To our valued readers of the Chronicle of Data Protection blog: we are changing how we deliver our content. As of today, we have moved the blog to a new technology platform: Hogan Lovells Engage.

We are working to make this transition as seamless as possible. For starters, Chronicle of Data Protection content will be made publicly available, at our new location on Hogan Lovells Engage. We are working on migrating old posts from the Chronicle, but until we do, they will continue to be available at https://www.hldataprotection.com.

Also, we will continue to send emails about new blog posts to current email subscribers of the blog. If you are signed up to receive emails from us, you’ll soon receive an email with details on how to use Engage to continue to stay up-to-date on the latest developments in privacy and cybersecurity, as well as on different topics published by the firm if you’d like. We also will continue to publish posts on our Twitter feed, @HLPrivacy.

We look forward to seeing you on Engage and Twitter!

The Dutch Data Protection Authority (DPA) issued a EUR 830,000 (approximately USD 937,000) fine against the Dutch Credit Registration Bureau (BKR) for violating data subject rights. The fine stems from BKR’s practice of charging fees and discouraging individuals who wanted to access their personal data.

BKR is responsible for maintaining the Dutch central credit information system, which holds information about all Dutch credit registrations and repayment behaviour by individuals, including information on insolvency, sanction screening, and publicly exposed persons registrations. The system is generally checked by various companies, including financial institutions, municipalities, payment service providers, and car lease companies (e.g., verify whether the person is eligible for a loan, mortgage, or credit card).

Under the European Union’s General Data Protection Regulation (GDPR), individuals have the right to access personal data collected about them, and to exercise that right easily and at reasonable intervals. It follows from article 12 GDPR that the controller “shall facilitate the exercise of [these rights],” and that such information should be “provided free of charge.” Where possible the controller should be able to provide remote access to a secure system which would provide the individual with direct access to his or her personal data (recital 63 GDPR).

The Dutch Data Protection Authority received complaints about the high standard BKR had set for accessing personal data. In brief, to get free access to their personal data, individuals had to send a written request via post, together with a copy of a passport. In its “GDPR Access” procedure, the BKR indicated that submitting an access request via post “would be handled within 28 days” and that it could “only be requested once a year.” For immediate digital access to their personal data or multiple access requests per year, individuals would have to subscribe with BKR for a minimum annual payment of EUR 4.95 (or higher depending on the subscription form). Multiple access requests per year were considered to have a repetitive character and therefore BKR claimed that it could charge a reasonable fee (based on article 12(5)(a) GDPR).

The Dutch DPA views that these practices violate article 12 GDPR for not facilitating the right of access (article 12(2) GDPR) and for not providing personal data free of charge (article 12(5) GDPR).

The Dutch DPA denies the arguments put forward by BKR that it considers free access to personal data once a year as reasonable, and that multiple annual access requests are considered “repetitive” without a need to assess this on an individual basis. Also its argument that allowing a one-time free access on an annual basis was legitimate on the basis of the report “ACCIS 2017 Survey of Members, Analysis of Credit Reporting in Europe,” which provided that 8 out of the responding 32 bureaus provided free access to personal data once per year only, was denied. In response, the Dutch DPA states that this report is not relevant for the implementation of the right of access and that the report cannot be used as an argument in favour of the BKR’s practices.

The Dutch DPA states that access requests may only be denied where requests from an individual are manifestly unfounded or excessive, in particular because of their repetitive character. This however, should be assessed on a case-by-case basis, which should be done at the moment the request is submitted, prior to the handling of the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

In consideration of the Dutch DPA’s fining structure, the EUR 830,000 fine consists of a fine of EUR 385,000 for violation of article 12(5) GDPR and a fine of EUR 650,000 for violation of article 12(2) GDPR. As the violations are both linked to the transparency principle aimed at giving individuals control over their personal data, the total fine is mitigated with 20% to EUR 830,000.

It’s official. The California Privacy Rights Act (CPRA) has received enough valid signatures to appear on the November 2020 ballot. And if polling from late last year remains accurate, California voters are likely to approve it. If voters approve the initiative, the CPRA would significantly expand the CCPA, establish the California Privacy Protection Agency, remove the CCPA’s cure period, and impose a number of GDPR-styled obligations on businesses, among other requirements. The substantive provisions of the CPRA would take effect January 1, 2023.

What would the CPRA do?

The CPRA would impose a number of novel obligations on businesses. We have summarized the CPRA’s key additions and modifications in this blog post. To name a few changes, the CPRA would:

• Modify existing consumer rights and grant new rights, including a right to correction, a right to limit use and disclosure of sensitive personal information, and a right to opt out of “sharing,” which the CPRA considers sharing of personal information for cross-context behavioral advertising regardless of whether consideration is exchanged
• Require businesses to enter into contracts with all entities to which the business discloses personal information
• Remove the CCPA’s 30-day “cure” period

These changes would come into effect January 1, 2023, and with the exception of the access right, would apply to only personal information collected after January 1, 2022. The CPRA would also extend the CCPA’s temporary exceptions for B2B and human resources data until January 1, 2023.

How did the CPRA come to be?

The CPRA is the latest consumer privacy ballot initiative from Californians for Consumer Privacy, a non-profit led by Celine and Alastair Mactaggart. Californians for Consumer Privacy was also behind the 2018 ballot initiative that, in a feat of last-minute deal-making, was pulled from the 2018 ballot in exchange for the enactment of the CCPA.

The organization introduced the CPRA ballot initiative in late 2019 given concerns that the CCPA did not sufficiently protect consumer privacy. The text of the proposed initiative went through several rounds of negotiations with interested parties. The final text of the CPRA was published on November 13, 2019. Californians for Consumer Privacy submitted over 900,000 signatures in support of the CPRA on May 4, 2020, and on June 24, 2020, the Secretary of State confirmed that the initiative had enough valid signatures to appear on the November 2020 ballot.

Can the CPRA be avoided through legislative revisions to the CCPA?

We will not see a repeat of 2018’s last-minute deal-making to avoid the CPRA. California’s Elections Code allows a proponent to remove only a “proposed” initiative. Initiatives are considered “proposed” until the Secretary of State issues a certificate of qualification on the 131^st day before the next statewide general election. June 25, 2020, is the 131^st day before the next statewide general election, and the Secretary of State has announced that his office will qualify the measure on June 25, 2020.

 How likely are voters to approve the CPRA?

While we will not know the results until the ballots are counted in November, preliminary polling conducted in October 2019 suggests that approximately 9 of 10 California voters would vote “yes” to support a ballot measure expanding privacy protections for consumers’ personal information. If this holds true, then CPRA—which needs only a majority vote to pass—would have overwhelming support come November.

What happens if voters approve the CPRA?

The immediate impacts on businesses will be minimal, at least until the lead up to January 1, 2023, as the CCPA would continue to be governing law until January 1, 2023.

The provisions establishing the California Privacy Protection Agency would come into effect five days after the Secretary of State certifies the election results per Cal. Const. art II section 10(a). The Agency would assume enforcement and rulemaking authority currently delegated to the Attorney General under the CCPA. The CPRA would require final regulations implementing the provisions of the act to be promulgated by July 1, 2022. Enforcement of the provisions added or modified by the CPRA would commence July 1, 2023 and would apply to only violations of the law that occur after that date

Leah Issokson, a paralegal in our Washington, D.C. office, contributed to this entry.

In the context of their return-to-work policies companies are seeking solutions to detect individuals with fever at the entrance of their premises with the aim of preventing further contamination within the buildings. This can be achieved by means of conventional thermometers, digital fever scanners directed at the forehead of the person, or sophisticated thermal camera systems. The Belgian Data Protection Authority has issued a guidance in which it adopts a strict position regarding the implications of temperature screenings for individuals’ data privacy rights. More specifically, it provides that the simple act of taking a temperature falls within the scope of the GDPR even if the temperature measurement itself has not been recorded. The guidance also provides that in light of Article 4, paragraph 2 of the GDPR, measuring temperature by means of an advanced digital process is subject to the requirements of the Regulation.

On 5 June 2020, the Belgian Data Protection Authority (DPA) issued a guidance regarding temperature screenings within the context of the return-to-work policies developed by companies following the COVID-19 pandemic. In the guidance, the Belgian DPA addresses, among others, the privacy concerns arising from different methods of temperature screening.

The DPA adopts the position that, in cases where these can be linked to an individual, temperature screening activities fall within the scope of the GDPR. This is the case even if the temperature measurement is not itself recorded. The guidance also provides that, in light of Article 4, paragraph 2 of the GDPR, measuring temperature by means of a sophisticated digital process, such as digital fever scanners or thermal cameras, constitutes automated processing of personal data.

In the guidance, the DPA recalls that a person’s temperature constitutes personal health data. It also recalls that GDPR protects personal data that are subject to automatic processing or which are intended to be included in a filing system. In the case of health data processing is, in principle, prohibited by Article 9, paragraph 1 of the GDPR subject to certain exceptions.

In order to assist companies in determining when measuring the temperature of natural persons falls within the scope of the GDPR, the Belgian DPA provides the following examples:

Situation 1: Temperature screenings without recording

According to the DPA, simple temperature readings on a conventional thermometer without the intention of recording the measurement data at a later stage, do not fall within the scope of the GDPR.

An example of this practice is the measurement of the temperature of employees for the purpose of preparing an anonymous report demonstrating the percentage of employees who present high temperature without identifying them.

Situation 2: Temperature screenings with recording

The DPA provides that if the measured temperature of employees is recorded in a file, this recording constitutes processing of personal health data and is, in principle, prohibited.

The DPA also adopts the position that measuring temperature falls within the scope of the GDPR even if the temperature measurement itself has not been recorded. A relevant example is that of employees who are denied access to the workplace following a manual temperature screening.

Even if the result of the temperature taking itself has not been recorded, the DPA notes that, in these cases, registering the absence of an employee will inevitably be linked to the file and/or identity of that employee. It must, therefore, be treated as processing of personal health data. According to the DPA, this processing falls within the GDPR and has no legal basis in Belgium.

Situation 3: Electronic temperature- screenings by sophisticated means

According to the DPA’s guidance, the GDPR does not only apply in cases where personal data are recorded in a file. It also applies in cases where the processing takes place by means of an advanced digital process.

According to the DPA’s interpretation, “processing” does not refer only to the storage of data. It also refers to any of the operations mentioned in Article 4, paragraph 2 of the GDPR when these operations are performed in an automated manner. Among these operations is the automated collection of data without subsequent storage or recording.

The DPA guidance concludes that the use of advanced digital fever scanners, thermal cameras, or other automated systems that measure the level of body temperature constitutes processing of personal health data and, therefore, it is not authorized.

Legal basis

The DPA guidance recalls that, according to Article 9, paragraph 2 of the GDPR, the processing of health data is prohibited unless the controller demonstrates a legal basis for this processing activity.

This legal basis in the employment context would be the existence of a provision of national law or a relevant collective bargaining agreement.

The DPA guidance notes, however, that there is currently no specific legal provision that would allow employers to process the personal health data of employees in Belgium.

The DPA guidance, therefore, calls upon the Belgian legislator to adopt related legislation that would allow the processing of health data if the legislator considers that temperature screenings are necessary in view of the exceptional circumstances to which the coronavirus crisis has given rise.

Vicky Vlontzou, a trainee in our Brussels office, contributed to this entry.

Last week, the U.S. District Court for the Eastern District of Virginia ordered Capital One to produce a forensic investigation report in multidistrict litigation arising out of the cyber incident Capital One announced in July 2019. The court found that the report was not protected by the work product doctrine because Capital One had not shown that “but for” the litigation the report would not have been prepared in substantially the same form. The opinion offers some lessons for companies entering into arrangements with forensic experts in advance of cyber events.

The ruling adds to a recent set of cases in which courts have taken a hard look at whether to afford protection to the work of cyber incident response service providers, including In re Dominion Dental Servs. USA, Inc. Data Breach Litig., 429 F. Supp. 3d 190 (E.D. Va. 2019), and In re Premera Blue Cross Customer Data Sec. Breach Litig., 296 F. Supp. 3d 1230 (D. Or. 2017), both of which found that post-incident investigation reports were discoverable.

These decisions are in tension with case law applying a more flexible standard to claims of attorney-client privilege or work product protection. See, e.g., In re Kellogg Brown & Root, Inc., et al., 756 F.3d 754, 760 (D.C. Cir. 2014); In re Experian Data Breach Litigation, 15-01592, 2017 WL 4325583 (C.D. Cal. May 18, 2017). This common sense approach acknowledges that there can be non-legal reasons for forensic investigation, but where the preparation for litigation is a key reason for the work, it still deserves protection. The Capital One court did not apply this approach, and it is important to understand what factors drove its analysis.

The Capital One court emphasized the following in compelling production of the Mandiant report:

• Nature of Mandiant’s services. The court found Mandiant’s incident response services would have been performed in substantially similar form even in the absence of litigation. In the court’s view, statements that Mandiant’s work “was to be ‘under the direction of Counsel’ did not alter the business purpose of the work.”
• Timing of Mandiant’s engagement. The court focused on the prior, ongoing engagement between Capital One and Mandiant, which dated back to 2015.  It also focused on the fact that the statement of work underlying Mandiant’s forensic services was signed in January 2019, which pre-dated the cyber incident.
• Payment. The court found that Capital One had designated Mandiant’s work as a “Business Critical” expense, not a “Legal” expense. The Mandiant report was paid for out of the retainer provided to Mandiant under the January 2019 statement of work, and expenses associated with Mandiant’s initial incident-related work were “paid directly by Capital One through their Cyber organization budget.” These expenses were then re-designated as legal expenses in December 2019 and deducted against Capital One’s legal department’s budget.
• Use of Mandiant’s report. The court viewed the disclosure of Mandiant’s incident report to an external accountant as “not necessarily” rising to the level of “waiver” but as evidence that the purpose of the report was not driven by the litigation and legal needs.  The court expressed a similar view about use of the report for regulatory disclosure purposes.

Although the court ordered the production of the Mandiant report, it denied without prejudice Plaintiffs’ request for access to “related materials” about the internal investigation. The court found that Plaintiffs’ motion to compel those materials was not yet ripe. It remains to be seen whether the court will open the door to discovery into Capital One’s incident response investigation more broadly.

This decision underscores several factors that are likely to influence how courts evaluate work product claims related to cyber incident investigations—from the timing of when service providers are retained, how they are retained, and how their work will be used and shared both within and outside an organization.

On June 1, The California Attorney General (CA AG) submitted the final text of the CCPA regulations to the California Office of Administrative Law (OAL) for approval. Though regulations submitted to the OAL in June ordinarily would not become effective—if approved—until October 1, the CA AG has requested an expedited review. According to the CA AG, the expedited review would allow the regulations to become effective by July 1, which still is the date his office plans to begin enforcing the CCPA according to a public statement.

The final text is unchanged from the most recent draft published on March 11, which we previously summarized. The final text also is accompanied by a revised Statement of Reasons that explains the basis for the regulations and outlines textual changes from the initial draft regulations published on October 11, 2019.

Even though we do not yet know whether the OAL will approve the final CA AG text in time for them to be effective July 1, it would still be prudent for businesses that were waiting for final regulations to proceed with updating their CCPA compliance programs.

To read our summary of the unchanged most recent draft regulations, click here. To access materials released by the CA AG to accompany the final regulations, click here.

In a decision (French only) dated 27 February 2020, the French Administrative Court of Marseille invalidated the deliberation of the Provence-Alpes-Côte d’Azur Regional Council which allowed to set up, on an experimental basis, a facial recognition mechanism in two high schools in order to (i) better control and speed up entry of students into the high schools and (ii) control access to premises of occasional visitors.

This decision is important as this is the first administrative court decision in France about facial recognition. Since the GDPR entered into force, it is also the first French administrative court decision relating to data protection not based on a deliberation issued by the French Data Protection Authority (CNIL), which was already quite uncommon before GDPR’s entry into force.

Facts and procedure

On October 2017, the President of the Provence-Alpes-Côte d’Azur Regional Council consulted the CNIL to request its assistance in setting up, on an experimental basis, a facial recognition system in two high schools in the South of France to be used at the entry and inside the premises to control access of students and visitors. Although the experiment had not been authorized by the CNIL, the Regional Council, in a deliberation (French only) dated 14 December 2018, decided to launch it. Expressly opposed to this measure, several French data protection and human and civil rights associations, including the French association “La Quadrature du Net“, filed an action for annulment of the Regional Council’s deliberation before the French Administrative Court of Marseille on 14 February 2019.

In the meantime, the Regional Council pursued its discussions with the CNIL and communicated to it the data protection impact assessment (DPIA) drafted for the facial recognition experiment. On October 29, 2019, the CNIL finally published on its website a press release (French only), in which it considered, based on the finalized version of the DPIA communicated by the regional council, that the experiment, which concerned students, most of whom were minors, with the sole aim of making access to their high schools more fluid and secure, was neither necessary nor proportionate to achieve the intended purposes.

In its decision (French only) of 27 February 2020, the French Administrative Court of Marseille took up most of the points raised by the CNIL in its press release and invalidated the decision of the Regional Council insofar as it (i) had not provided sufficient guarantees to obtain free and informed consent of students to the processing and (ii) did not demonstrate that the purpose of checking the entrances to the high schools could not be achieved by other, less intrusive means.

Key grounds of the decision

Proportionality

Although it would be practical for the high schools to implement “virtual gates” to facilitate the daily life of security guards, the Court considered that the proportionality criteria was not satisfied as controls can be carried out by less intrusive means.

The Court thus used the “less intrusive” argument which is often used by the CNIL to check whether a given solution is proportionate. It underlined therefore a lack of proportionality as it stated that other, less intrusive, means such as a badge access control or CCTV system, could be more appropriate.

Legal basis

The path taken by the administrative court to consider that the consent was not validly collected is not surprising as it reiterates the analysis table usually used to assess the validity of consent based on freely given and informed consent: the consent was collected through a simple form to be signed by high school students in a subordinate position to their respective high schools’ directors.

It is however surprising that the Regional Council relied on consent rather than another legal basis, as consent is, in several respects, simultaneously a fragile and rigorous legal basis: numerous and binding criteria for obtaining a valid consent, possible withdrawal of consent at any time, risk that the controller might not be able to carry out the proposed processing operation if the data subject does not provide consent, etc.

Processing of minors personal data

The Court remained silent on the particularity of the mechanism, namely the processing of biometric data of high school students, most of whom are minors.

This raises the more general question of the absence of a specific provision within the GDPR or the French Data Protection Act concerning the processing of sensitive biometric data of minors over the age of fifteen (defined age of minors under the French Data Protection Act, based on Article 8 GDPR), insofar as minors are presumed, irrespective of age, to be so-called vulnerable persons within the meaning of the GDPR.

Key takeaways of the decision

Experimentation does not preclude privacy requirements

The decision highlights the fact that although the facial recognition processing was still at an experimental stage, it does not preclude the application of data protection principles, in particular as it related here to sensitive data in the form of biometric data and to vulnerable persons such as minors.

Facial recognition, as innovative processing of biometric data, requires higher demonstration of compliance with privacy standards

When processing personal data in innovative ways such as facial recognition, data protection authorities expect controllers to demonstrate a high level of compliance with data protection principles due to the complexity of ensuring compliance when deploying facial recognition tools.

The European Commission, for example, stated in its White Paper on artificial intelligence adopted on 19 February 2020 that processing, gathering and using biometric data for remote identification purposes “carries specific risks for fundamental rights” and must be “duly justified, proportionate and subject to adequate safeguards”.

Appropriate legal basis for facial recognition must be examined in detail

Apart from consent, which here did not satisfy the criteria of free and informed consent, the controller could have identified its legitimate interest as the legal basis. However, that might not have been valid either.

Indeed, the CNIL already had the opportunity to decide that when biometric data processing is implemented for reasons of convenience, i.e. outside of security or public health imperatives, it cannot be imposed on the data subjects, despite the legitimate interest of the data controller (CNIL Deliberation No. 2018-012 of 18 January 2018 refusing the implementation of facial recognition processing for access control of members to the premises of a sport association).

Where there are no strong security reasons or societal issues legitimating the processing, the identification of the legal basis for the implementation of facial recognition is therefore a crucial point that requires a high level of attention.

As of today, it has not been confirmed whether the Regional Council has appealed the decision from the Court. It could still appeal as the time limit for appealing has been extended in France due to the current coronavirus pandemic.

Alexandra Antalis, a trainee in our Paris office, contributed to this entry.

The European Court of Justice (CJEU) recently published plans to issue its much awaited decision in CJEU case C-311/18 (also referred to as “Schrems II”) on July 16. The ruling will impact how organizations lawfully transfer personal data from the EEA to jurisdictions not providing an “adequate” level of data protection in accordance with the GDPR. The ruling will specifically address the validity of the European Commission’s standard contractual clauses (SCCs) and it may also affect operation of the EU-US Privacy Shield. On May 18, the European Data Protection Board (EDPB) published a report on its 2019 activities that may signal whether it plans to influence further development of this area.

Is the EDPB working on a successor for the SCCs?

Notably absent from the report is any indication that the EDPB has already undertaken work to outline general mechanisms that could survive a negative ruling from the CJEU. The annual report only indicates that the “expert subgroup” on International Transfers worked on guidance on the rules for international data transfers under Chapter V GDPR. However, it is striking that the report does not expressly mention any work of the EDPB relating to the approval of additional standard data protection clauses. Such standard data protection clauses may be adopted as an alternative to the SCCs and could therefore serve as a rescue in case of an invalidation of the SCCs in the “Schrems II” case. However, the EDPB’s program for 2019/2020 (published in February 2019) listed the work on standard data protection clauses under Art. 46(2) GDPR as one of the EDPB’ recurrent activities, which suggests that the standard data protection clauses are still on the EDPB’s agenda for the remainder of 2020.

Possible outcomes of the “Schrems II” case with regard to SCCs

Early signals in the case indicate that the CJEU may find that existing SCCs remain a valid international data transfers mechanism but there is a chance that the CJEU would (at least “partly”) invalidate not only SCCs but also the EU-US Privacy Shield Framework that offers an alternative mechanism for participating organizations to import personal data from the EEA. In its Opinion of 19 December 2019, the Advocate General of the CJEU (AG) concluded that companies exporting personal data to non-EEA jurisdictions must assess their use of SCCs by means of case-by-case due diligence for each particular transfer, in order to ensure the lawfulness of the transfer. In addition, the AG expressed “certain doubts” regarding the adequate level of data protection provided in the US, in particular considering the activities of US intelligence services. Given that the CJEU is not bound by the Opinion of the AG, most frequently discussed outcomes of the “Schrems II” case are the following:

• “Partial” invalidation of the SCCs: It is possible that, in line with the AG’s Opinion, the CJEU regards the SCCs valid in principle but rules that exporters and national data protection authorities must assess the ability of the parties to meet their relevant obligations under the SCCs, and in the absence of such practical ability, the authorities should suspend affected data transfers to certain countries. This may in particular concern data transfers from the EU to the US if the CJEU should find that the safeguards provided by the Privacy Shield are not sufficient to protect the rights and interests of data subjects in light of the surveillance activities of the US authorities.
• Complete invalidation of the SCCs: It also is theoretically possible that the CJEU rules that SCCs are completely invalid and cannot be used for international data transfers to data importers in non-EEA jurisdictions.

What to do now

With less than two months to go before the CJEU is expected to issue its ruling, the EDPB’s signal that it will take up the issue of international data transfers is welcomed. Companies that transfer personal data to jurisdictions outside the EEA should nevertheless mark July 16 on their calendars and make sure to take timely precautions that will allow them to be able to react quickly in the aftermath of the final decision of the CJEU, irrespective of whether the CJEU will follow the AG´s Opinion or invalidate the SCCs and/or EU-US Privacy Shield altogether. As a starting point, this may include the following precautions:

• Map international data flows: If not already done, such as through records of processing activities in accordance with Art. 30 GDPR, companies should map the international data transfers under their responsibility. This comprises both intra-company data transfers and data transfers to third parties, including vendors and other business partners.
• Perform adequacy due diligence: Once the relevant data flows are identified, companies should carry out case-by-case assessments of the safeguards they apply to data transfers as relevant under the GDPR. Where SCCs are used as safeguards, a more detailed assessment may be required of whether the data importer in recipient jurisdictions is able, in practice, to live up to its commitments under the SCCs by taking into account possible disclosure requests under local laws. In some scenarios, companies can also consider the use of vendor questionnaires in order to test how their service providers can help them to comply with rules on international data transfers.

Possible risk-mitigation measures

In any case, it is recommended to closely monitor the developments in the “Schrems II” case as well as the activities of the EDPB as 2020 progresses. In order to address potential risks resulting from the pending CJEU proceedings on the validity of SCCs and the EU-US Privacy Shield, companies may consider the following measures, as appropriate:

• Use “SCC plus” contract language: As a “quick-fix,” companies should assess options to address remaining concerns on the adequacy of the level of data protection in the recipient jurisdiction by the use of additional contract language. Such “SCC plus” contract language may, for instance, expressly set forth rules for the handling of government requests for access to personal data. Given that “SCC plus” language will not fully remove compliance risks and may not be accepted by all national data protection authorities, companies should simultaneously work on implementing alternative mechanisms, as outlined below.
• Rely on service provider Processor BCR: With regard to external service providers (e.g., cloud services), companies should check whether such service providers offer Binding Corporate Rules (“BCR”) for their activities as data processors. Such “Processor BCR” serve as appropriate safeguards where use of the services require international transfers to the service provider.
• Apply for approval of BCR: Companies seeking for a long-term solution for their international data transfers may consider applying for BCR to govern international data transfers within a group of companies.
• Apply for approval of ad-hoc clauses: As an alternative long-term measure, companies may also consider applying for approval of their own standard contractual clauses following Art. 46(3)(a) GDPR. Similar to the BCR, such approval is based on a coordination of the European data protection authorities, and therefore provides a high level of legal security.
• Check applicability of exemption rules: Where all else fails, it might also be possible to base a data transfer on an exemption rule listed in Art. 49 GDPR. However, the respective exemptions rules are interpreted very narrowly and will only work in exceptional scenarios, so should be avoided as a regular option.

As previously reported, Brazilian lawmakers have been debating a delay to the LGPD, which was scheduled to come into effect August 15, 2020, in response to COVID-19. The Brazilian Senate first passed Bill 1,179/2020, and Brazil’s President later enacted Provisional Measure 959 (PM 959).

On May 19, 2020, the Brazilian Congress sent to the President’s desk an amended Bill 1,179/2020 (Final Bill) that would maintain the LGPD’s August 15, 2020 effective date but would delay administrative sanctions until August 1, 2021. However, if approved, the Final Bill would still allow the LGPD’s requirements to be enforced through other means.

The journey to the Final Bill was far from direct.

The initial Senate-passed draft of the Bill (Senate Bill) would have delayed the LGPD’s effective date to January 1, 2021, and the administrative sanctions until August 1, 2021. The Senate Bill was passed on April 3, 2020, and was sent to the House of Representatives for consideration.

On May 15, 2020, the House of Representatives amended the Senate Bill (to create the House Bill). The House Bill would have delayed the LGPD’s effective date to May 3, 2021, and would have delayed administrative sanctions until August 1, 2021. The House of Representatives approved the House Bill on May 15, 2020. Because the House Bill amended the Senate Bill, the House Bill returned to the Senate for approval.

On May 19, 2020, the Senate rejected the amended timelines in the House Bill. The Senate instead approved the Final Bill, which would not delay the LGPD’s effective date but would delay only administrative sanctions until August 1, 2021. Under Brazilian legislative procedure, the Final Bill did not need approval from the House of Representatives. Once approved by the Senate, the Final Bill was sent to the President for final approval or veto.

If President Bolsonaro approves the Final Bill, it would effectively render the Provisional Measure void. The LGPD would come into effect on August 15, 2020, along with its attendant compliance obligations. While administrative sanctions would be delayed, other enforcement mechanisms would exist, including the LGPD’s private right of action and the ability of Public Prosecutors to bring actions under other provisions of law.

If President Bolsonaro vetoes the bill in whole or in part, Congress could overturn the veto. PM 959, which delayed the LGPD’s effective date to May 3, 2021, would remain in effect unless it fails to receive Congressional ratification by June 27, 2020.

So when will the LGPD come into effect?

Unfortunately it is not clear.

PM 959 is currently valid law in Brazil. This means the LGPD’s effective date is currently May 3, 2021. But if Congress does not ratify PM 959 by June 27, 2020, the provisional measure will expire and the LGPD will come into effect on August 15, 2020.

If President Bolsonaro approves the Final Bill, then the LGPD will come into effect August 15, 2020, and administrative sanctions will be delayed until August 1, 2021. PM 959 would effectively be void at this point.

If President Bolsonaro vetoes the Final Bill, then PM 959 will remain valid law until June 27, 2020, unless ratified by Congress before then.

For more information, please read our previous posts on Bill 1,179/2020 and Provisional Measure 959.

The California Privacy Rights Act (CPRA) is progressing through California’s elections process for inclusion on the November 2020 ballot. Businesses may want to begin considering how their data privacy obligations in California may change if voters enact CPRA. The purpose of this post is to summarize some of the most impactful CPRA provisions.

As we recently covered, the CPRA is a ballot measure created by Californians for Consumer Privacy, led by co-founders Celine Mactaggart and Alastair Mactaggart—chief architect of the California Consumer Privacy Act (CCPA)—to amend the CCPA and create new data privacy obligations, including some measures that appeared in a 2018 ballot initiative but did not survive the CCPA’s legislative process.

The CPRA would significantly amend the CCPA. Substantive provisions of the CPRA would become effective on January 1, 2023. Below is a summary of key additions and modifications to the CCPA’s existing obligations:

Scope

• In-Scope Businesses (modification)
  • Revises the standard to become a CCPA “business”:
    • Bases “business” determination on previous year’s activities.
    • Increases one threshold for businesses to for-profit entities who process 100,000+ consumers or households (other thresholds are unchanged).
    • Requires entities sharing common control and common branding to also share consumer personal information to be considered the same “business.”
      • “common branding” is a shared name, servicemark, or trademark such that the “average consumer” would understand the two entities are commonly owned.
• Service Providers (modification)
  • Clarifies that “service providers” cannot combine personal information collected as a service provider with information received from other businesses or collected in the service provider’s “business” capacity (subject to exceptions).
• Employee and Business-to-Business Exemptions (modification)
  • Retains the CCPA’s exceptions for personal information collected in the employment and business-to-business contexts and extends their sunset provisions to January 1, 2023.
• Deidentified (modification)
  • Redefines “deidentified” to mean information that “cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer,” so long as the business takes reasonable measures to ensure that the information cannot be associated with a consumer or household, publicly commits to maintain information in deidentified form, and contractually requires recipients to comply with the provisions.

Transparency and Data Governance

• Pre-collection Notice (modification)
  • Clarifies that a business that “controls the collection” of a consumer’s personal information must provide the consumer with notice at or before the point of collection.
  • Expands the information that a business must include in the pre-collection notice, to include:
    • The categories of sensitive personal information collected and whether they are sold or shared; and
    • The length of time the business intends to retain each category of personal information or the criteria that would be used to determine the retention period.
• Storage Limitation (new)
  • Prohibits retaining personal information for longer than is “reasonably necessary” for the specific, disclosed purposes.
• Data Minimization (new)
  • Limits collection, use, retention, and sharing of personal information to what is “reasonably necessary” to achieve the specified purposes.
• Contracting Requirements (modification)
  • Requires businesses to enter into contracts with all entities to which the business discloses personal information, including:
    • service providers;
    • contractors (a new category of person that receives PI for specific business purposes); and
    • third parties (entities other than the business, its service providers, or its contractors) and notably even for sales or disclosures to third parties the agreement must “specif[y] that the personal information is sold or disclosed by the business only for limited and specified purposes.”
• Reasonable Security Procedures and Practices (new)
  • Requires businesses to implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal from unauthorized or illegal access, destruction, use, modification, or disclosure.

Individual Rights

• Deletion (modification)
  • Requires businesses to, in response to a valid deletion request, notify service providers and contractors to delete personal information and to notify all third parties to delete the personal information.
    • Requires service providers and contractors to cooperate with responding to rights requests.
    • Requires service providers and contractors to delete personal information when directed.
• Correction (new)
  • Requires businesses to use commercially reasonable efforts to correct inaccurate personal information in response to a verifiable consumer request.
    • Requires that businesses take into account “the nature of the personal information and the purposes of the processing of the personal information.”
• Right to Know (modification)
  • Expands the period of time covered by consumer right to know requests beyond the 12-month window provided in the CCPA, at the consumer’s request (applicable to personal information collected on or after January 1, 2022).
  • Expands the scope of right to know requests to include a business’ sharing and disclosure of the consumer’s personal information.
  • Expands the manner in which specific pieces of personal information must be shared, including that they be provided in a format “easily understandable to an average consumer” and if technologically feasible in a “structured, commonly used, machine readable format.”
• Opt-Out of Sale and Sharing (modification)
  • Requires businesses to provide consumers with the ability to opt-out of sharing of personal information in addition to the existing right under the CCPA to opt-out of the sale of personal information.
    • Sharing includes the transferring or making available personal information to a third party for cross-context behavioral advertising, regardless of whether consideration is exchanged.
    • Requires that opt-out links be updated to read “Do Not Sell or Share My Personal Information” link unless the business allows consumers to opt-out via an opt-out preference signal sent with the consumer’s consent via a mechanism conforming to specifications to be established by implementing regulations. If a business is providing the link, it can be combined with the “Limit My Use of Sensitive Personal Information” link discussed below, if applicable.
• Limit on Use and Disclosure of Sensitive Personal Information (new)
  • Requires that businesses not use or disclose a consumer’s sensitive personal information for purposes other than those necessary to provide the goods or services requested by consumers without providing consumers the right to limit the additional uses or disclosures except for certain limited business purposes.
    • Sensitive personal information would capture a wide range of data elements (e.g., identification numbers, financial information, precise geolocation, racial and ethnic origin, the contents of certain communications, and genetic data).
    • Requires that businesses provide a link to consumers (combined with the opt-out link or separately in a clear and conspicuous manner) reading “Limit the Use of My Sensitive Personal Information” unless the business allows consumers to opt-out via an opt-out preference signal sent with the consumer’s consent via a mechanism conforming to specifications to be established by implementing regulations.
    • The provision of advertising and marketing services and internal research are not business purposes for which a business or service provider can use sensitive personal information without providing consumers the right to limit.

Enforcement

• California Privacy Protection Agency (new)
  • Establishes the “California Privacy Protection Agency” to assume responsibilities for promulgating rules and enforcing the CCPA through administrative proceedings.
• Rulemaking Authority (modification)
  • Empowers the Attorney General (and eventually the California Privacy Protection Agency) to issue regulations on a wide range of topics, including:
    • Identifying certain “business purposes” for which service providers may use personal information (on their own behalf);
    • Updating the definition of “sensitive personal information,” “deidentified,” and “unique identifiers”;
    • Establishing when service providers and contractors can combine personal information from multiple sources; and
    • Defining “specific pieces of information” to minimize delivery of information not helpful to consumers (e.g., log information and technical data).
• Cure Period (modification)
  • Eliminates the 30-day cure period following notice of alleged non-compliance.
• Penalty for violations involving minors (new)
  • Adds a new penalty of $7,500 for violations involving personal information of consumers whom the business knows to be under 16 years of age.

***

California’s Secretary of State has until June 25, 2020 to certify that the CPRA ballot initiative has received the valid signatures (623,212) required to appear before California voters in the November 2020 election. Though Californians for Consumer Privacy could still withdraw the ballot initiative until the June 25 deadline, the CPRA text is no longer subject to modification.

If adopted by California voters, new and modified obligations under the CPRA would enter into force on January 1, 2023 and apply to personal information collected by businesses on or after January 1, 2022. Certain technical provisions, such as creation of the California Privacy Protection Agency and the extended exemptions for personal information collected in the business-to-business and employment contexts, would take effect within days after the initiative is adopted.

For more information on administration of California’s elections process, through which the CPRA is currently progressing, please read our previous post.

As the world focuses its efforts on the right strategy to beat the coronavirus and make normal life safe again, businesses are devising and implementing a variety of measures to deal with the COVID-19 crisis which rely on the collection, use and dissemination of personal data.

To assist with this challenge and ensure that privacy and cybersecurity aspects are appropriately addressed, Hogan Lovells has released today a detailed guide providing legal analysis and practical recommendations.  The guide has been prepared by a team spanning its 45 offices around the world and led by the firm’s Global Regulatory practice.

It includes in-depth guidance and actionable tips for business in relation to measures such as COVID-19 testing, temperature screening, immunity certificates, and contact-tracing apps. Other critical areas such as customer communications, data processing during clinical trials, cyber risks and potential litigation risks, are also carefully considered.

Eduardo Ustaran, Co-Head of the global Privacy and Cybersecurity practice at Hogan Lovells, commented: “Public health and privacy are not in conflict. They are on the same side. A workable strategy to ease off the world’s lockdown and keep the coronavirus under control demands respect for people’s rights and their trust. So our objective is to help and show how privacy and cybersecurity can be part of the solution to this crisis, ensuring the measures taken by governments and businesses are truly effective.”

Each section includes a brief legal analysis and specific guidance on next steps, split into the following chapters:

• Why privacy and cybersecurity should be part of the strategy
• Regulatory guidance and a summary of approaches so far
• Legal bases for processing COVID-19 data
• Employers’ transparency requirements when collecting COVID-19 data
• Temperature screening privacy implications
• Using immunity certificates and data protection
• Making COVID-19 contact tracing apps privacy compliant
• Vendors and contractual implications of a COVID-19 exit strategy
• The role of Data Protection Officers (“DPOs”) and Data Protection Impact Assessments (“DPIAs”) in the context of COVID-19 measures
• Cybersecurity precautions for an agile workforce
• Getting cloud projects right in times of COVID-19
• Direct marketing communications in times of coronavirus
• Mitigating investigation and litigation risks
• Key privacy considerations for COVID-19 clinical trials
• Privacy lessons from Asia

To read COVID-19 Exit Strategy: A Global Privacy and Cybersecurity Guide, click here.

Updated versions of the UK model Clinical Trial Agreement (mCTA) and the Clinical Research Organisation model Clinical Trial Agreement (CRO-mCTA) have been published. Given the increasing importance of safe but swift clinical trials in the time of coronavirus, this post outlines the main changes introduced from a data protection perspective and what they mean for contracting parties.

The Association of the British Pharmaceutical Industry (ABPI), Health and Care Research Wales (HCRW), Health and Social Care Northern Ireland (HSC NI), the Health Research Authority (HRA, England) and NHS Research Scotland (NRS), have adopted March 2020 versions of the commercial model Clinical Trial Agreement (mCTA) and the Clinical Research Organisation model Clinical Trial Agreement (CRO-mCTA), which were first published in 2003 and 2007, respectively. These template model agreements were designed to streamline the approval process of commercial studies and they were therefore intended to be used without modification by sponsors performing clinical trials in NHS/HSC patients in hospitals throughout the UK Health Services.

Despite their intention, requests for changes to the mCTAs had been notably increasing over the past few years, primarily due to the outdated data protection provisions in the templates which did not fully take into account the application of the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA).

The revised mCTAs replace the 2018 versions and introduce GDPR and DPA compliant clauses for the processing and sharing of personal data between institutions, sponsors, and Clinical Research Organisations (CROs).

The adoption of this more robust documentation is particularly welcome in the current climate and an important step forward to address the need to streamline clinical trials relating to COVID-19. This need is also reflected in the fast-track approval process for COVID-19 studies, which is down to only 24-72 hours from around 80 days. Similarly to the 2018 templates, the HRA expects that the new mCTA and CRO-mCTA will be used without modification.

What remains the same?

The mCTA is entered into by the sponsor and the institution (i.e., Participant Organisation), while the CRO-mCTA is to be used when, in addition to these two parties, the sponsor contracts with a CRO which is responsible for aspects of trial management at site. The role ascribed to the parties keeps reflecting the position of the HRA and the business community, which considers the sponsor as controller of personal data and the Participant Organisation and the CRO as processors acting on behalf of the sponsor for the purpose of the clinical trial (Clauses 6.2.1 mCTA and CRO-mCTA).

What has changed?

The mCTA and CRO-mCTA have been generally updated to reflect the new data protection legislation (GDPR and DPA), by including provisions on sharing coded data, security, and data breaches.

In particular, Clause 6 (Data Protection) in both the mCTA and the CRO-mCTA has been substantially redrafted to align with the GDPR and the DPA, with some welcome changes including:

• New Clause 6.2 incorporating an Article 28 GDPR-compliant data processing agreement between the sponsor (controller) and the Participant Organisation (processor).
• New Clause 6.3 providing for the sharing of personal data and/or pseudonymised data of clinical trial participants and giving the Participant Organisation important assurances as to safeguards implemented by, and/or on behalf of, the sponsor to protect clinical trial data and/or pseudonymised data with an increased focus on security and appropriate responses to data breaches and related incidents.
• The removal of previous Clause 6.4 – pursuant to which consent was collected by the sponsor and the CRO in order to process personal data of the principal investigator, sub-investigators and all personnel – to overcome the difficulties arising from consents which were likely to be regarded as not freely given (in a GDPR sense).

Some areas for further improvement

While the above changes offer a comfortable level of protection to the contracting parties, some issues that the business community encountered with the 2018 versions of the mCTAs have not been fully addressed in the updated templates.

For example, the Standard Contractual Clauses (SCCs), necessary in the context of clinical trials in the absence of other measures where it is relatively common that sponsors are based outside of the EEA and the UK, have not been included in the revised mCTA and CRO-mCTA.

Further, and in light of the UK departure from the European Union, it would have been desirable for the revised templates to include wording explicitly referring to the UK and UK law, thus providing adequate protection post-Brexit.

With respect to the data sharing under Clause 6.3, we could have expected more in-depth provisions to fully reflect the recently updated ICO Sharing Code of practice (you can read more on this in our Hogan Lovells blog post here).

Finally, while the new templates are Article 28 GDPR-compliant, the relevant processor obligations are made explicit only for the Participant Organisation, but not for the CRO, which is also a processor under the CRO-mCTA, thus leaving a question mark about how or where the controller-processor relationship with the CRO should be documented.

A positive step forward

Overall, the parties entering into the updated mCTAs and CRO-mCTAs can feel confident and protected by the new templates, which substantially improve the limited protection offered by the previous documentation.

The Guidance to the newly published templates states that it is anticipated that the mCTA and CRO-mCTA will be kept under ongoing review. We may therefore see some further desirable changes incorporated in the next version of the templates, and perhaps some novel changes in response to the challenges that the current circumstances bring to light.

Sara Marinoni, a trainee solicitor in our London office, contributed to this entry.

As companies in the United States work to re-open physical workplaces, they must navigate an array of federal, state, and local laws that relate to employees, including requirements to keep workplaces safe while protecting employee privacy.

Hogan Lovells partner Harriet Pearson, whose in-house corporate experience prior to joining the firm included human resources leadership roles, contributed to a timely memorandum published on May 13 by the HR Policy Association, the lead public policy organization representing chief human resources officers of the largest employers in the United States. The memorandum can be accessed here.

The memorandum provides an overview of the key laws and issues each present relevant to return to workplace efforts, including the following laws:

• Occupational Safety and Health Act
• National Labor Relations Act
• Fair Labor Standards Act & State Compensation Laws
• Workers’ Compensation
• Age Discrimination in Employment Act
• Americans with Disabilities Act
• Title VII
• Federal Family and Medical Leave Act
• Privacy Laws (such as the Health Insurance Portability and Accountability Act, Genetic Information Nondiscrimination Act, and Illinois Biometric Privacy Act)
• Employee Retirement Income Security Act
• State and Local Scheduling Laws

Businesses spent the latter months of 2019 working hard to prepare for the January 1, 2020 implementation of the California Consumer Privacy Act (CCPA). Months later, those businesses still are uncertain of their full range of potential compliance obligations because the California Attorney General’s (CAG) CCPA implementing regulations are still not final. As businesses refine their CCPA compliance programs, they should also be aware that privacy rules in California could again change before the end of this year if the California Privacy Rights Act (CPRA) ballot initiative is approved by voters.

Both the CAG draft regulations and the CPRA are subject to complicated administrative processes that could affect their adoption and implementation, as described below.

CCPA Regulations

The CAG appears committed to begin enforcing the CCPA starting on July 1, 2020—the date on which the statute authorizes enforcement to begin—despite not yet having finalized the key compliance obligations that will arise only from the regulations. Before the regulations can be implemented, the CAG needs to submit a final version to the California Office of Administrative Law (OAL) for its approval.

The California Attorney General accepted comments on the second set of modified draft regulations (the current version) until March 27. This means that a new set of modifications could be released publicly sometime soon for another round of comments or the CAG could submit the current version for approval and finalization by the OAL.

According to information published by the OAL, If the CCPA regulations were to be finalized by May 31, they would take effect on July 1. However, if the finalization occurs in the window of June 1-August 31, normal process would dictate that the regulations take effect on October 1 (which is after the CCPA’s enforcement deadline). This timeline assumes that the OAL would be subject to a limited 30-day window to review the CAG’s final regulations.

A recent executive order by the California Governor Gavin Newsom—in response to the COVID-19 pandemic—has extended the OAL’s timeframe for approving draft regulations by an additional 60 days. This extension may have the effect of lengthening the time it takes for the CCPA regulations to be finalized.

California Privacy Rights Act

While some obligations arising under the CCPA are subject to change when the CAG’s regulations become final, a new ballot initiative—the CPRA—could significantly amend and expand the CCPA. The CPRA is a ballot measure created by Californians for Consumer Privacy, led by co-founders Celine Mactaggart and Alastair Mactaggart—the CCPA’s chief architect—to create new privacy obligations and re-introduce some of the CCPA’s more restrictive measures that appeared in a 2018 ballot initiative.

As was originally intended for the 2018 ballot initiative, the CPRA would be presented to California voters for their adoption of the ballot measure, rather than passed through the legislative process. To place the CPRA on the November 2020 ballot in California, Californians for Consumer Privacy needs to gather the signatures of 623,212 California voters who support the initiative.

This week, Californians for Consumer Privacy announced that they are submitting over 900,000 signatures to qualify the CPRA for the November 2020 ballot. This suggests that the group is confident it has gathered the 623,212 valid signatures required to place CPRA on the November 2020 ballot. The signatures gathered by Mactaggart’s group still need to be counted and verified by CA election officials (a process that can take 38 working days, or longer in some circumstances). Given that the deadline for the Secretary of State to certify that ballot initiatives have received the required number of signatures is June 25, 2020, Mactaggart has barely left enough time for this process.

The large number of signatures submitted by Mactaggart suggests there is a good chance he has gathered enough signatures to place the CPRA on the November ballot. However, if the random sampling verification process indicates that the number of valid signatures is within a narrow margin of the required threshold (i.e., less than 110% of the required number), the June 25 deadline would likely pass before the verification process could be completed. If that occurs, the CPRA would be left off the ballot.

On February 26, Hogan Lovells Partner Bret Cohen participated in a panel discussion about the privacy and security concerns with biometric data at the RSA Conference, along with Alexandra Ross, Director and Global Privacy and Data Security Counsel at Autodesk, and Natalia Belaya, Director of Security Assurance and Compliance at Autodesk. With the use and collection of biometric data becoming more ubiquitous in our digital society, this discussion dove into the privacy and cybersecurity legal landscape surrounding biometric data and explored risks and practical approaches for implementing this technology consistent with laws, regulations, and best practices in the U.S., Europe, and around the world.

The presentation along with the slideshow can be viewed here.

On April 29, The Brazilian Federal Government issued an executive order, Provisional Measure (PM No. 959; Portuguese only), which would postpone the implementation of LGPD until May 3, 2021 if approved by Brazil’s legislature in the next couple of weeks. This type of measure is usually subject to a 120-day window in which they must be approved by Brazil’s Congress. However, due to special measures implemented in response to the current COVID-19 pandemic, Brazil’s House of Representatives and Senate must ratify this Provisional Measure within the next 16 working days for it to take effect. This means that Brazil’s Congress has until May 15, 2020 to consider the Provisional Measure.

As we recently covered, a few weeks ago Brazil’s Senate passed Bill 1,179/2020 which would postpone the LGPD’s effective date until January 1, 2021 and the enforceability of the LGPD’s administrative penalties until August 15, 2021. However, Brazil’s House of Representatives has yet to vote on that Bill. If the Provisional Measure is approved, it will eliminate the need for the legislative LGPD delay, and delay LGPD’s effective date and enforceability of administrative penalties until May 3, 2021.

Pressure had been mounting on the Brazilian government to delay the LGPD implementation date, culminating in the passage of the Bill in the Senate and its consideration in the House, even though the delay was opposed by the Public Prosecutor’s office. However, this executive order from the Federal Government adds more weight behind the push to delay LGPD implementation, making it more likely that the LGPD will be delayed until 2021. If so, the final date would be determined by whether the legislature agrees to pass the Provisional Measure (May 3, 2021) or the existing Bill (January 1, 2021).

We currently live in a world where the rapid spread of COVID-19 has provoked the urge to initiate the search for an effective vaccine or medicines to fight against it. In this context, the EDPB has recently published its Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak (Guidelines) with the clear objective of ensuring that patients’ and trial subjects’ privacy is not disregarded while clinical trials are carried out.

This is not the first time that the EDPB has issued guidance on topics related to scientific research or clinical trials (see its analysis on the interplay between the GDPR and the Clinical Trials Regulation, which we covered, here). However, the Guidelines focus specifically on scientific researches in connection with the current enemy: COVID-19.

Below are our highlights of the Guidelines:

• Fundamental takeaway – Data protection and, specifically, the GDPR do not hinder the fight against COVID-19. As foreseen in the GDPR, there are several scenarios under which the processing of personal data for scientific research is allowed while guarantying the fundamental rights to privacy and personal data protection.
• Interpretation of key concepts:
  • Broad concept of health data – Beyond the definition of article 4(15) GDPR, health data emerges from many sources: a patient’s medical history and results of examinations, cross referencing of data that reveals a person’s state of health or health risks, self-assessment apps, and other information obtained in a specific context (e.g., recent trip or presence in a region where COVID-19 is widespread).
  • Scientific research – Defined as a “research project set up in accordance with relevant sector-related methodological and ethical standards, in conformity with good practice” (following the definition of Article 29 Working Group in the absence of one in the GDPR).
  • Primary or secondary use of the data – The type of uses of the personal data is relevant for the purposes of identifying the appropriate legal basis, as detailed below. The primary use is the one for which the data is originally collected for a specific purpose, while the secondary use is an additional use for a different purpose (e.g., data collected and processed within the context of a medical consultation [primary use], and subsequently used for a certain scientific investigation [secondary use]).
• Legal ground (article 6 GDPR) and derogations (article 9 GDPR) for the lawful processing of health data:
  • Consent – Although it does not seem to be the preferred option for the EDPB due to the difficulty of consent meeting GDPR standards, it is not ruled out as a potential legal basis and derogation for the processing of health data.
  • Legitimate interest and public interest -In combination with the exceptions provided for in articles 9.2(i) and (j) GDPR (that is, and respectively, the public interest and where the data processing carried out for archival purposes in the public interest, scientific or historical research purposes, or statistical purposes). These grounds/derogations are based on national laws that will determine their scope. Note that national laws in this regard have not been fully unified within the EU.
• Data protection principles:

• • Transparency and information duties – Together with article 13 GDPR, special attention should be paid to article 14 GDPR since many times: (i) the data is not obtained directly from the data subject; and (ii) it will be used for purposes different to the ones for which they were initially collected. In this regard, note that the GDPR provides for exceptions to information duties in certain scenarios under article 14(5) GDPR, and that transparency vis-à-vis trial subjects and patients remains one of the most important principles where sensitive data are to be processed.
  • Purpose limitation and compatibility – Although article 5(1)(b) GDPR does not consider–as a general rule–the secondary use of data for scientific research purposes as incompatible, it is necessary to comply with article 89(1) GDPR, which, in these cases, emphasizes the importance of the data minimization.
  • Data minimisation and storage limitation – To comply with these principles, there are two items that must be taken into account: (i) the envisaged purposes, to clearly assess and determine which are the personal data required (minimisation); and (ii) the duration of the scientific research and national regulations, in relation to the document retention (storage).
  • Integrity and confidentiality – Taking into account the special nature of the personal data processed in this context, sufficient technical and organizational security measures must be implemented in order to guarantee its protection (e.g., pseudonymization, encryption, access control, etc.). In this regard, it is highly advisable (and even may be deemed necessary) to carry out a data protection impact assessment and to fully involve the data protection officer of the company.
• International transfers – Apart from the general rules for the international transfer of personal data to countries outside the EU, the EDPB remarks the derogation regime foreseen under article 49 GDPR under the current COVID-19 outbreak. Due to the exceptional sanitary crisis of an unprecedented nature and scale, the EDPB recognizes that during this period entities may rely their international data transfers on the public interest to carry out the same (article 49(1)(d) GDPR) or, ancillary, on the explicit consent of trial subjects or patients (article 9(1)(a) GDPR).

In addition to the above, and as it is customary, the Guidelines contain numerous examples that end up being, in many occasions, the most useful way of putting in practice the theoretical explanations provided by the EDPB.

Finally, it should be noted that the EDPB has stated that the development of a further and more detailed guidance for the processing of health data for the purpose of scientific research is part of its annual work plan. Thus, it is expected that the EDPB will issue additional guidance on this topic in the near future.

This post was originally on our Spanish-language data protection blog, available here. Hogan Lovells’ global Privacy and Cybersecurity team maintains a tracker of guidance from 30+ European data protection authorities related to data processing in the fight against coronavirus.

The Chambers USA 2020 lawyer rankings have been released for Privacy & Data Security. Hogan Lovells’ Privacy and Cybersecurity practice has once again received Band 1 recognition in the area of Privacy & Data Security. This team has retained its Band 1 ranking for nine consecutive years. The team also has been recognized at the spotlight table for Privacy & Data Security: Healthcare.

Several of our partners also have been individually recognized. Marcy Wilder was ranked Band 1 in the Privacy & Data Security: Healthcare category, Harriet Pearson was ranked Band 1 in the Privacy & Data Security category, and Christopher Wolf was recognized as a senior statesperson in the Privacy & Data Security category.  Mark Brennan was ranked Band 4 in the Telecom, Broadcast, and Satellite – District of Columbia category in part for his privacy and TCPA work.

Hogan Lovells’ global Privacy and Cybersecurity team maintains a tracker of guidance from 30+ European data protection authorities related to data processing in the fight against coronavirus.

On April 21, The European Data Protection Board (EDPB) published guidelines related to use of data for fighting the COVID-19 health crisis. The Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak and Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak adopt a similar approach to the EDPB’s previous statement that data protection rules do not hinder measures taken to fight the COVID-19 health crisis as long as controllers ensure the protection of personal data.

The new Guidelines outline obligations for processing data in specific scenarios. The Guidelines on processing health data for the purpose of scientific research highlight that controllers must still rely on a GDPR Art. 6 basis for processing personal data (e.g., consent or legitimate interests) in addition to the applicable exceptions to the prohibition on processing data concerning health regarding public interest particularly in the area of public health, scientific research, or statistical purposes (under Art. 9(i) and (j)). These Guidelines also highlight that Member State derogations related to these exceptions, established as permitted by the GDPR, may also impact the bases for processing available to controllers covered by those local-law derogations. The Guidelines on use of location data and contact tracing state that preference should always be given in this context to processing anonymized data, though consent could also form a basis for processing where location data is not anonymized. These Guidelines also provide further guidance on how to limit the risks to fundamental freedoms that are associated with systematic and large scale monitoring of location and/or contact between natural persons (see relevant entry in the tracker, here). When considering adoption of contact tracing tools, the EDPB expects that controllers carry out a data protection impact assessment (DPIA) and strongly recommend that it is published.

In both Guidelines, the EDPB emphasizes that processing must meet the GDPR principles in Art. 5 (e.g., transparency, purpose limitation, data minimization, and storage limitation).

The EDPB guidelines, as well as the views of over 30 European data protection authorities, are further summarized in our tracker (updated April 23, 2020).

On Wednesday April 15, Hogan Lovells and Ankura hosted a webinar  about the impact of the GDPR and CCPA on cookies and similar AdTech tracking technologies. James Denvil from Hogan Lovells’ Privacy and Cybersecurity practice by was joined senior directors from Ankura to share best practices and perspectives. We have made the webinar available on demand here and the slides can be downloaded here.

Program topics included:

• Cookies and Similar Tracking Technologies Defined
  • How cookies and similar tracking technologies support and enhance digital services, including advertising
  • Types of cookies (are your cookies strictly necessary or for marketing purposes?)
  • Ways in which consumers’ digital activities are shared throughout the digital advertising ecosystem
• Tracking Technology Legal and Regulatory Challenges
  • How cookies have evolved from being “totally anonymized” trackers to “profiling tools” in the eyes of regulators and others
  • Key legal and regulatory challenges to deploying cookies and similar technologies for digital advertising
  • Industry and “homegrown” solutions to address the regulatory challenges
• AdTech Data Privacy Best Practices in a GDPR and CCPA World
  • Best practices for cookie risk governance
• The Future of Cookies
  • Potential changes in the digital advertising ecosystem with the supposed death of third party cookies

We have made the webinar available on demand here and the slides can be downloaded here.