In this week’s episode Floora, Milla and our guest host Joost discuss how to look at AI through the lenses of privacy and data protection. With so much hype around the topic, we go through the most important developments in the past weeks.

On one hand, proponents of AI regulation argue that without proper oversight, AI could cause harm to privacy, whether intentionally or unintentionally. For example, if AI systems are used to make important decisions that affect people's lives, such as hiring decisions or medical diagnoses, there is a risk of bias or errors that could lead to unfair outcomes.

On the other hand, opponents of AI regulation argue that too much regulation could stifle innovation and hinder progress in the field. They argue that AI is still in its early stages of development and that it is not yet clear what the long-term impacts of AI will be.

The main reason for all the discussion is that service providers have been very opaque about the collection and usage of personal data in the AI models. Do they even use personal data? Are they processing it actively?

And thats where the Italians come along, as the Italian DPA already has taken a stance against Chat GPT and a "virtual friend" chatbot named Replica. What were the main issues according to the Italian DPA with ChatGPT? Why should you re-read the Google Spain decision to understand how ChatGPT might comply (or not comply) with the GDPR? We also shortly touch on the upcoming AI Act.

 

Links: 

Google Spain (Case C‑131/12)

https://curia.europa.eu/juris/document/document.jsf?docid=152065&doclang=en 

Italian DPA Garante on ChatGPT:

https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870847#english 

Norwegian DPA Datatilsynet: Artificial intelligence and privacy

https://www.datatilsynet.no/globalassets/global/english/ai-and-privacy.pdf 

 

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

 

In this episode of PrivacyPod with Anja Wyrobek, a Legal Policy Advisor and European Parliament, we will dive into lengthy development of ePrivacy Regulation, its impact on cookies (one may not forget cookies), encryption and impact of combat against child sexual abuse material thereto.

Eprivacy, the troublesome uncle of GDPR who just doesnt seem to get its act together, is on the talks, again. Eprivacy was expected to be adopted shortly after the GDPR, but the lingering conflicts has dragged the regulation in jeopardy, in an sort of  EU legal limbo, a void of Nothing. Five years later, no regulation is still the news.

Some say the future of the internet depends on it, others think the changes arent that big in the end. Many presidencies have tried to forcefully either bury it or unlock it, to no avail. Will the hard working regulators in Brussels get to finally push this Sisyphean rock on the top of the privacy hill? 

The key questions relate to the way communications are regulated, trying to bring OTT players, such as electronic communication services providers WhatsApp, Facebook messenger and Skype (yes, the proposal is THAT old) into the realm of regulation. The other goal is to stenghten regulation to protect consumers, but this has greatly fluctuated between revised proposals of the regulation.

Cookies are also a central question and thats also what is the issue here. As Anja reminds, its not the cookie banners that are striclty required by the current eprivacy directive, instead its the market players who have selected to solve the underlying issue with a terrible solution. It is not clear whether or not the new proposal clarifies the cookie situation, but people do have their hopes up.

Dial in to listen how Anja, Milla Keller and Hannes Saarinen dissect the legislative proposals impacting the future of our communications.

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week we discuss everything around U.S. privacy with a special guest, Odia Kagan! Odia is a Partner and Chair of GDPR Compliance and International Privacy at Fox Rothschild, a US-based law firm with 29 offices across the United States.

What was that last week’s discussion on banning TikTok all about? What is happening with U.S. privacy legislation right now, and how is FTC enforcing privacy requirements? If you gave up on following U.S. privacy updates after the California Consumer Privacy Act, this episode is for you.

 

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Have you ever felt bad about clicking ”decline all” on a cookie consent? Has that button been difficult to find? And if you finally find it, has the website spawned a pop up message trying to tell you how they will go bankrupt and the world will end if you do not accept all? If you answered yes to any of the previous questions, congratulations -- you have been subjected to dark patterns. 

In this episode, we venture into the dark side and discuss this issue with Marie Potel-Saville, a very well known figure in the world of legal innovation and the founder and CEO of Amurabi, a legal innovation agency. Before founding Amurabi, Marie has worked at Allen & Overy, Chanel and as a VP for legal at Estee Lauder EMEA. 

Almost the whole internet is full of dark patterns trying to nudge you into doing things you actually do not want to do by utilizing your humanity and the fact that you do not use your full brain capacity in every second you browse the wonderful world of the World Wide Web. 

But why is this a problem? What harm does this actually cause to individuals, companies, societies and well, democracy? And what about the children (1/3 of the web users are under age)? Is there a better way? What does the GDPR say about dark patterns -- is it really compliant to use dark patterns? What is the solution? 

Did we find the light at the end of the tunnel at all? Listen in to find out!

Links:

The Helmet decision by the Finnish Data Protection Ombudsman:

https://tietosuoja.fi/en/-/deputy-data-protection-ombudsman-issues-reprimand-for-conveying-library-search-information-to-us-based-google

European commission: Consumer protection: manipulative online practices found on 148 out of 399 online shops screened

https://ec.europa.eu/commission/presscorner/detail/en/ip_23_418

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

 

This week, we talk with Romain Robert, a Program Director and a senior lawyer working at NOYB. For the few who might not know, NOYB is a Austrian NGO founded by Max Schrems, who is probably a familiar name to everyone in the privacy world (heard of Scherms I or Schrems II anyone?).

Romain has extensive and interesting background and can claim a rare feat of actually taking part in writing the GDPR.

We talk about three groundbraking cases delivered by the Irish DPA by just the beginning of the privacy year 2023 concerning Instagram, Facebook and Whatsapp, all Meta owned platforms (yeah, those ones, everybody is talking about them, right?).

The complaints against these three companies were made on 25th of May 2018, on the day GDPR entered into force, and concerned their legal basis for processing the personal data of their users. The legal basis used for multiple different purposes, such as behavioural advertising and service improvement, was claimed to be contract, and this ultimately did not go through with the DPC. However, the case is more complicated than it sounds and included many twists and turns between the parties as well as between the DPC and other Member State DPAs- and ultimately the EDPB).

We also talk to Roman about working with NOYB, their future agenda, consent or pay -solutions and GDPR enforcement. Please tune in and learn more about the inside world of the most talked-about privacy NGO in Europe (or the world)!

 

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

 

And we are back once again with Joosts Case Corner! This time we dive deep into the past, present and future of the Court of Justice of the European Union with upcoming cases as well as latest judgments.

Panu and Joost explore the continous push and pull of GDPR enforcement. On the other hand, it seems like the GDPR puts aside any rights (the Luxembourg Business Registers case). On the other, there seems to be forming limits to the GDPR application in some areas (the Pankki S case).

If you have missed the CJEU action lately, no worries, this episode will put you back in track on what has been happening in the highest court in the EU.

The hosts discuss in this loong episode about several cases and in the process of doing that, they give Milla a good chance to issue an correction.

So load up your earpods and get your pencils ready, because this is going to be a pleasure.

Reading material:

Report about 22 GDPR: https://fpf.org/blog/fpf-report-automated-decision-making-under-the-gdpr-a-comprehensive-case-law-analysis/

New cases:

• C-672/22 (DKV) + Advocate General conclusion of 15 December 2022, C-487/21 (Österreichische Datenschutzbehörde and CRIF)
• C-693/22 (I)
• T-682/22 (Meta v EDPB)
• C-740/22 (Endemol Shine Finland)
• C-757/22 (Meta Platforms Ireland)

Questions and overview of all pending cases available at: https://gdprbeetle.eu/which-cjeu-data-protection-cases-are-currently-pending/

Judgments

• C-129/21 (Proximus)
• C-37/20 and C-601/20 (Luxembourg Business Registers)
• C-154/21 (RW)

 

Hearing

• C-634/21 (SCHUFA Holding and Others (Scoring)) on 26 January 2023 at 14:30 (First Chamber)

 

A-G opinion

• C-579/21 (Pankki S.)

Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

We start this year of PrivacyPod with a recap of recaps of year 2022. Milla and Hannes Saarinen (from our Finnish podcast) go head-to-head on a quirky quiz drawn up by Panu. I have a bad feeling about this.

Milla and Hannes will be scratching their heads on terms like "privacy zuckering" as well as trying to once again remember what was Privacy Shield 2.0 all about. And of course, Panu makes few mistakes, which dont effect the end result.

What was case C-245/20 about? Can you remember cases by their number? If you can, you would shine in the lightning round of Privacy/Not Privacy!

We have also asked our guests and presenters to give predictions on the privacy year 2023 and dare I say, they are very intruiging. And no, not all of them are about data transfers to the US. 

Who will take on the crown of privacy champion of 2022? Well, for that, you need to listen to the episode, they are both pretty competetive.

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

There's no such thing as too much talk about Schrems II, right? Tune in for our talk with the absolute expert on this topic, Eduardo Ustaran. We discuss the current state of international data transfers and when we can expect the new transfer deal to be finalized.   Eduardo tells us his learnings from assessing third country privacy laws: every country has some sort of surveillance regime in place, but when are the safeguards imposed on it sufficient in the EU's eyes? And of course, lots of talk about assessing risk in data transfers. We are not done with the risk based approach yet.   Eduardo also brings us greetings from IAPP's Brussels Congress, where he had the chance to discuss the Schrems II decision with Schrems himself. Should we already be expecting a Schrems III decision?   Recording of Schrems & Ustaran conversation moderated by Caitlin Fennessy at IAPP Brussels: https://iapp.org/news/video/schrems-ii-the-eu-us-dpf-stakeholders-volley-iapp-europe-data-protection-congress-2022/   

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Time for another Case Corner with Joost Gerritsen! What's been cooking in the CJEU, you ask? We're here to tell you! In this extra-long episode we discuss Digi, concerning the use of personal data in testing environments and whether that can be considered compatible use. Also on our list a few upcoming decisions - AG Decision on Österreichische Post regarding data protection damages, the pending log data case and lots more.

In case you're interested in watching the cases live, the streaming website is this:

https://curia.europa.eu/jcms/jcms/p1_1477137/en/

Only Grand Chamber judgments and opinions are streamed (so not the hearings, as far as we know). The stream will appear automatically around 09:15 – 09:30. At 09:30 the stream starts.

Digi, C-77/21; https://curia.europa.eu/juris/liste.jsf?num=C-77/21

Spacenet, C-793/19; https://curia.europa.eu/juris/liste.jsf?lgrec=fr&td=%3BALL&language=en&num=C-793/19&jur=C

VD and others, C-339/20; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-339/20%20and%20C-397/20

UI v Österreichische Post AG, C-300/21; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-300/21

Meta Platforms and Others, C-252/21; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-252/21

IAB Europe, C-604/22; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-604/22

KNLTB v Autoriteit Persoonsgegevens, C-621/22; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-621/22

Pankki S, C-579/21, https://curia.europa.eu/juris/liste.jsf?num=C-579/21&language=en 

 

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this episode, Milla and Pilvi are pressing play on their inner gamers as today's guest, Jussi Honkasalo, Senior Legal Counsel and DPO at Rovio (the home of the legendary Angry Birds), gives us a let's play tour around the privacy of mobile games. (Ok, did we get any previous gaming sayings right?) 

We discuss, for example, how is it possible to build a global mobile game in the jungle of different kinds of privacy regulations globally -- especially when the target audience of mobile games is vast not just geographically but also age-wise? What are the most critical privacy aspects to take into account? What would be the best ways to comply with transparency requirements with such a broad audience -- could, for example, the amazing game designers be of help here? We also discuss what kind of privacy requirements gaming platforms, from where mobile games are downloaded, have and if these requirements have an impact on gaming companies.   

We also briefly discuss the new "EO" (Executive Order on Enhancing Safeguards for United States Signal Intelligence Activities), which tries to patch up the holes exposed by Schrems II. 

Press play on the console/device of your choice, and jump into the world of gaming!

Executive Order on Enhancing Safeguards for United States Signal Intelligence Activities: https://www.whitehouse.gov/briefing-room/presidential-actions/2022/10/07/executive-order-on-enhancing-safeguards-for-united-states-signals-intelligence-activities/

 

We know we are not going to get any, but we would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]