The European Commission’s High Level Expert Group on Artificial Intelligence has released a new set of guidelines for ensuring that AI is “trustworthy”, following a public consultation with feedback from over 500 contributors.

The updated guidelines set out the EU’s guidance for assisting developers and deployers in achieving “trustworthy AI”, maximizing the benefits and minimizing the risks associated with this emerging area of technology.

Following its European strategy on AI (published in April 2018), the guidelines were drafted by an independent expert group, comprising of 52 representatives from academia, industry and society.Continue Reading Future of Technology: EU guidelines for developing ethical AI

The Information Commissioner’s Office (ICO) has launched a consultation on a code of practice for online services to ensure they adequately safeguard children’s personal data. This follows on from the UK consultation for new online safety laws (discussed here). The Irish government has also recently launched guidance in relation to online safety (discussed here). The UK Data Protection Act (DPA) 2018 also requires the ICO to produce an age-appropriate design code of practice to give guidance to organisations about the privacy standards they should adopt when offering online services and apps that children are likely to access and which will process their personal data.
Continue Reading ICO launches consultation on Code of Practice to help protect children online

On 17 April 2018, the European Commission proposed new rules in the form of a Regulation and an accompanying Directive, which aim to improve law enforcement authorities’ cross-border access to e-evidence.

The proposed Regulation on European Production and Preservation Orders enables a judicial authority in a Member State to obtain electronic evidence in criminal matters directly from a service provider in another Member State. The Directive complements the Regulation, as it sets out the rules for the appointment of service providers’ legal representatives, whose role is to receive and respond to judicial orders. The new rules will ensure swift access to e-evidence, with service providers being required to respond to judicial orders within 10 days and in emergency cases within 6 hours, compared to 10 months under the current Mutual Legal Assistance process.Continue Reading European Council reaches position on proposed e-evidence Directive

On 17 April 2019, the European Parliament approved a new Regulation on platform-to-business trading practices. It requires online platforms and online search engines to comply with certain legal obligations and also encourages them to take voluntary complimentary steps. The Regulation aims to ensure that businesses using online intermediation services and general online search engines have greater certainty and clarity with respect to the rules governing their relationships with these platforms and how to resolve potential disputes.

The text adopted by the European Parliament has not yet been formally approved by the Council of the EU. Once approved, the Regulation will enter into force 12 months after its publication in the Official Journal.Continue Reading European Parliament agrees new rules to improve fairness of online platforms

In Ryanair dac v SC Vola.ro srl [2019] IEHC 239 the Irish High Court confirmed the enforceability of a jurisdiction clause contained within a website’s Terms of Use, finding the user had agreed to it via a “click-wrap” agreement. Following previous Ryanair screen-scraping cases, the court held the click-wrap agreement met the requirements of Article 25(1) (c) of the Brussels I Recast Regulation (EU 1215/2012) (the Regulation). The court rejected the defendant’s arguments that there had been no assent to the Terms of Use, and the jurisdiction clause, because there was an element of “auto-ticking” by the Ryanair…
Continue Reading High Court confirms enforceability of jurisdiction clause agreed electronically by “click-wrapping”

On 1 May 2019, Ms Helen Dixon, the Data Protection Commissioner (DPC), appeared before the US Senate Committee on Commerce, Science and Transportation.  She was invited to testify on Ireland’s implementation of the GDPR, as the US is considering introducing a federal data privacy framework. California has already passed a new data privacy law, the California Consumer Privacy Act, which is due to come into effect on 1 January 2020. This note sets out some of the highlights of the DPC’s testimony.
Continue Reading DPC testifies before US Senate Committee on GDPR implementation

As we approach the GDPR’s one-year anniversary, we are starting to see more enforcement activity by the EU Data Protection Authorities (DPAs) as they complete their initial investigations into data breaches. This blog looks at two recent fines issued by the Polish and Danish DPAs, which demonstrate the type of conduct likely to lead to enforcement activity.
Continue Reading GDPR enforcement action – Polish & Danish DPAs issue their first fines

The UK Supreme Court has granted supermarket chain Morrisons permission to appeal against a landmark UK Court of Appeal ruling that found it vicariously liable for a deliberate data breach carried out by a former employee (previously discussed here).
Continue Reading UK Supreme Court grants Morrisons permission to appeal class action data breach

The EDPB has released new draft guidelines 2/2019 on the contractual necessity legal basis for processing personal data in the context of the provision of online services to data subjects. The guidelines emphasise the narrow scope of the contractual necessity legal basis. A controller must be able to demonstrate that the processing is ‘objectively necessary’ for a purpose that is ‘integral’ to the delivery of a contractual service to the data subject in order to rely on this legal basis. If a controller cannot demonstrate such necessity it must consider another legal basis for processing the personal data. This note considers the key highlights of the guidelines.
Continue Reading EDPB issues draft guidelines on the contractual necessity legal basis in the context of online services

On 3 April 2019, the Joint Committee on Justice and Equality met to discuss the implementation of the GDPR with Ms Anna Morgan (Deputy Commissioner), Ms Jennifer O’Sullivan (Deputy Commissioner), and Mr Cathal Ryan (Assistant Commissioner). The Commissioners discussed a range of issues, including the enforcement powers used by the Data Protection Commission (DPC) post-GDPR, the difficulties with verifying parental consent in relation to the provision of information society services to children, and the DPC’s experience of resolving data access requests by amicable resolution. This note highlights some of the Committee’s questions (in abbreviated form), and the responses given by the Commissioners.
Continue Reading Deputy Data Protection Commissioners discuss GDPR implementation with Oireachtas Committee