{"id":2547,"date":"2020-05-24T09:56:34","date_gmt":"2020-05-24T09:56:34","guid":{"rendered":"http:\/\/www.bizlegal.eu\/?page_id=2547"},"modified":"2020-05-24T09:56:35","modified_gmt":"2020-05-24T09:56:35","slug":"newsletter-september-2019","status":"publish","type":"page","link":"https:\/\/www.bizlegal.eu\/?page_id=2547","title":{"rendered":"Newsletter September 2019"},"content":{"rendered":"\n

Biometric Data processing. <\/strong><\/p>\n\n\n\n

To be legally compliant with data protection law, an employer must have a  \u201clawful basis\u201d or justifiable reason to process an employee\u2019s personal data.  <\/p>\n\n\n\n

Ordinarily, under the GDPR, these reasons could include:  <\/p>\n\n\n\n

a) employee consent;  <\/p>\n\n\n\n

b) where the processing is necessary for the performance of <\/p>\n\n\n\n

a contract to which the data subject has agreed to;  
c) for compliance with an employer’s legal obligation;  
d) where the processing is necessary to protect to protect <\/p>\n\n\n\n

an individual\u2019s vital interests; <\/p>\n\n\n\n

e) where the processing is necessary in the public 
interest; <\/p>\n\n\n\n

f) where the processing is necessary for the 
purposes of legitimate interests pursued by the <\/p>\n\n\n\n

employer. <\/p>\n\n\n\n

Biometric data used to uniquely identify individuals is considered a \u2018special category\u2019 of personal data under the 
GDPR. Processing of special categories of personal data is prohibited unless additional legal bases apply. Therefore, in  addition to having one of the above legal bases for processing, the employer must ALSO have one of the following 
legal bases: <\/p>\n\n\n\n

g) explicit consent;  <\/p>\n\n\n\n

h) where the processing is necessary for the <\/p>\n\n\n\n

performance of specific rights or obligations in 
employment\/social security\/social protection law 
or a collective agreement;  <\/p>\n\n\n\n

i) where the processing is necessary to protect to 
protect an individual\u2019s vital interests where the 
data subject is physically or legally incapable of 
giving consent;  <\/p>\n\n\n\n

j) where the processing is carried out by a non-profit 
body in certain circumstances; <\/p>\n\n\n\n

Consent <\/strong><\/p>\n\n\n\n

Explicit consent (i.e stated consent, or <\/p>\n\n\n\n

consent signified by some positive <\/p>\n\n\n\n

action such as ticking a box, not just consent which <\/p>\n\n\n\n

may be inferred from circumstances) given by the data  subject to process their biometric data is one of these  additional legal bases, however employee consent is 
often not considered true consent due the 
asymmetrical nature of the employer\/employee 
relationship.  Readers will also note from the list at g)- n) above that \u2018Legitimate interests\u2019 are not available <\/p>\n\n\n\n

as a legal basis to process biometric data.  <\/p>\n\n\n\n

k) where the processing related to personal data 
made public by the data subject themselves;  <\/p>\n\n\n\n

l) where the processing is necessary for the 
establishment, exercise or defence of legal claims; <\/p>\n\n\n\n

m) where the processing is necessary for reasons of 
substantial public interest; <\/p>\n\n\n\n

n) where the processing is necessary in some limited 
other circumstances as set out in Article 9 of the 
GDPR. <\/p>\n\n\n\n

Considering these stricter consent obligations under  the GDPR and the Article 29 Working Party guidance  (the Article 29 group is now effectively the European  Data Protection Board, the overseeing body of the <\/p>\n\n\n\n

GDPR), an employer who is processing biometric data  of employees used to uniquely identify individuals 
should seek alternative bases to explicit consent or 
\u2018legitimate interests\u2019 to process its employees\u2019 
biometric data. Unless an employer can make an 
argument that it is processing biometric data under a  collective agreement, or is doing so in the public 
interest, no other alternative basis is currently 
available.   
<\/p>\n\n\n\n

In our opinion, employees should be offered 
alternatives to biometric clock in systems used to  uniquely identify individuals. This is based on a pre- existing pre-GDPR decision from the Irish Data <\/p>\n\n\n\n

<\/td><\/tr>
<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Protection Commission to that effect, which has now  been reinforced by a recent Swedish decision in which  a school was fined 200,000 Krona (about \u20ac19,000) for  processing biometric data. <\/p>\n\n\n\n

https:\/\/www.biometricupdate.com\/201908\/swedish-<\/a> data-protection-authority-issues-first-fine-for-<\/a>
biometrics-use-under-gdpr <\/a><\/p>\n\n\n\n

One potential solution is to use biometric data for 
non-identification purposes. Biometric data which is 
used to authorise entry without identifying an 
individual, but only identifying the fact that they are 
one of a class of people who are entitled to entry or 
access is not \u2018biometric data for the purpose of 
uniquely identifying a natural person\u2019 and is therefore  not Special Category Data and therefore only subject  the less onerous legal bases in the list at a)-f) above.<\/p>\n\n\n\n

<\/td><\/tr>
<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

When is a Data Protection Impact Assessment (\u2018DPIA\u2019) required in Ireland? <\/strong><\/p>\n\n\n\n

Following the EDPB\u2019s Opinion, the Irish Data Protection Commission (DPC<\/strong>) has published a non-exhaustive list of 
processing activities which require a DPIA to be carried out. The list encompasses both national and cross-border 
data processing operations. It should be read in conjunction with Article 35 of the GDPR and the Article 29 Working  Group Guidelines  <\/p>\n\n\n\n

The DPC has determined that a DPIA will be mandatory for the following types of processing operations: <\/p>\n\n\n\n

1. Use of personal data on a large-scale for a 
purpose(s) other than that for which it was <\/p>\n\n\n\n

initially collected (a compatibility test must also 
be carried out pursuant to Article 6(4) GDPR). <\/p>\n\n\n\n

2. Profiling vulnerable persons including children to 
target marketing or online services at such 
persons. <\/p>\n\n\n\n

3. Use of profiling or algorithmic means or special 
category data as an element to determine access <\/p>\n\n\n\n

to services or that results in legal or similarly 
significant effects; <\/p>\n\n\n\n

4. Systematically monitoring, tracking or observing 
individuals\u2019 location or behaviour. <\/p>\n\n\n\n

5. Profiling individuals on a large-scale. <\/p>\n\n\n\n

6. Processing biometric data to uniquely identify an <\/p>\n\n\n\n

individual or enable the identification or 
authentication of an individual in combination 
with any of the other criteria set out in the WP29 
DPIA Guidelines. <\/p>\n\n\n\n

7. Processing genetic data in combination with any 
of the other criteria set out in WP29 DPIA 
Guidelines. <\/p>\n\n\n\n

8.    Indirectly sourcing personal data where GDPR 
transparency requirements are not being met, 
including when relying on exemptions based on <\/p>\n\n\n\n

impossibility or disproportionate effort. <\/p>\n\n\n\n

9. Combining, linking or cross-referencing separate <\/p>\n\n\n\n

datasets where such linking significantly 
contributes to or is used for profiling or 
behavioural analysis of individuals, particularly 
where the data sets are combined from different 
sources where processing was\/is carried out for 
different purposes or by different controllers. <\/p>\n\n\n\n

10. Large scale processing of personal data where the 
Data Protection Act 2018 requires \u201csuitable and 
specific measures\u201d to be taken in order to 
safeguard the fundamental rights and freedoms <\/p>\n\n\n\n

of individuals. <\/p>\n\n\n\n

You will see that biometric data processing is at number 6. In our opinion that DPIA should conclude that you should  offer an alternative to its employees. There is no requirement that such alternative be more convenient for the 
employees <\/p>\n\n\n\n

Brexit : this advice from August is worth repeating.  <\/strong><\/p>\n\n\n\n

Are you an Irish company that transfers personal data to the UK?   <\/p>\n\n\n\n

\"Reserved:The proposed withdrawal agreement would have preserved the status quo in data  protection terms, at least until the end of the transition period in December 2020.  However, if the U.K. leaves the EU without a deal, the implications for <\/p>\n\n\n\n

international data flows and privacy compliance generally will be severe.  Without  additional actions, UK based processing of EU personal data will be illegal. <\/p>\n\n\n\n

How to ascertain ways you might be transferring data to a UK-based company <\/strong><\/p>\n\n\n\n

\u2022 Are you outsourcing your HR, IT or Payroll function 
to a UK based organisation?  <\/p>\n\n\n\n

\u2022 Are you using a UK based marketing company to 
send marketing communications to your customer <\/p>\n\n\n\n

database? <\/p>\n\n\n\n

\u2022 Is your pension scheme based in the UK? <\/p>\n\n\n\n

\u2022 Are you using a UK based company to analyse data 
on visitors to your website?  <\/p>\n\n\n\n

In a ‘No Deal’ Brexit scenario you will need to put extra 
measures in place to legally transfer this data.  EU based 
data controllers are not permitted to transfer personal data  outside the EU\/EEA unless those standards are maintained.  In a \u201cno-deal\u201d Brexit scenario, the UK will no longer be <\/p>\n\n\n\n

a member of the EU; instead, it will become a \u2018Third 
Country\u2019.  It will have to look for an Adequacy Ruling <\/p>\n\n\n\n

like Japan in time. This means that transfer of personal <\/p>\n\n\n\n

data from Ireland to the UK will be treated in the same <\/p>\n\n\n\n

way as transfers of personal data to countries like <\/p>\n\n\n\n

Australia or India etc. <\/p>\n\n\n\n

What this means in practice is that, in order to comply <\/p>\n\n\n\n

with GDPR rules, an Irish company intending to <\/p>\n\n\n\n

transfer personal data to the UK will need to put in <\/p>\n\n\n\n

place specific safeguards to protect the data in the <\/p>\n\n\n\n

context of its transfer and subsequent processing. <\/p>\n\n\n\n

<\/td><\/tr>
<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Recent Cases from around the world <\/strong><\/p>\n\n\n\n

\u2022 Are you storing or processing data in the UK on a 
server or in the cloud? <\/p>\n\n\n\n

\u2022 Are you using web-based tools provided by or via 
UK resources? <\/p>\n\n\n\n

This can be done in a number of different ways, 
depending on the circumstances in which the data is 
to be transferred. One such way is the use of 
\u201cStandard Contractual Clauses\u201d or \u201cSCCs\u201d  or\u201d Model 
Clause Agreements \u201cand this is likely to be relevant to  most Irish businesses that transfer personal data to 
the UK.  <\/p>\n\n\n\n

The Model Clause Agreements consist of standard or  template sets of contractual terms and conditions that  the Irish-based controller and the UK-based recipient  both sign up to. The basic idea is that each of the 
parties to the contract gives contractually binding 
commitments to protect personal data in the context  of its transfer from the EU\/EEA to the Third Country. 
Importantly, the data subject is also given certain 
specific rights under the SCCs even though he or she is  not party to the relevant contract.<\/p>\n\n\n\n

Recently the data protection authority of North Rhine \u2013 Westphalia in Germany 
has brought the matter into sharp focus into an investigation into the car industry. <\/p>\n\n\n\n

It pointed at the following: \u2013 <\/p>\n\n\n\n

1. Vehicle data can be considered personal data if it can be linked to the 
customer\u2019s name, or to a vehicle identification number; 
<\/p>\n\n\n\n

2. Data processing by a garage necessary for repair, service and maintenance including data transmission to the 
manufacturer is legitimate where that is necessary for the purpose of fulfilling a contract to which the data 
subject is party, but even in such circumstances the exact nature of the processing must be made clear to the 
data subject.  The recommendation was that this be done at the time of the order, in an addendum to order 
documents; <\/p>\n\n\n\n

3. The data protection authority was more sceptical of transmission of personal data to manufacturers.  In 
particular, it formed the view that the garages and manufacturers were possibly both joint controllers of the <\/p>\n\n\n\n

personal data; <\/p>\n\n\n\n

It seems that the automotive industry is now becoming a focus for data protection, and that the data protection  
commission here will be aware of this German investigation, as there is a regular formal coordination process 
between all of the data protection authorities in the EU.  We can expect that the DPC will be considering launching its  own investigation, now that a large proportion of the work involved has already been done in Germany. <\/p>\n\n\n\n

Department of Social Protection, the DPC has directed  that the department cease processing applications for <\/p>\n\n\n\n

Breaking news in Ireland <\/strong><\/p>\n\n\n\n

We explained in our August Newsletter that the State  has been told it must delete data held on 3.2 million 
citizens, which was gathered as part of the roll-out of  the Public Services Card, as there is no lawful basis for  retaining it. <\/p>\n\n\n\n

In a report on its investigation into the card, the Data  Protection Commission found there was no legal 
reason to make individuals obtain the card in order to  access State services such as renewing a driving 
licence or applying for a college grant. <\/p>\n\n\n\n

While the card will still be sought from people 
accessing some services directly administered by the <\/p>\n\n\n\n

cards needed for such functions. <\/p>\n\n\n\n

https:\/\/www.dataprotection.ie\/en\/dpc-statement-<\/a> matters-pertaining-public-services-card <\/a><\/p>\n\n\n\n

The Minister has now said she is going to challenge  any outcome arising from the findings. The report is  below: <\/p>\n\n\n\n

\nhttps:\/\/www.welfare.ie\/en\/pdf\/pr170919.pdf\n<\/div><\/figure>\n\n\n\n

It seems that the government is waiting for the DPC to  issue a prosecution or fine, before reacting, so we will  have to await any such prosecution or fine and the 
inevitable Appeal\/Judicial Review.  
<\/p>\n\n\n\n

Polish DPA imposes \u20ac645,000 fine for insufficient organisational and technical safeguards which led to personal  data of 2.2 million data subjects being breached. <\/strong><\/p>\n\n\n\n

In the decision imposing the fine, the Polish DPA concluded that the company by  failing to comply with the required technical means of data protection, had 
breached, inter alia, the principle of confidentiality, as set out in Article 5 (1)(f) of  the GDPR. Therefore, there had been unauthorised access to and obtaining of 
customers\u2019 data. The authority considered that unsuccessful measures for the 
authentication of data access were put in place. The company had implemented  additional technical security measures after the breach. 
<\/p>\n\n\n\n

The investigation revealed that the infringement occurred also because of ineffective monitoring of potential risks. <\/p>\n\n\n\n

https:\/\/edpb.europa.eu\/news\/national-news\/2019\/polish-dpa-imposes-eu645000-fine-insufficient-organisational-<\/a> and-technical_en <\/a><\/p>\n\n\n\n

Google wins landmark right to be forgotten case <\/strong><\/p>\n\n\n\n

The Court of Justice of European Union on 24 September 2019 has agreed with the earlier decision of the Advocate 
General (on 10 January 2019) in its ruling on this landmark case and found that the “Right to be Forgotten” as applied  to Google search results only applies within the EU. Therefore, only domain names corresponding to EU Member 
States may be dereferenced TOGETHER WITH geo-blocking preventing all access to that partially dereferenced 
material from within the EU.  <\/p>\n\n\n\n

This case was decided on jurisdictional grounds. It can just about be distinguished from Article 3.2 which does confer  extra-territorial jurisdiction, as that extra-territorial jurisdiction is only in the context of the sale of goods or services,  or of the monitoring of the behaviour of data subjects. <\/p>\n\n\n\n

It does make the Right to be Forgotten of only very limited use, as the information can now be accessed by technical  means or simply by accessing the information from outside the EU. <\/p>\n\n\n\n

ECJ Decision 24 September 2019 <\/p>\n\n\n\n

http:\/\/curia.europa.eu\/juris\/document\/document.j<\/a> sf?text=&docid=218105&pageIndex=0&doclang=EN<\/a> &mode=req&dir=&occ=first&part=1&cid=1162593 <\/a><\/p>\n\n\n\n

Advocate General\u2019s Decision 10 January 2019 <\/p>\n\n\n\n

http:\/\/curia.europa.eu\/juris\/document\/document.j<\/a> sf?docid=209688&mode=req&pageIndex=1&dir=&o<\/a> cc=first&part=1&text=&doclang=EN&cid=1162593<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Biometric Data processing.  To be legally compliant with data protection law, an employer must have a  \u201clawful basis\u201d or justifiable reason to process an employee\u2019s personal data.   Ordinarily, under the GDPR, these reasons could include:   a) employee consent;   b) where the processing is necessary for the performance of  a contract to which the data subject …<\/p>\n

Newsletter September 2019<\/span> Read More »<\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":""},"coauthors":[],"author_meta":{"author_link":"https:\/\/www.bizlegal.eu\/?author=3","display_name":"Sharon McGauley"},"relative_dates":{"created":"Posted 6 years ago","modified":"Updated 6 years ago"},"absolute_dates":{"created":"Posted on 24\/05\/2020","modified":"Updated on 24\/05\/2020"},"absolute_dates_time":{"created":"Posted on 24\/05\/2020 9:56 am","modified":"Updated on 24\/05\/2020 9:56 am"},"featured_img_caption":"","featured_img":false,"series_order":"","_links":{"self":[{"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/pages\/2547"}],"collection":[{"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2547"}],"version-history":[{"count":1,"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/pages\/2547\/revisions"}],"predecessor-version":[{"id":2548,"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=\/wp\/v2\/pages\/2547\/revisions\/2548"}],"wp:attachment":[{"href":"https:\/\/www.bizlegal.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}