#53: ECJ does not get Nordics, TikTok "ban" and AI Act approved

Get ready for a super META conversation—no, not about social media, but about who we are and what we really do. Milla and Laura are joined by the privacy guru herself, Natalija Bitiukova (Head of Privacy at Carlsberg). They almost spent the entire episode talking about beer, but once they tapped into Natalija’s epic level of privacy geekdom, the focus shifted back to our roles in the privacy world. Stick around until the end, and you’ll be treated to the story of the most romantic gift in the universe (hint: “the world” just doesn’t cut it). There’s a lot to unpack in today’s chat, so take notes—what you agree with, disagree with, or just find hilariously nerdy—and we’ll do a future episode where we read your comments and dive deeper. Grab your earbuds and let’s get META!   LINKS: Natalija’s hobby: https://streamlex.eu/  EDPB survey on DPO: https://www.edpb.europa.eu/news/news/2024/edpb-identifies-areas-improvement-promote-role-and-recognition-dpos_en     Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]  

The world of privacy and AI shook and trembled when Hamburg's Data Protection Authority published its edgy discussion paper on Large Language Models (LLM). In a nutshell, they stated that LLMs do not store personal data and that this is in line with the CJEU’s views. Milla and Pilvi were honored and humbled (=overly excited with fangirl-hats on) to have Dr. Markus Wünschelbaum, Policy and Data Strategy Advisor at the Hamburg Data Protection Authority, to discuss what’s this all about. And what a discussion this ended up being!  Markus takes our (and your) hands and walks us all through the discussion paper’s key points and how the DPA ended up with this view: From the technical key points (it’s all about probabilities) all the way to the legal gymnastics and philosophy. On the other hand we also discuss what the result and impact would be if we would take the stance that LLMs do in fact store personal data and if that would actually make any sense. And what about NOYB’s complaint on OpenAI?  All this and much, much more awaits all our 6 listeners in this episode that you should not miss. After the recording our hosts needed a moment to gather themselves from all the excitement. We tried to be tough journalists but how can you not get excited about all this. We love DPAs with edgy action and hot tea to serve. Sorry about that. BUT IT WAS TOO FUN!    Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected] Links: In German: https://datenschutz-hamburg.de/news/hamburger-thesen-zum-personenbezug-in-large-language-models   In English: https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/240715_Discussion_Paper_Hamburg_DPA_KI_Models.pdf  

In this episode, Jyri, Milla, and Pilvi walk  you through the latest hottest tea in privacy and data protection. First, we turn our attention to the herald of doom itself: Clearview and the actions taken by the Dutch Data Protection Authority (fine of 30,5 million euros and then some). Will the Dutch DPA follow through with going after the management and inflict personal liability the managers or directors of Cleaview? We also explore whether such a grim herald can have any positive aspects. The Dutch DPA suggests that the government could create its own version of Clearview, raising an important question. Should we, as a human society, pursue every technological capability simply because we can? Next, we visit the herald of digital future and all things beautiful, that is of course Sweden. The Swedish data protection authority, IMY, has given out two fines for unfortunate use of Meta pixels by a pharmacy and a bank that led to leaking sensitive personal data to Meta. The cases have some meme aspects (legal said no) but also raise up important questions: what is the root cause? Could Meta’s way of enrolling in updates be the one to blame? What steps to take to ensure your organization’s compliance? Then, we take a look at the latest blog by Anu Talus, the Finnish Data Protection Ombudsman and the the Chair of the European Data Protection Board. She admires Sweden (don’t we all?), who seems to thrive under the GDPR rules whereas Finland’s Data Protection Authority remains under-resourced, raising concerns about its ability to support future demands. She distinctly calls out for the ability to fine the public sector also in Finland (one of the few countries where this isnt possible), and discusses the AI Act. Lastly, we dive into a fast-paced Lightning Round™ of key data protection developments. From the Belgian DPA’s crackdown on dark patterns in cookie consent to fines against Uniqlo by the Spanish DPA (AEPD), and a penalty for Vejen Municipality in Denmark over stolen school laptops, important actions are shaping the landscape. We also explore Liechtenstein’s insights on remote work and This and much more (such as some tips on who to follow on LinkedIn) awaits behind the play-button! Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]   Links: Clearview fine: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition   Swedish Meta Pixel cases: https://www.imy.se/nyheter/sanktionsavgift-mot-avanza-for-overforing-av-personuppgifter-till-meta/ https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/   Anu Talus’ blog: https://tietosuoja.fi/-/tekoaly-hoi-missa-suomen-digistrategia-   Belgian DPA’s cookie case: https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-113-2024-van-6-september-2024.pdf   Uniqlo fine: https://www.edpb.europa.eu/news/national-news/2024/spanish-supervisory-authority-fined-uniqlo-europe-ltd-violations-article_en   Vejen Municipality fine: https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/aug/endnu-en-kommune-indstillet-til-boede-for-manglende-kryptering   The DPA of Lichtenstein’s activity report for 2023: https://www.datenschutzstelle.li/application/files/3417/2526/0394/WEB_Datenschutzstelle_Taetigkeitsbericht_2023.pdf  

See how we get back to podcasting after the brat summer? Very demure, very mindful. We are not like these other podcasts, we don’t come back for the new season with a half-planned episode, we don’t use chatGPT to make notes, we don’t record too long episodes where half of it is just giggling–we’re very mindful, very considerate, very cutesy. In today’s very considerate episode Jyri, Milla, and Pilvi walk you through the most interesting news from the summer, such as the mega fine of €13,9 million given by the the Czech Supervisory Authority to a cyber security company that shared data of 100 million data subjects to its subsidiaries in a not very mindful way. We also discuss the latest drama on the EU Commission’s Preliminary DMA Findings on Pay or Consent as well as Meta suing the EDPB that is very interesting, very cutesy.  We also take a look at the secret collaboration between Meta and Google to target ads at 13–17-year-olds and have a discussion on what’s the harm in this? Is it really a problem or are we just trying to hold on to a world that is not realistic? We are not like these other privacy people–we don’t just gush about this–we explore different perspectives and play devil’s advocate. Very mindful, very considerate, very demure. These and much more in this episode where we do not try to play too much slightly off pitch on the hottest meme by the amazing @joolieannie , we’re very considerate, very funny, very cutesy, very mindful, and most certainly very demure.    Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected] Links: Big fine in Czech: https://www.edpb.europa.eu/news/news/2024/czech-sa-imposed-fine-139-million-eur-infringement-art-6-and-art-13-gdpr_en   EU Commission and Pay or Consent: Commission sends preliminary findings to Meta over its “Pay or Consent” model for breach of the Digital Markets Act - European Commission (europa.eu)   Meta and Google not very demure collaboration: https://www.ft.com/content/b3bb80f4-4e01-4ce6-8358-f4f8638790f8   NOYB annual report Annual_Report_2023_EN.pdf (noyb.eu)   Scraping and OpenAI: Microsoft Word - 2024.08.02 FINAL OpenAI Complaint (2) (courtlistener.com) https://www.legaldive.com/news/nvidia-open-ai-face-youtube-creator-lawsuits-for-using-online-videos/724498/  

Prepare to get your mind blown (and not necessarily in a good way) - in this episode Laura, Floora, Pilvi, Milla and Hannes (what a full house!) discuss the theory and practice behind data processing roles.  What is the background of the roles, what is working and not working - why does CJEU want everyone to be joint controllers, what about the AI Act and much more. If you bear with us to the very end we even throw in some suggestions on how to develop a less complex life for the many privacy professionals. linkit: EDPB guideline on controller and processor: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en  CJEU, judgment of July 10, 2018, Jehovan todistajat, C‑25/17, EU:C:2018:55 https://curia.europa.eu/juris/document/document.jsf?text=&docid=203822&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1305431 CJEU; judgment of June 5, 2018, Wirtschaftsakademie Schleswig-Holstein, C‑210/16, EU:C:2018:388 https://curia.europa.eu/juris/document/document.jsf?text=&docid=202543&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1305548  CJEU, judgment of July 29, 2019, Fashion ID, C‑40/17, EU:C:2019:629 https://curia.europa.eu/juris/document/document.jsf?text=&docid=216555&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1305826    Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Cambridge Analytica, Brexit, Trump, Russian Trolls. Political microtargeting has shaped the world and our society more and longer than we would like to admit. The European Union decided to fight back on it with Regulation on the transparency and targeting of political advertising, yet the road to the regulation was everything but smooth. Time will tell how or if the regulation will be able to actually make a difference. On this episode, Milla and Pilvi are going back to this important subject with our very special guest, privacy influencer and an Estonian lawyer Norman Aasma, who wrote his master thesis on the subject. Together we will discuss the road to the regulation, what was the issue with banning the use of sensitive personal data, what does the regulation actually regulate, and what change we can expect it to make.  The episode was recorded on the 27th of May 2024, just before the EU Elections, and thus, we also discuss the current EU Elections and take a brief look at the political advertising taking place (or the lack of it…). We compare it to the research data and results that we have gained from conducting research on the Finnish elections (see our Finnish podcast TietosuojaPod episodes #66 and #52).  So hit play and join us to enjoy a moment in privacy!   Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]

“Welcome! Welcome! Welcome! To PrivacyPod Joost’s Case Corner Episode, we are your hosts Milla and Pilvi with Joost Kle… Gerritsen. Thank you so much for joining us and let us begin with our first and most important story, the events of last week’s Eurovision and the big denim egg that made it all the way to “Last Week Tonight” with John Oliver (Go Finland!).”  After we have gathered ourselves from the too short (Panu’s comment which has been noted) section on Eurovision, we move head first to the most interesting recent CJEU cases! And what is on the chopping block today? CJEU NADA and Others [C-115/22], where doping results were published online.  CJEU Juris [C-741/21], where a lawyer wanted to be compensated on receiving direct marketing which for some reason made some of our hosts just lose it (sorry). CJEU IAB Europe [C-604/22], where our focus is on the joint controllership aspect of the case. Thank you so much for listening and good night! Links: Belgian DPA’s Decision on IAB Europe:  decision-quant-au-fond-n-21-2022-en.pdf (autoriteprotectiondonnees.be) CJEU NADA and Others [C-115/22]: https://curia.europa.eu/juris/document/document.jsf?text=&docid=285723&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2737812 CJEU Juris [C-741/21]: https://curia.europa.eu/juris/document/document.jsf?text=&docid=284641&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2738131   CJEU IAB Europe [C-604/22]: https://curia.europa.eu/juris/document/document.jsf?text=&docid=283529&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=2738315   Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]  

We’re so glad to geek out on something a bit different this week, as we welcome Natallia Karniyevich to discuss all things cyber with our hosts Hannes Saarinen and Milla Keller. Natallia is a senior associate at Bird & Bird, where she also co-chairs Bird & Bird’s international cybersecurity steering group.  Natallia guides us through what has been a flood of new, stricter cybersecurity legislation. We discuss the background and need behind the new laws. We look a bit closer specifically at the NIS2 Directive, which brings tighter requirements to many different kinds of organizations. And ofcourse, we discuss what do these new laws mean for privacy professionals: how does cyber intersect with the GDPR?     Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]  

We have good news and bad news. Good news are, we are returning with Joost’s Case Corner, so expect lots of CJEU goodness from this episode. Bad news are, we get pretty distracted by other (equally important) topics before actually getting to the CJEU privacy cases… But don’t worry, whatever recent case law we didn’t cover in this episode, we’ll come back to in another episode in a few weeks! Ok, so what do we discuss in this episode? We had to start with EDPB’s Pay or Consent Opinion, as that is the most exciting piece of news from last week. Related to that, we also dare to talk about the Advocate General’s Opinion in the C-446/21 Schrems v Facebook case - even though the AG Opinion was only published after we recorded the episode.  The CJEU cases we cover in this episode are: CJEU Belgian State – Data processed by an official journal [C-231/22] CJEU Gesamtverband Autoteile-Handel [C-319/22] CJEU FT – Copies of medical records [C-307/22] CJEU Ministerstvo zdravotnictví – COVID-19 mobile application [C-659/22] (Upcoming on 7 May 2024) - CJEU NADA and Others [C-115/22]   Did you enjoy our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]

Laura and Panu are joined by Otto Lindholm to discuss recent CJEU case related to Finnish transparency laws and disclosing criminal conviction data via telephone. What is the Finnish tradition of transparency of official documents really about, are we now losing it and what’s going to happen? If you ask Panu, doomsday is upon us. Transparency is dead and criminals, politicians and reality tv contestants will run amok with no accountability. Or then its just a storm in a tea cup. Panu does make a lot of mistakes, such as reads the European Charter of Fundamental Rights wrongly. In other news, but no less important, the Court actually states that oral transfer of data from a filing system is processing of personal data. Did you see that one coming? The cool privacy kids did, Panu did not.  The discussion twists and turns and reaches some kafkaesque levels but who cares - privacy theory is fun.   Hope you enjoyed our show? Support us by buying us a coffee here: https://bmc.link/privacypod4u We would love to get feedback – so please tag us, follow us, DM us, or send us traditional email: Twitter: https://twitter.com/PodPrivacy, #privacypod Instagram: @privacypod LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/ Email: [email protected]