Dashcams have become increasingly popular in recent years and a built-in dashcam is now the most sought-after feature among car buyers. Buyers' primary motivation is self-explanatory: recorded footage can be used as evidence in case of an accident. However, whether dashcams are incompatible with privacy and data protection law and thus illegal on Austrian roads is a tricky question.
Parliament recently enacted the Third, Fourth and Fifth COVID-19 Acts. Although these laws have significantly changed the Austrian legal framework, none of them include data protection provisions. Thus, the legislature appears to have overlooked a significant data protection issue arising from the new law – namely, the conflict of interests between the amended Social Insurance Act and the EU General Data Protection Regulation.
Due to the COVID-19 pandemic, telecoms providers must now send mass alerts (eg, regional access prohibitions) via text message on order of the government and provide traffic and location data for the purposes of evaluating whether individuals are complying with quarantine orders. In addition, a number of legislative developments have taken place with respect to data protection. This article outlines these recent changes.
With the adoption of the EU General Data Protection Regulation, the EU legislature intended to strengthen the rights of individuals (ie, data subjects or applicants) by giving them greater control over how their personal data is used. Applicants must be informed of the processing of their personal data and be able to verify whether such processing is lawful. Accessing documents is not necessary to achieve that goal. This view is supported by two recent Austrian decisions.
'Influencer marketing' means taking advantage of bloggers and other persons who have their own social media channels to promote goods and services. While the concept of transmitting arguably hidden advertising is problematic, there are many variations of this and the lines between hidden advertising and personal opinion are often blurred. As such, the Advertising Council recently issued guidelines for dealing with influencer marketing as a specific means of marketing communication.
The Litigation Chamber of the Data Protection Authority (DPA) recently provided welcome clarifications concerning the validity of employee consent. The DPA decided that the free consent of employees was possible and could be valid if all other conditions of Article 4.11 of the EU General Data Protection Regulation were fulfilled and that the data was collected for a specified and legitimate purpose but the purpose of the processing was not explicit.
The Litigation Chamber of the Data Protection Authority recently issued a reprimand to a hospital for its violation of an employee's access and information rights regarding an audit, which had led to the employee's dismissal. Specifically, the hospital had refused the employee access to the external expert's audit report which had formed the basis of its decision to dismiss the employee.
The Belgian Protection Authority (DPA) recently fined a social media platform €50,000 for processing personal data during the scope of a referral programme without an appropriate legal basis. This decision is particularly relevant because it was rendered on the basis of the one-stop-shop mechanism and all of the national authorities concerned validated the DPA's reasoning.
In an increasingly hostile market, companies have taken an innovative approach to advertising, seeking to ensure consumer loyalty. This has included comparing their products and services with those of competitors in an attempt to convince consumers that theirs are the best. However, is this type of advertising, which is (in theory) harmful to competitors whose products and services are shown as being inferior, allowed?
The Cayman Islands Monetary Authority (CIMA) has updated its Rule and Statement of Guidance – Cybersecurity for Regulated Entities following feedback received during a private sector consultation. The rule, which sets out CIMA's requirements in relation to the management of cybersecurity risks, is a clear and precise directive that creates binding obligations, the breach of which may lead to a fine or regulatory action being taken by CIMA.
The Supreme People's Procuratorate recently issued the Provisions on the Handling of Cybercrime Cases by the People's Procuratorates, which include general provisions, as well as provisions on the guided collection of evidence and case reviews, the review of electronic data and court attendance in support of public prosecutions. Among other things, the provisions require the people's procuratorates to strengthen the penalties handed down in cybercrime cases.
The Ministry of Industry and Information Technology recently issued the Circular on Launching the Pilot Programme on Classified and Graded Management of Cybersecurity of Industrial Internet Enterprises. The pilot programme is initially scheduled to launch in 15 provinces and aims, among other things, to perfect the rationality, effectiveness and operability of the rules, standards, classification procedures and grading for industrial internet cybersecurity.
In August 2020 the State Cryptography Administration released the Regulations for the Administration of Commercial Cryptography (Draft for Comment). The draft regulations provide that the import of commercial cryptography products on the Commercial Encryption Import Licence List and the export of commercial cryptography products on the Commercial Encryption Export Control List should be subject to the import and export licence for dual-use items issued by the State Council.
In August 2020 the Ministry of Commerce issued the Master Plan for Comprehensively Deepening the Pilot Programme on the Innovative Development of Trade in Services. The plan covers 28 provinces and municipalities directly under the central government, including Beijing, Tianjin and Shanghai. The pilot programme, which concerns cross-border data transfer security management, will run for three years.
In 2020 the Ministry of Industry and Information Technology issued the Guidelines on the Construction of a Data Security Standards System in the Telecoms and Internet Industries for public comment. According to the draft guidelines, the data security standards system for telecoms and internet industries comprises four categories: basic and general standards, critical technology standards, security management standards and critical field standards.