Sophie de Kermenguy

🚨 New EDPB Guidelines on Legitimate Interests under GDPR - Impacts on health data processing ? 📝On 8th October 2024, the European Data Protection Board (EDPB) released its Guidelines 1/2024 on processing personal data under Article 6(1)(f) GDPR. These Guidelines aim to clarify the criteria controllers must meet to lawfully rely on the legitimate interest legal basis for their data processing activities. ❗The EDPB emphasizes that the legitimate interest legal basis should neither be considered a “last resort” nor an “open door” for justifying data processing. Instead, it requires the fulfillment of three strict cumulative conditions, carefully interpreted within the broader GDPR framework. First, the controller or a third party must have a legitimate interest. Second, processing personal data must be necessary to achieve this legitimate interest. Third, the interests or fundamental rights and freedoms of the data subjects should not override the legitimate interests of the controller or a third party. ⚖️A key aspect of this legal basis is the balancing exercise—ensuring that the controller’s or third party’s legitimate interests do not override the rights, freedoms, and interests of the data subjects. This evaluation takes into account various factors, such as the nature of the processing, the categories of personal data involved, as well as the reasonable expectations of the data subjects. 💡The Guidelines also shed light on the interaction between the legitimate interest legal basis and several key data subject rights, including the right to object and the right to erasure. Additionally, they explore its application across different contexts. 💊 🧪 🩺Fundamentally, this new guideline has little to no impact on health data processing in clinical trials where the legitimate interest basis has been authorized and vetted by the EDPB in 2019 in its Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art.70.1.b)) 📱 Outside the clinical trial context, in areas like healthcare and medical apps, this new opinion provides clarification and a framework for controllers to use the balancing test to rely on this legal basis. Special caution is advised when the end users are children. https://lnkd.in/ejsiVNDp #GDPR #EDPB #DataProtection #LegitimateInterest #ClinicalResearch #PrivacyCompliance

5

Ready to tackle the #CyberResilienceAct? Read our new #CRA Step-By-Step Compliance Guide, with a foreword by Haas Avocats — thanks Gerard Haas! A comprehensive action plan in 15 steps (and 80 pages) to prepare you for the EU’s most important cybersecurity regulation for products with digital elements. 📚 This guide aims to provide a clear and practical resource for navigating the complex requirements of the regulation. It is primarily aimed at people directly involved in product security — security managers, CTOs, CPOs, architects and so on — but also legal teams and GRC managers. In short, all those who, in the course of their work, are responsible, at one time or another, for the digital security of regulated products placed on the European market. 👇 Our CRA Compliance Guide can be freely read and downloaded via the link below. You can also comment below this post to receive it by DM. >> https://lnkd.in/dckQuV_y

18

🎤 Don’t miss the DataGalaxy x Malakoff Humanis Keynote at Big Data Paris! Isaac Look & Julie Sartoretti will discuss how Malakoff Humanis guarantees GDPR compliance through effective data deletion processes using a data catalog. Key takeaways: ✅ Federating data around retention periods ✅ Organizing & controlling data purges ✅ Piloting purges in complex environments If you're attending Big Data Paris, don't miss out on this keynote! #bigdataparis

72

2 commentaires

✨ Did you know? It’s the 5th anniversary of the GDPR's application in France! The General Data Protection Regulation is the reference text protecting personal data within the European Union. ⚖️ Five years after the date to organize GDPR compliance, we’re still helping organizations maintain compliance with the regulation’s standards. Find out more about GDPR compliance at our blog: https://lnkd.in/dScAxVbh #gdprcompliance #datacatalog #datagovernance

21

Focusing on France, our ‘Data and tech’ blog series on collective actions and mass claims for non-material damages due to (alleged) infringements of the GDPR examines the mechanisms for privacy collective actions in France and how such mechanisms have been used in recent years. 📝 Jerome Philippe | Laéna Bouafy | Thomas Retière Read now: https://okt.to/XHeKyq #GDPR #Litigation #DataProtection #DataLitigationEurope

24

When two companies with the same mission join forces: Then something amazing is created! We are therefore proud and delighted to announce the official cooperation between EuroPriSe Cert from Bonn and ACTECIL from Strasbourg today. While EuroPriSe Cert focuses 100% on certification with the European Data Protection Seal, ACTECIL, as the French market leader founded in 2007, offers a broad portfolio covering all aspects of GDPR compliance for its partner companies. With the intersection of smart privacy and the mindset of seeing a strong GDPR compliance as a competitive advantage, both companies are building on a common foundation. For the two managing directors, Mr. Muschiolik (EuroPriSe Cert) and Mr. Bertrand (ACTECIL), it quickly became clear that a combination of their individual strengths would offer great potential for partner companies. From now on, even more companies will be able to benefit from a real competitive advantage if they communicate their GDPR compliance transparently and credibly to the outside world. From now on, ACTECIL will represent the European Data Protection Seal of EuroPriSe Cert in France, Luxembourg and Belgium. This allows processors in these countries to demonstrate their compliance with GDPR transparently and credibly through an accredited certification in accordance with Article 42 GDPR. For the first time, these companies finally gain the opportunity to have their actual compliance certified - and not just their management processes, as was the case with e.g. ISO 27701 until now. Here's to many successful joint projects, Franco-German friendship and many win-win situations for both companies and their partners. #europrise #gdpr #gdprcertification #article42 #france

26

3 commentaires

The CNIL highlights the risks associated with the European Cloud Certification (EUCS) allowing access by extra-territorial authorities. Emphasizing the need to safeguard sensitive data from extra-territorial surveillance laws, digital sovereignty is increasingly critical in the era of AI development. With recent concerns raised post the June EUCS update, advocating for cautious hosting of sensitive data, the dominance of major US Cloud companies in the EEA poses challenges. Lobbying efforts, backed by various Member States, have influenced the landscape. In France, the SREN law oversees hosting sensitive state data in sovereign clouds, ensuring legal protection against third-country surveillance laws. To enhance competitiveness, European sovereign clouds must offer cost-effective solutions. #cloud #CNIL #surveillance #extraterritorial #sovereigncloud #SREN

3

Are you a professional working within the privacy world? Join us for an exclusive webinar on The Future of Consent featuring Max Schrems, Chairperson of noyb.eu and renowned privacy advocate, alongside Romain Gauthier, CEO and Co-founder of Didomi. 📅 Save the Date: September 24th at 5pm CEST Agenda of the webinar:  👉 EDPB Cookie Banner Taskforce: Compliance & Privacy-by-Design  👉 Pay Or Okay Model: Current State of Regulation & Best Practices  👉 Privacy and AI: Ensuring Legal AI Use Take advantage of this opportunity to engage with industry leaders and get your questions answered in our interactive Q&A session! To register, visit the link in the comments! #Dataprivacy #Webinar #ConsentManagement

27

2 commentaires