A couple of things I would keep in mind on this saga: 1) The 1st Constitutional Courts which declared unconstitutional the data retention laws transposing the defunct directive, did so in 2009, 2010 & 2011: 1st, the Romanian Const Court ❤️, then the German and Czech Const Courts.
2) Before them, the Bulgarian Supreme Administrative Court annulled a provision of the data retention national law in 2008.
What do these countries have in common? A history of suffering under surveillance states & no rule of law. Maybe they know this leads to bad stuff?
3) The ECJ tried to avoid the problem in a couple of cases, looking at formal issues & competence of the EU to act, when 1st looking at the 2006 Directive.
It couldn’t avoid it any longer when 2 other Constitutional-level tribunals sent it Qs : Austria & Ireland.
4) Under this pressure from *Constitutional Courts*, the CJEU started its now famous line of cases against bulk collection of metadata w/out proper safeguards for collection & gov access. Digital Rights Ireland & Seitlinger, in 2014, annulled the Directive w immediate effect!
5) After the DRI Decision, other Constitutional Courts followed suit to declare the transposing data retention laws unconstitutional.
6) Take Poland’s example. The Const Tribunal declared the law unconstitutional in 2014, a couple of months after the DRI judgment. But the Polish Gov (PiS) took it as an opportunity to broaden its surveillance powers in the newly proposed law - tandfonline.com/doi/full/10.10…
7) And the problem boils down to this: a battle between Const Courts, the rule of law and respect for fundamental rights on one hand, and governments and their increasing need to be all powerful and omniscient, on the other. #DataRetention
8) Some constitutional courts, like the Czech one, abandoned course a decade later, see edri.org/our-work/czech….
Some governments thought that the best way to solve the battle is to simply *undermine the foundations of the Const Court*, see washingtonpost.com/politics/2020/…
9) And now another government came up with an even more radical strategy - why not undermine the foundational texts of the EU that protect fundamental rights, including the EU Charter? So on April 21st next, I will read with more anxiety & curiosity ...
10)...what the Conseil d’Etat will say in this saga, than what the European Commission will put forward in the AI reg proposal. If the Const Courts, the CJEU, the rule of law, the fundamental frameworks will be eroded, a secondary piece of legislation doesn’t matter as much. #END
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Per art. 1 the draft reg covers:
- placing on the market
- putting into service
- use of AI systems in the Union
Does this leave out training of AI? Possibly. But when they're trained w personal data, no worries. The GDPR applies.
2/
Other rules in scope of the regulation:
- prohibitions of certain AI systems (!)
- requirements for high-risk AI systems
- transparency rules for AI intended to interact w people
- rules on market monitoring and surveillance. 3/
Time to pay close attention to #China & #India's comprehensive #DataProtection bills. Why? Because they are coming probably by the end of 2021, they are giving 'data subject' rights to app 2.7 billion people & they legislate DP where the US is absent: 1/ linkedin.com/posts/iapp---i…
In this panel that opened the #GPS2021 online sessions for @PrivacyPros, I explore with Barbara Li and Malavika Raghavan @teninthemorning some of the context & background leading to these two legislative developments in China and India, as well as the burning topics of ... 2/
...data localization, international data transfers, private rights of action and enforcement. There was so much more to talk about - we promise to be back with a follow-up and a deeper dive into individual data subject rights and other practical topics. Why the time pressure? 3/
I see a bit more interesting interaction between data protection rules and the #DigitalMarketsAct. Two points: (1) the obligation for gatekeepers to refrain from combining personal data from any other services offered by the gatekeeper or w PD from 3rd-party services, unless 1/
"unless the end user has been presented with the specific choice and provided consent in the sense of the GDPR" (Art. 5(a) of the proposal). And 2) the obligation for gatekeepers to submit to COM an annual independent audit w a description of the user profiling techniques 2/ #DMA
There are also data sharing obligations with third parties, including personal data, which are quite interesting. In fact, one of them speaks of "continuous and real time access" offered to business users (Art. 6(1)(i)) #DSA 3/
And the text fo the long awaited #DigitalServicesAct Proposal is here! One day early, thanks to @SamuelStolton and his sources. One key thing to note is that the DSA is clearly without prejudice to both the GDPR and the ePrivacy Directive... euractiv.com/wp-content/upl… 1/n #DSA
which technically means that it applies on top of them and in case of conflict, the provisions in the #GDPR and the ePrivacy Directive prevail. There are 2 areas of interaction that immediately pop-up. First, the rules on recommender systems and online advertising 2/n #DSA
Both of these certainly rely on processing of personal data. But it seems there is broad convergence between the existing #EUDataP regime and the proposed #DSA, especially in relation to transparency and rights to explanation 3/n #DSA
Momentous development in EU law for the digital market: the EU Commission is expected to publish today the #DataGovernanceAct proposal for a Regulation. From a new European Board, to fiduciary duties, to data intermediaries, data cooperatives (!) and data altruism… 1/
There are plenty of things to look out for! Here is my top list of hot topics, based on the leaked version that circulated among Brussels tech media a couple of weeks back. First: lots of “data sovereignty” undertones to key rules, sometimes sliding into data localization … 2/n
Exhibit A: The title regulating the re-use of data held by public sector bodies allows such re-use by different actors “within the Union”, with an additional specification that “the processing of such data shall be limited to the European Union” 3/
... within the federalized legal system, where consumer protection agencies, big and small, have a strong tradition of enforcing consumer rights, where Prosecutors from the Public Ministry - federal and regional, have the power to bring #LGPD breaches to Court ... 2/n
... where there is a long tradition of class actions, with actually very few barriers to proceed in Court from an admissibility and costs perspective, where the Supreme Constitutional Court recognized this year an autonomous fundamental right to data protection... 3/n