DP News – Week 11. The European Court of Justice has clarified GDPR rules regarding auctioning personal data for advertising and stance on oral disclosure of criminal convictions data, the European Parliament has passed the AI Act.
***
The European Court of Justice has clarified GDPR regulations regarding the auctioning of personal data for advertising purposes, particularly in the case involving a non-profit association representing digital advertising and marketing companies across Europe (C-604/22).
In the digital advertising landscape, where companies bid in real-time for advertising space to display tailored ads to users, obtaining prior consent for data collection and processing is essential under GDPR guidelines.
The non-profit association representing digital advertising and marketing companies, proposed a solution involving the encoding of user preferences into a ‘Transparency and Consent String’ (TC String), shared with data brokers and advertising platforms. However, the Belgian Data Protection Authority ruled that the TC String constituted personal data under GDPR, imposing corrective measures and fines on the association.
Upon contesting the decision, the matter was referred to the Court of Justice, which confirmed the TC String’s status as personal data and labeled the non-profit association as a ‘joint controller’ in data processing operations related to user consent preferences.
***
The European Court of Justice has furthermore ruled on a case involving the oral disclosure of information on ongoing or completed criminal proceedings (C‑740/22). A company sought such data from a court, sparking a legal dispute regarding the processing of personal data under the GDPR.
The district court initially rejected the request, citing concerns about the disclosure’s alignment with data protection laws. The company appealed, leading to the referral of key questions to the Court of Justice for clarification.
The first question revolved around whether oral disclosure of such information constituted processing of personal data under the GDPR. The Court emphasized the GDPR’s broad definition of processing, concluding that oral disclosure indeed fell within its scope, particularly when the data were part of a court’s filing system.
Moving to the second and third questions, the Court considered whether GDPR provisions permitted the oral disclosure of criminal convictions data for public access to official documents. The Court stressed the need for compliance with GDPR principles, highlighting the sensitivity of such data and the potential infringement on individuals’ rights to privacy and data protection.
In summary, the Court ruled against the oral disclosure of criminal convictions data, unless there is a specific interest in obtaining the data. The court emphasized the need for proportionality and safeguarding individuals’ fundamental rights, regardless of whether the requester was a commercial entity or a private individual.
***
The EU AI Act was adopted by the European Parliament on 13 March on a 523-46 vote.
As IAPP reports, “the AI Act text needs to be translated into various languages and errors within the text need to be cleaned up. That is the job of the lawyer linguists. European Parliament Senior Policy Advisor Laura Caroli indicated approval of the text final text will likely happen sometime in April, putting the entry into force date closer to May”.
Comments are closed.