PrivacyPod

We start this year of PrivacyPod with a recap of recaps of year 2022. Milla and Hannes Saarinen (from our Finnish podcast) go head-to-head on a quirky quiz drawn up by Panu. I have a bad feeling about this.

Milla and Hannes will be scratching their heads on terms like "privacy zuckering" as well as trying to once again remember what was Privacy Shield 2.0 all about. And of course, Panu makes few mistakes, which dont effect the end result.

What was case C-245/20 about? Can you remember cases by their number? If you can, you would shine in the lightning round of Privacy/Not Privacy!

We have also asked our guests and presenters to give predictions on the privacy year 2023 and dare I say, they are very intruiging. And no, not all of them are about data transfers to the US.

Who will take on the crown of privacy champion of 2022? Well, for that, you need to listen to the episode, they are both pretty competetive.

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

There's no such thing as too much talk about Schrems II, right? Tune in for our talk with the absolute expert on this topic, Eduardo Ustaran. We discuss the current state of international data transfers and when we can expect the new transfer deal to be finalized. Eduardo tells us his learnings from assessing third country privacy laws: every country has some sort of surveillance regime in place, but when are the safeguards imposed on it sufficient in the EU's eyes? And of course, lots of talk about assessing risk in data transfers. We are not done with the risk based approach yet. Eduardo also brings us greetings from IAPP's Brussels Congress, where he had the chance to discuss the Schrems II decision with Schrems himself. Should we already be expecting a Schrems III decision? Recording of Schrems & Ustaran conversation moderated by Caitlin Fennessy at IAPP Brussels: https://iapp.org/news/video/schrems-ii-the-eu-us-dpf-stakeholders-volley-iapp-europe-data-protection-congress-2022/

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Time for another Case Corner with Joost Gerritsen! What's been cooking in the CJEU, you ask? We're here to tell you! In this extra-long episode we discuss Digi, concerning the use of personal data in testing environments and whether that can be considered compatible use. Also on our list a few upcoming decisions - AG Decision on Österreichische Post regarding data protection damages, the pending log data case and lots more.

In case you're interested in watching the cases live, the streaming website is this:

https://curia.europa.eu/jcms/jcms/p1_1477137/en/

Only Grand Chamber judgments and opinions are streamed (so not the hearings, as far as we know). The stream will appear automatically around 09:15 – 09:30. At 09:30 the stream starts.

Digi, C-77/21; https://curia.europa.eu/juris/liste.jsf?num=C-77/21

Spacenet, C-793/19; https://curia.europa.eu/juris/liste.jsf?lgrec=fr&td=%3BALL&language=en&num=C-793/19&jur=C

VD and others, C-339/20; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-339/20%20and%20C-397/20

UI v Österreichische Post AG, C-300/21; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-300/21

Meta Platforms and Others, C-252/21; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-252/21

IAB Europe, C-604/22; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-604/22

KNLTB v Autoriteit Persoonsgegevens, C-621/22; https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=C-621/22

Pankki S, C-579/21, https://curia.europa.eu/juris/liste.jsf?num=C-579/21&language=en

We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this episode, Milla and Pilvi are pressing play on their inner gamers as today's guest, Jussi Honkasalo, Senior Legal Counsel and DPO at Rovio (the home of the legendary Angry Birds), gives us a let's play tour around the privacy of mobile games. (Ok, did we get any previous gaming sayings right?)

We discuss, for example, how is it possible to build a global mobile game in the jungle of different kinds of privacy regulations globally -- especially when the target audience of mobile games is vast not just geographically but also age-wise? What are the most critical privacy aspects to take into account? What would be the best ways to comply with transparency requirements with such a broad audience -- could, for example, the amazing game designers be of help here? We also discuss what kind of privacy requirements gaming platforms, from where mobile games are downloaded, have and if these requirements have an impact on gaming companies.

We also briefly discuss the new "EO" (Executive Order on Enhancing Safeguards for United States Signal Intelligence Activities), which tries to patch up the holes exposed by Schrems II.

Press play on the console/device of your choice, and jump into the world of gaming!

Executive Order on Enhancing Safeguards for United States Signal Intelligence Activities: https://www.whitehouse.gov/briefing-room/presidential-actions/2022/10/07/executive-order-on-enhancing-safeguards-for-united-states-signals-intelligence-activities/

We know we are not going to get any, but we would love to get feedback – so please tag us, follow us, DM us, or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week we discuss the latest developments in ad tech privacy with Peter Hense. Peter is a partner at Spirit Legal, where he specializes in data privacy litigation, particularly in the area of advertising technology. In this episode we cover the Danish DPA's guidance on Google Analytics as well as CNIL's guidance on using proxy servers as a supplementary measure to combat Schrems II issues. Also on the table: is Google Analytics 4 any better for privacy than Universal Analytics, where is ad tech headed in the future and what is the one thing Peter would change about the GDPR. Danish DPA - press release on Google Analytics https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics Danish DPA Q&A https://www.datatilsynet.dk/english/google-analytics CNIL guidelines for making GA compliant https://www.cnil.fr/en/google-analytics-and-data-transfers-how-make-your-analytics-tool-compliant-gdpr

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

We're back from our summer break! This week on the podcast we discuss privacy and security issues in in-app browsers. Many apps do some tracking, but TikTok seems to win the price this time around on being the most intrusive social media app in this regard. Panu and Milla are disagreeing on what level of concerned one should be about this. We also discuss the Finnish Prime Minister's party scandal (from a very serious privacy angle, not just gossiping), the Danish DPA banning the use of Chromebooks in schools and lots more.

TikTok

https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

Dutch Football case https://www.fedma.org/2022/07/dutch-court-closes-voetbaltv-case-but-balance-to-the-gdpr-legitimate-interest-is-yet-to-be-restored/ https://www.raadvanstate.nl/uitspraken/@132243/202100045-1-a3/?highlight=voetbaltv#toonpersaankondiging

Danish DPA banning use of Chromebooks https://techcrunch.com/2022/07/18/denmark-bans-chromebooks-and-google-workspace-in-schools-over-gdpr/ https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/aug/ny-afgoerelse-datatilsynet-fastholder-forbud-i-chromebook-sag

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Dear listeners - technology is not neutral. That's the premise of the book from our this week's guest, Stephanie Hare. In this episode, Stephanie shares with us her insights on technology ethics. Sure, privacy is an important part of ethical design, but what else does it entail? And who bears the responsibility for raising their voice, when something doesn't seem right? More on Stephanie and her book "Technology Is Not Neutral: A Short Guide to Technology Ethics" here: https://www.harebrain.co/

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

You know what the title means - we have Joost Gerritsen back on board with us! What we intend to be a regular section on the podcast, we delve again into the intricacies of CJEU case law. On the menu this week:

CJEU judgments:

• X, Z v Autoriteit Persoonsgegevens – C-245/20 – 24 March 2022 - https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62020CJ0245
• G.D. v The Commissioner of the Garda Síochána And Others – C-140/20 – 5 April 2022 - https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62020CJ0140
• Meta Platforms Ireland (C-319/20) – 28 April 2022 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62020CJ0319

Advocate General opinions:

• Digi (C‑77/21) – 31 March 2022 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CC0077
• Google (C-460/20) – 7 April 2022 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CC0460
• Proximus (C-129/21) – 28 April 2022 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CC0129

And hey - if you come up with a cooler brand name than Case Corner for Joost's section, hit us up, we're all ears for feedback!

And check out also Joost's website https://gdprbeetle.eu/which-cjeu-data-protection-cases-are-currently-pending/ to keep posted on latest CJEU privacy developments.

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this week's episode, be prepared to experience moral outrage on so many fronts. We cover the Verisure scandal from Sweden with employees snooping on security camera footage, another big fine from the Netherlands and lots more. Also in this episode: should you quit your job, move to Germany, and start filing for privacy damages left and right to make a living?

And is EU Courts streaming their judgments the new Netflix?

LinkedIn v HiQ case https://iapp.org/news/a/linkedin-v-hiq-and-the-transatlantic-privacy-divide/

Verisure scandal under investigation by Swedish DPA https://www.is.fi/digitoday/art-2000008769860.html

Google introduces new controls in Google Analytics https://support.google.com/analytics/answer/12017362

Dutch DPA fines the Dutch tax authority 3,7 MEUR https://www.politico.eu/article/dutch-scandal-serves-as-a-warning-for-europe-over-risks-of-using-algorithms/

25€(yes, 25€!) in damages granted for receiving spam email https://gdprhub.eu/index.php?title=LG_Heidelberg_-_4_S_1/21&mtc=today

Nerdflix – EU Courts start livestreaming https://www.politico.eu/article/eus-top-court-embraces-digital-age-with-streaming-service/

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

We have a new data transfer deal between the EU and the US! In principle. What does the announcement of an agreement "in principle" mean, when can we expect an actual deal, and what does this mean for transfers of personal data to the US right now? Can we stop doing transfer impact assessments altogether?

In other news, we cover Meta's 17MEUR fine from Ireland, and have a quick look at the recent EDPB guidelines. We're delighted to discover that the term "Privacy Zuckering" exists, and equally disappointed to find out that the term did not make its way in the EDPB's dark patterns guideline.

European Commission press release on the Framework https://ec.europa.eu/commission/presscorner/api/files/attachment/872132/Trans-Atlantic%20Data%20Privacy%20Framework.pdf.pdf

US Fact Sheet on the Framework https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-states-and-european-commission-announce-trans-atlantic-data-privacy-framework/

CMS blogpost on Privacy Shield https://www.cmshs-bloggt.de/tmc/datenschutzrecht/trans-atlantic-data-privacy-framework-datentransfer-usa/#

US Supreme Court Fazaga case https://thehill.com/opinion/judiciary/598899-the-supreme-court-just-made-a-us-eu-privacy-shield-agreement-even-harder

17MEUR fine on Meta from Irish DPA https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-meta-facebook-inquiry

New guidelines from the EDPB https://edpb.europa.eu/system/files/2022-03/guidelines_202202_on_the_application_of_article_60_gdpr_en.pdf https://edpb.europa.eu/system/files/2022-03/edpb_03-2022_guidelines_on_dark_patterns_in_social_media_platform_interfaces_en.pdf

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]