Bytesize Legal Update: Automated decision making back in the spotlight

In our latest Bytesize Legal Update, Fieldfisher's James Russell and Richard Lawne unpick what the key headlines are, what are the top 5 changes that will impact businesses, and in practical terms what that means businesses operating in the UK need to do.Read more here.

In the recent case C 203/22 (Dun & Bradstreet Austria), the court of Justice has returned to the issue of automated decision-making and provided some useful clarification on what information needs to be disclosed about this kind of data processing to data subjects – in particular, addressing the question of how these obligations interact with trade secrets rules.In our latest Bytesize Legal Update, Fieldfisher's James Russell and Richard Lawne unpick what the court decided, how this decision adds to the previous caselaw like SCHUFA, and ultimately what this means for companies that use automated decision-making as part of their business.Read more here.

The Fieldfisher Silicon Valley team delve into the final decision issued by the UK Information Commissioner's Office (ICO) in relation to Snap's data protection impact assessment (DPIA) for its MyAI chatbot. Megan Ward and Hannah El Gazzar discuss how Snap's initial DPIA fell short of the UK GDPR requirements and why the ICO concluded that Snap's revised DPIA was compliant, and highlight the learning points for organisations conducting DPIAs, particularly when that DPIA relates to AI powered features.  

It's finally here - the EU's Artificial Intelligence Act (EU AI Act) has now been published in the Official Journal of the European Union and will enter into force on the 1st of August 2024. So what happens now?In this episode, we explore what the timeline for implementation of the Act looks like, what are the priorities businesses need to be considering now, and what steps they can be taking now in order to prepare. Cutting through hundreds of pages of new law, Fieldfisher's  Flick Fisher, Richard Lawne, and James Russell distill down the key takeaways and outline the critical next steps for businesses.

On April 17, 2024, the European Data Protection Board (EDPB) published its guidance on "consent or pay" models implemented by large online platforms for behavioral advertising. The headline is that, in the EDPB's opinion, in most cases it will not be possible for large online platforms using "consent or pay" models to demonstrate that they have obtained valid consent under European data protection law to process an end user's data for the platform's behavioural advertising purposes.   In this episode, Fieldfisher's Felicity Fisher and Megan Ward unpick the EDPB's guidance and discuss what it means for online platforms using "pay or OK" models for targeted advertising. 

In this episode of Fieldfisher's Bytesized Legal Updates podcast, James Russell and Paul Lanois, technology and data specialists at Fieldfisher Silicon Valley, discuss the UK's recent guidance on loot boxes in video games. They explore the industry's self-regulatory approach, transparency standards, probability disclosures, and responsible play. The guidance, which provides 11 principles, aims to bring clarity to the legal grey area surrounding Loot Boxes. James and Paul highlight the potential impact on businesses, the need for compliance, and the broader implications of data protection and advertising regulation. Don't miss this informative discussion on the key legal developments in technology and data protection law.

The recent guidance issued by the Spanish Data Protection Authority (DPA) on cookies proposes a new exemption for analytics cookies used for strictly limited first party anonymised and aggregated statistical purposes.  In this episode of Fieldfisher's Bytesize Legal Update podcast, legal advisor Pardeep Dhanoya and senior associate Andrea Ortega provide an overview of the EU and UK cookie rules and explain what cookies are exempt from user consent. They also outline how the recent guidance from the Spanish DPA sits in the framework of existing cookie rules and guidance, what it changes, and what the conditions are to qualify for the exemptions with some specific examples. 

The French data protection authority, the CNIL, has fined Amazon France Logistique €32 million for its use of excessively intrusive employee monitoring systems and failing to provide transparency and adequate security to personal data in relation to the use of video surveillance systems, in breach of the GDPR. In our latest Bytesize Legal Update, Fieldfisher's Moira Campbell and Eilish Beeby discuss the key takeaways from the decision and what the practical implications are for businesses. 

The FTC's proposals to amend COPPA and the updated Information Commissioner's Opinion on Age Assurance, are just two of the most recent updates in the area of Age Assurance.  With governments and regulators heavily prioritising children's data and their online safety, understanding when you need to implement Age Assurance and how to select the most appropriate method for your business is increasingly important. In this Bytesize Legal Update, Fieldfisher's James Russell and Lorna Cropper explore the key influences in this area as well as the main practical takeaways for any business or organisation that is likely to be accessed by children.

The recent ruling by the Court of Justice of the European Union (CJEU) decision in the Lithuanian Ministry of Health case grapples with the definition of "controllership" under the GDPR. In this case, nearly 4,000 users' personal data had been collected by a Covid-19 mobile app released to the public without the Lithuanian Ministry's express approval, and yet the Lithuanian ministry were still held liable for the processing. In this Bytesize Legal Update Fieldfisher's James Russell and Richard Lawne explore the key factors that led to the court's decision;  as well as the key practical takeaways for both controllers and processors.