Topics in this issue are:

CHANGES IN LEGISLATION

• EU Commission Withdraws Plans for E-Privacy Regulation and AI Liability

CASE LAW

• ECJ: Discretion of the Authority in the Case of Excessive Complaints
• ECJ: Finde Amount Depends on Worldwide Group Turnover
• Higher Regional Court of Schleswig: Transport Encryption Insufficient when Sending Invoices by E-Mail
• Federal Court of Justice: Compensation of EUR 500 Due to Unauthorized Schufa Entry

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Italy: Data Protection Authority Bans DeepSeek
• German Data Protection Authorities Initiate Investigation Proceedings Against DeepSeek
• Spain: Fine of EUR 4 Million Against Generali Due to Data Breach

OPINIONS

• EU Commission Guidelines on Prohibited AI Practices
• EDPB Adopts Statement on Age Assurance

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• DORA in Force

CASE LAW

• ECJ: Gender Information Unnecessary when Purchasing Tickets
• ECJ: Collective Agreements do not Create a Legal Basis

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Ireland: Fine of EUR 251 Million Against Meta Due to Data Breach
• Italy: Fine of EUR 15 Million Against OpenAI for Lack of Legal Basis and Intransparency
• Netherlands: Fine of 4.75 Million Against Netflix for Lack of Information

OPINIONS

• EDPB Adopts Guidelines on Pseudonymisation
• EDPB: Opinion on the Processing of Personal Data in AI Models
• Lowe Saxony Data Protection Authority: Criticism of the Consent Managament Regulation

The Privacy Ticker is available under this link or in the download area below.

However, the speed of developments in recent months has surprised us. There is hardly a medium that has not reported in one form or another – and the current possibilities are being tested in schools just as much as in companies. Meanwhile, the third edition of the German broschure is available and we decided to publish it in English language as well.

The aim of this brochure is to provide a brief overview of the current legal situation and the state of the discussion. A brief presentation such as this cannot claim to be complete in terms of breadth and depth.

In addition, we venture an outlook on future developments and possible adaptations of the legal framework with regard to the advancing automation of AI and robotic systems. We are particularly interested in questions concerning the protectability of works created by AI on the one hand and questions of liability on the other – up to and including the not only provocative question of whether artificial intelligences should be holders of rights, perhaps even be given a legal personality. Here, too, we can and will only provide food for thought and discussion in a work of limited scope.

The German version has been published in summer 2024. This is an English translation for which some of the chapters have been updated.

Dr. Andreas Lober
Susanne Klein

Topics in this issue are:

Changes in Legislation

• Cyber Resilience Act and Amendment ofProduct Liability Directive in Force

CASE LAW

• ECJ: Exemptions from Information Obligations also for Self-Generated Personal Data
• Federal Social Court: Delayed Information Does not Lead to Loss of control Over Data
• Austrian Federal Administrative Court: Consent for Google Recaptcha
• Labour court of Duisburg: Compensation of EUR 10,000 for Disclosure of Health Data

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• France: Fine of EUR 50 Million Against Telecommunications Service Provider for Unlawful Advertising
• Italy: Fine of EUR 5 Million Against Delivery Service for Unauthorized Tracking
• Spain: Fine of EUR 1.3 Million Against Telecommunication Service Provider After Cyber Attack

OPINIONS

• EDPB Guidelines on Art. 48 GDPR

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CASE LAW

• Federal Court of Justice: Loss of Control from Facebook Scraping can be Damage
• Higher Regional Court of Frankfurt: Self-Service Tool in X Fulfils Right to Information Under Art. 15 GDPR
• Regional Labour Court of Düsseldorf: Employer Must Inform Applicants that it Googles them

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Spain: Fine of EUR 3.5 Million Against Telecommunications Provider due to Ransomware Attack
• Hamburg Data Protection Authority: Fine of EUR 900,00 for Breach of Deletion Obligations
• Finland: Fine of 2.4 Million for Setting up an E-Mail Inbox

OPINIONS

• EDPB: First Report on the EU-US Data Privacy Framework
• German Data Protection Conference: Updates Guidelines for Providers of Digital Services
• German Data Protection Conference: Guidelines on Selected Issues of the New Online Access Act

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Draft of an Employee Data Protection Act
• Cyber Resilience Act Adopted

CASE LAW

• ECJ: Order Information can Represent Health Data
• ECJ: No Obligations of the Supervisory Authorities to Take Remidial Action
• ECJ: Apology can be Sufficient Compensation for Damage
• ECJ: Sensitive Data may not be Used for Personalised Adverstising

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 310 Million against LinkedIn for Unlawful Processing for Advertising Purposes
• Fine of EUR 91 Million against Meta for Storing Passwords

OPINIONS

• EDPB: Responsibilities of the Controller in the Assignment of Data Processors
• EDPB: Guidelines on the Balancing of Interests

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Federal Government Adopts Cookie Regulation

CASE LAW

• Higher Regional Court of Munich: Data Breach Justifies Termination of Employment without Notice
• Regional Court of Traunstein: No Claim against Social Network for Data Processing Solely in Europe
• Administrative Court of Schleswig: Dashcam Videos on YouTube must be Pixelated

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 30.5 Million against Clearview
• Fine of EUR 3.2 Million due to Meta-Pixel on Website

OPINIONS

• Data Protection Conference: Transfer of Personal Data in Asset Deals
• Data Protection Conference: Resolution on the Use of Facial Recognition Systems by Security Authorities
• Data Protection Conference: Guidelines on Data Processing in Connection with Radio-Based Meters

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Data Transfer to the USA: New Agreement Between Switzerland and the USA Adopted

CASE LAW

• Federal Court of Justice: Explicit Naming of Data Protection Officer not Mandatory
• Administrative Court of Stuttgart: City Ordered to Pay EUR 2,500 Compensation for Unauthorized Publication of Health Data
• Administrative Court of Ansbach: Data Subject has Right to Demand Intervention from Data Protection Authority

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Fine of EUR 290 Million Against Uber Because of Data Transfer to the US
• USD 60 Million Fine Against T-Mobile Due to Unauthorized Data Access

OPINIONS

• Guidelines for Local Authorities and Administrations on the Right to Information Under Article 15 GDPR
• EU Commission: Second Report on the Evaluation of the General Data Protection Regulation

The Privacy Ticker is available under this link or in the download area below.

Topics in this issue are:

CHANGES IN LEGISLATION

• Digitalisation in the Healthcare Sector: Innovations for Cloud Computing in Force

CASE LAW

• ECJ: Claim by Consumer Associations in Case of GDPR Infringements Confirmed
• Federal Labor Court: Processing if Health Data in an Employment Relationship

REGULATORY INVESTIGATIONS AND ENFORCEMENT ACTIONS

• Online-Platform Vinted Fined Almost EUR 2.4 Million
• Fine of EUR 6.4 Million Against Italian Energy Company
• Fine of Some EUR 1.3 Million Against Swedish Bank

OPINIONS

• Agreement Between the EU and Japan on Data Flows in Force
• Hamburg Data Protection Authority: Large Language Models do not Store Personal Data
• BaFin: Implementation Information on DORA

The Privacy Ticker is available under this link or in the download area below.