Dec 22019

EDPB Stakeholder Event Highlights Continued Confusion over Data Subject Rights Compliance under the GDPR

William RM Long, Francesca Blythe and Jasmine Agyekum
, ,

On 4 November 2019, the European Data Protection Board (EDPB), the EU-wide data supervisory authority, held a stakeholders’ event on data subject rights under the GDPR. At the event, various stakeholders including e.g., corporates and NGOs, raised a number of issues including, for example:

  • Overall confusion around the scope and applicability of data subject rights. Stakeholders noted some requests were too broad, in turn, making it difficult to identify which data subject right was being exercised (e.g., erasure, objection or access);
  • Difficulties identifying data subjects, in particular children;
  • How to reconcile compliance with Article 12 of the GDPR (the requirement for information to be provided to data subjects in a concise, intelligible and easily accessible manner) and Article 15 (the requirement to provide extensive information to data subjects on the processing of their personal data);
  • Where technical data concerning a data subject is collected (e.g., clickstreams and page interactions), how this should be provided to data subjects in an accessible way;
  • How controllers can delete personal data and, if requested, prove to data protection authorities that personal data has been deleted; and
  • What is the burden of proof for compelling legitimate interest grounds in order to rebut the application of the right to object.

The wide-ranging concerns raised by stakeholders before the EDPB highlight the confusion organisations face in responding to data subject requests. Upcoming guidance to be developed and published by the EDPB will be welcomed in providing much needed clarity and a streamlined and best practice approach for organisations, who are receiving an influx of data subject requests since the entry into force of the GDPR.

William RM Long

London

wlong@sidley.com

Francesca Blythe

London

fblythe@sidley.com

Jasmine Agyekum

jagyekum@sidley.com

You might also like
UK’s New Pro-innovation Approach to Regulating Digital Technologies

On 15 March 2023, the UK Government published, alongside its Spring Budget, a report on the Pro-innovation Regulation of Technologies Review (the “Report”). The Report was led by the government’s Chief Scientific Advisor and National Technology Officer, Sir Patrick Vallance, who was tasked with “bringing together the best minds to advise how the UK can better regulate emerging technologies, enabling their rapid and safe introduction.” In response, the UK Government has accepted all of the Report’s recommendations, and set out some next steps for their implementation.

U.S. Employers Need to Reconsider Use of Confidentiality and Nondisparagement Provisions in Light of New NLRB Decision

Employers frequently seek to include confidentiality and nondisparagement provisions in severance agreements provided to departing employees. Last week, the U.S. National Labor Relations Board (NLRB or Board) significantly altered the legal landscape governing such provisions, making it much more difficult for unionized and nonunionized employers alike to use them for nonsupervisory employees without running afoul of the National Labor Relations Act (NLRA). The decision is likely to be appealed, and we will issue updates as they become appropriate. In the interim, however, it is critically important for employers to understand the implications of the decision (see below) and to adjust their use of these provisions to limit their risk.

New FTC Guidance for Mobile Health Apps

Healthcare providers, health plans, and technology companies that use mobile health apps to access, collect, share, use, or maintain information related to an individual’s health should take note of the recently issued Federal Trade Commission (FTC) Mobile Health App Interactive Tool. The purpose of the tool is to help mobile health developers determine the federal regulatory, privacy, and security laws and regulations that may apply to the use of a consumer’s health information, such as information related to diagnosis, treatment, fitness, wellness, or addiction. While the tool should not be considered legal advice and cannot guarantee compliance with legal requirements, it can help healthcare providers, health plans, and technology companies issue-spot to manage risk in this heavily regulated space.