Not just a good excuse to brush up my limited German! Yesterday’s dual-language event in Zurich was an excellent blend of discussions regarding the concept of “personal data” and the tensions with data sharing frameworks.
The juxtaposition of my opening keynote (in English) on case law on the notion of personal data (+ Digital Omnibus possible evolutions) and Alexandre Jotterand’s presentation on the evolution towards more laws on data sharing was particularly judicious, and it gave rise to interesting discussions on open data “licences” (read: terms of use), the nature of rights on data and possible contractual solutions.
Yesterday showed that the CJEU’s SRB judgment continues to lead to important questions about its impact on processors. In my response, I told the audience I really like the existence of the SRB judgment and its confirmation of the relative nature of “personal data” under the GDPR – but at the same time I consider that if Deloitte’s probable role as processor had been properly taken into account, we might have had a different judgment (not that it would have concluded to an absolute nature of personal data, but rather that the processor’s own perspective is irrelevant and only that of the controller).
While I agree with Alexandre’s comments that there is more and more legislation on data in general, I believe the distinction remains key to determine the scope of obligations (and rights). Cybersecurity elements of data protection are becoming a universal layer, purpose limitation is getting translated into contractual restrictions for recipients of non-personal data, yet the issue of transparency and accountability vis-à-vis individuals remains tied to “personal data”.
All eyes are on the European Data Protection Board to see whether it will take a pragmatic approach in its forthcoming pseudonymisation guidelines – or whether it will attempt to minimise the teachings of SRB.
Thanks Martina Arioli for the invite!
More on pseudonymisation and SRB:
– Pseudonymisation & “means reasonably likely to be used” for identification: when does data become personal? https://lnkd.in/ewCAtRue
– When is data no longer personal? And what are the implications?
https://lnkd.in/e5PERUdN“
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗