{"id":6001,"date":"2022-08-16T09:48:44","date_gmt":"2022-08-16T07:48:44","guid":{"rendered":"https:\/\/s8.tgin.eu\/?p=6001"},"modified":"2024-01-23T14:23:25","modified_gmt":"2024-01-23T13:23:25","slug":"data-protection-digest-16082022-commercial-surveillance-sensitive-data-by-comparison-worker-electronic-monitoring","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/data-protection-digest-16082022-commercial-surveillance-sensitive-data-by-comparison-worker-electronic-monitoring\/","title":{"rendered":"Data protection & privacy digest 2 – 15 Aug 2022: commercial surveillance, sensitive data \u201cby comparison\u201d, worker electronic monitoring"},"content":{"rendered":"\n

TechGDPR\u2019s review of international data-related stories from press and analytical reports.<\/em><\/h4>\n\n\n\n

Legal processes: commercial surveillance, sensitive data \u201cby comparison\u201d, workers electronic monitoring, farming data<\/h4>\n\n\n\n

The CJEU\u2019s recent decision may have a major impact on digital services that use background tracking and profiling to target users with behavioral ads<\/a>, TechCrunch reports. The EU top court\u2019s decision related to the anticorruption law in Lithuania. It found out that the country\u2019s law covering online disclosure of data contained in the declaration of private interest of directors\u00a0of institutions receiving public funds, (data concerning the declarant\u2019s spouse, cohabitee, partner, etc.), is contrary to the fundamental rights to privacy and data protection in the EU.\u00a0The court believes disclosure online of relatives and associates\u2019 names and their significant financial transactions is not strictly necessary for the objective pursued and may constitute highly sensitive data<\/a> “by comparison”. <\/p>\n\n\n\n

It is likely to reveal information of sensitive aspects of the private life of the persons concerned and to make it possible to draw up a particular detailed portrait of them, such as their sex life and sexual orientation, (Art. 9 of the GDPR). Finally, such processing results in this data being freely accessible on the internet to a potentially unlimited number of people. Thus, some privacy law experts suggest the judgement\u2019s broad definition of what constitutes sensitive data, (involving the act of comparison or deduction), potentially covers a wide range of online processing, including online ads, dating and health apps, location tracking and more, concludes TechCrunch.\u00a0<\/p>\n\n\n\n

In the US, the Federal Trade Commission, (FTC), seeks public comment ahead of ruling on the prevalence of commercial surveillance and data security practices that harm consumers<\/a>. The Commission invites comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies a) collect, aggregate, protect, use, analyze, and retain consumer data, as well as b), transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive. The permissions that consumers give may not always be meaningful or informed.\u00a0Studies have shown that most people do not generally understand the market for consumer data that operates beyond their monitors and displays, the FTC states. Many privacy notices that acknowledge such risks are reportedly not readable to the average consumer or a minor. In the end, these practices that nowadays heavily rely on automated systems may have significant consequences for consumers\u2019 wallets, safety, and mental health.\u00a0 <\/p>\n\n\n\n

The EDPS published its opinion on the proposal for a regulation regarding conversion of the Farm Accountancy Data Network into a Farm Sustainability Data Network (FSDN)<\/a>. The proposal aims to regulate the processing of personal data in the context of the collection of individual farm\u2019s economic, environmental and social data as well as the further management and use of such data. The EDPS positively notes that in case individual data will be shared by the Commission or liaison agencies, the data of the farmers and all other individual details obtained would be anonymised or pseudonymised. However the EDPS considers that the proposal does not provide a specific reason of public interest justifying the publication of personal data in identifiable form, even if the data were to be pseudonymised prior to publication. <\/p>\n\n\n\n

The EDPS therefore recommended specifying that only duly anonymised FSDN data may be made publicly available. That being said, the regulator considered it important to preserve a clear distinction between these concepts, as pseudonymous data can still be related to an identifiable individual and therefore qualifies as personal data. Moreover, the EDPS considered that it is not clear whether the proposal refers only to the exchange of data between the national liaison agencies and the Commission or also extends to the sharing of data with the general public or otherwise making it available for reuse. Finally, the interoperability provisions include the need to identify all the IT tools and linked databases, data protection roles and responsibilities and relevant applicable safeguards. Read the full opinion here<\/a>.<\/p>\n\n\n\n

Meanwhile Ontario provided updated guidance on a new legislation which includes an electronic monitoring policy for workers<\/a>. “Electronic monitoring” may include GPS systems to track employee movement, using sensors to track how quickly an employee performs a task or tracking the websites an employee visits during working hours. The policy must include:<\/p>\n\n\n\n