

Meta Plans to Charge $14 a Month for Ad-Free Instagram or Facebook - WSJ

UK Information Commissioner issues preliminary enforcement notice against Snap | ICO

Record fine in the Grindr case confirmed | Datatilsynet

BBC blocks ChatGPT from using its content (thetimes.co.uk)

Google adds a switch for publishers to opt out of becoming AI training data - The Verge

Irish Data Protection Commission announces €345 million fine of TikTok | 15/09/2023 | Data Protection Commission

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this episode, join Pilvi, Hannes, and Floora as they take a deep dive into the world of Mergers and Acquisitions (commonly known as M&A) from a privacy perspective. They'll explore the intriguing question of whether the M&A process differs in the realm of privacy compared to other areas of law. If so, what sets it apart, and does it make sense to approach privacy M&A in the traditional manner?

Listeners can expect a lively and informative discussion on the intricacies of privacy M&A. Our hosts will shed light on the varying perspectives of in-house counsel, external advisors, and walk you through the general M&A process, step by step. Additionally, they'll engage in a thoughtful conversation about proposals aimed at advancing the field of privacy M&A.

Tune in for an insightful and educational journey through the legal landscape of privacy M&A, where we explore the unique challenges and opportunities that arise in this ever-evolving field. Furthermore, tune your ears to the finest, because eagle ear listeners can hear our ultracute privacy poodle Hubert weigh in on M&A as well!

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Joost Case Corner (JCC) is back! As per usual, there's no way we will cover all of the Court of Justice of the European Union (CJEU) goodness in under one hour, so buckle up for an extra-long special episode.

Its a perfect catch up with the lates court action and since its been a while, we can hear our presenters (Milla mainly) trip over some pretty basic EU abbreviations. So all you EU nerds there, prepare to scream really hard to your earphones what TFEU stands for.

We discuss three cases with final judgments already out there: Meta v Bundeskartellamt (C-252/21), Pankki S (C-579/21) and Lietuvos Respublikos (C-162/22).

Under our section on ongoing cases we go through five cases that will likely shake the privacy world once decided: ILVA (C-383/23), Mousse (C-394/23), Österreichische Datenschutzbehörde (C-416/23, which Milla can pronounce perfectly, just wait for it), IAB Europe (C-604/22, sad that Heikki isnt here to rant) EDPS v SRB (C-413/23 P, yes, that annoying pseudonyisation case where normies claim that GDPR doesnt apply). The cases cover definition of personal data, pseudonymization and anonymization, calculation of fines and much more.

We know, you might be a bit lagging behind on the case law, so no worries! This is your cue to press play and dig through the intricacies of data protection case law with Joost, Milla and Pilvi.

Cases covered in the episode:

Cases with final judgments:

Meta v Bundeskartellamt (C-252/21)

Pankki S (C-579/21)

Lietuvos Respublikos (C-162/22)

Ongoing cases:

ILVA (C-383/23)

Mousse (C-394/23)

Österreichische Datenschutzbehörde (C-416/23)

IAB Europe (C-604/22)

EDPS v SRB (C-413/23 P)

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week Pilvi and Milla do a deep dive into two recent cookie related rulings from Nordic data protection authorities. First we discuss the Bonnier case from IMY, the Swedish data protection authority. Whilst not strictly only about cookies, this case discusses the further processing of data collected with cookies - and more specifically, whether this processing can be based on legitimate interest (IMY says no).

The second half of the show we discuss Traficom's ruling on the Nordic media company Sanoma's cookie practices. Lots to unpack there: necessity of certain analytics cookies, retention times, representation of legitimate interest in cookie banners and much more. Both of the cases have been appealed.

Links:

Sanoma Media Finland Oy.pdf (kyberturvallisuuskeskus.fi)

Tillsyn: Bonnier News AB | IMY

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]