MWC16 / 4YFN - Mobile World Congress Roundup

Everything you need to know about appointing an EU and/or UK representative as required by the GDPR.

Update 14 February 2021: under the EU Council’s agreed position on the future E-Privacy Regulation, providers of electronic communications services, providers of publicly available directories, senders of direct marketing over electronic communications services, and anyone using processing and storage capabilities or collecting information processed by or emitted by or stored in the end-users’ terminal equipment (i.e. adtech!) will also be required to appoint a representative in the EU and communicate it to the relevant national supervisory authority.

The EU-UK Trade and Cooperation Agreement has avoided major changes to personal data flows between the EEA and UK at least until 30 April 2021. However, if we process data of individuals in both the EEA and the UK, then we face the prospect of complying with two similar but distinct regulatory regimes.

If you’re handling personal data subject to EU (and/or UK) laws then you would do well to read the UK Information Commissioner’s (“ICO”) decisions to fine Marriott and BA for failures to have in place appropriate cyber-security measures. And this post for 10 more easily digestible takeaways.

The Court of Justice of the EU has struck down the EU Commission’s EU-U.S. Privacy Shield Framework decision, but in principle left in place the EU Commission’s Standard Contractual Clauses, which organisations can sign in order to impose EU-style data protection obligations on non-EU data importers. For now, where we used to rely the Privacy Shield framework, the pragmatic approach may be to sign SCCs – but the story won’t end there.

The EU-U.S. Privacy Shield framework may be an interesting tool to permit international transfers of personal data without any other permissions or contracts.
UPDATE: The Privacy Shield framework remains in place and we can still apply to be certified, but on 16 July 2020, the EU Court of Justice decided that it could no longer be used to authorise transfers of personal data from the EU/EEA/UK to the USA, and other mechanisms need to be used.

A wise man once said: “The real purpose of a force majeure clause is to make into events of force majeure things that normally wouldn’t be”

Yes, Eden Legal can guarantee that your notice under the old laws won’t give all the information required by GDPR. And if we are collecting data from or about children, all the more so. What if we only receive data from another party? Yes again.

No! But still time for some smart thinking…

The EU’s proposed E-Privacy Regulation (“E-PR”) would significantly affect use of cookies and tracking technologies and direct marketing activities. But it is still not in final form, and we will most likely have a maximum of 6 months to adapt from when it is.

FAQs re B2B contracts:
- Are contracts between businesses exempt from consumer protection rules on unfair contract terms? Yes, but some clauses are still banned. And others need to be reasonable.
- All clauses? No, just some exemption and limitation of liability clauses.
- Can you summarize these in a handy way? Let’s see…

The standard remedy for breach of contract is damages. Termination may or may not be available but damages can always be claimed. Why then do indemnity clauses seem to be creeping wider in scope? And why do some habitually strike them out on the basis that “we don’t give indemnity”. Are indemnity clauses really so effective? Or so scary?

The final part of the series:

Part 1: Right to be Forgotten; Notification of Security Breaches; Data Protection Impact Assessments
Part 2: Non-EU Controllers & Processors; Data Protection by Design & by Default; Children’s Data
Part 3: International Transfers; Fines & Damages
Part 4: Obtaining Consent; Profiling; Portability; Pseudonymization
Part 5: Obligations for Processors; Data Protection Officers

In this part 4 of the series (see Part 1, Part 2 and Part 3), we review the new rules on obtaining consent, profiling, data portability and pseudonymization of data

(January 2017: edited to reflect draft E-Privacy Regulation)

The EU Commission has made proposals to modernize copyright protection in the Digital Single Market, but for sites republishing news content or hosting user-generated content, these measures look likely to create new obligations and restrictions.

The European Commission has published a proposed European Electronic Communications Code, which among other matters addresses directly the place of “OTT” voice and data communications services, imposing new obligations particularly on those connecting to public phone networks.

A downloadable list developed over the years, that I wish I had had before, and hope someone else might be able to benefit from.

Quick checklist for Intellectual Property legal due diligence: for M&A, funding, restructuring, audit, etc. #lawinagraphic

If we know that content has been published online without the rightsholder’s consent, then linking to it is a breach of copyright. And, if we do this for profit, then we are presumed to know this. This is the dividing line set by new caselaw from the Court of Justice of the EU.

Even if there is no breach of the contract, then the law won’t tie us to it forever. There may be additional grounds that it would be unreasonable for us to continue. Some of them may be more often seen and easier to show than others, but they can be worth considering in cases of doubt. This part 2 follows up part 1 where we considered how to terminate for breach of contract.

We want out. For whatever reason. But trouble can lie ahead if we terminate if we’re not entitled to, or if we don’t comply with what we agreed in the contract. In this part 1 we look at the scenario where the other party is in breach of the contract. In part 2 we’ll look at termination for other reasons.

If two parties each owe each other money, then sometimes the law may assist by permitting the smaller amount to be offset against the larger, resulting in a single payment of the difference. However, it is not the case that unless our contract says otherwise then we are automatically entitled to set off any claim. We need to be aware of the conditions and restrictions of this and tailor our contracts accordingly.

Quickest ever overview of how to export personal data from the EU/EEA #lawinagraphic

UPDATE: On 16 July 2020, the EU Court of Justice decided that the EU-U.S. Privacy Shield framework could no longer be used to authorise transfers of personal data from the EU/EEA/UK to the USA, and other mechanisms need to be used.

From 1 August 2016, the EU-U.S. “Privacy Shield” arrangements are available to allow personal data to be exported from the EU to the US without further formalities. Digital businesses may sigh with relief for now, but we all will be on the lookout for the (seemingly inevitable) legal challenges to the new system.

UPDATE: On 16 July 2020, the EU Court of Justice decided that the EU-U.S. Privacy Shield framework could no longer be used to authorise transfers of personal data from the EU/EEA/UK to the USA, and other mechanisms need to be used.

Of course we can. But we will need to disclose the commercial relationship and, if we fall into the “advertorial” category, then viewers will need to be alerted before engaging with the video…

Some say the EU’s GDPR which will apply from 2018 represents a dramatic shake up of data protection law. We don’t totally agree. Keep Calm and Start Preparing.

The countdown has begun. The EU’s General Data Protection Regulation has finally been published and will apply from 25 May 2018. It’s definitely not too early to begin preparing…

Finally we have details of the ‘EU-US Privacy Shield’ arrangements that have been developed to supersede the defunct “Safe Harbor” scheme that previously allowed personal data to be more easily exported from the EU to the USA. On the basis of agreements with – and information on US law and practices provided by – US authorities, the European Commission has published a draft ‘adequacy decision’ which if approved will make this system an option for permitting data transfers to the USA without requiring additional authorisation.

UPDATE: On 16 July 2020, the EU Court of Justice decided that the EU-U.S. Privacy Shield framework could no longer be used to authorise transfers of personal data from the EU/EEA/UK to the USA, and other mechanisms need to be used.

So another MWC and (for the first time for this author) 4YFN done. Eden Legal isn’t a professional investor or an expert in protocol stacks or processor speeds, and also could only chat with a fraction of the exhibitors. However, here are a few things that we noticed soaking up the shows and talking to the ones that we did.

Although for many businesses there is no legal obligation to submit to alternative dispute resolution for consumer dispites, online traders and marketplaces must now at least provide consumers with a link to a new EU “online dispute resolution” mechanism.

Under proposed new EU rules intended to give consumers additional rights under online contracts, social media, hosting and other services may be classified as “digital content”, including those provided for free but in exchange for provision of personal data.

EU-US personal data transfers seem set to be permitted to continue under plans agreed between the EU Commission and US authorities. However, details are sketchy and the uncertainty created since the end of the Safe Harbor system seems likely to continue as national Data Protection Authorities and privacy activists remain unconvinced that the prospective scheme properly addresses the key issue of surveillance by US authorities.

UPDATE: On 16 July 2020, the EU Court of Justice decided that the EU-U.S. Privacy Shield framework could no longer be used to authorise transfers of personal data from the EU/EEA/UK to the USA, and other mechanisms need to be used.

If you are in business you are processing data – so this applies to all of us. We have some time but clearly it would be a mistake to leave preparations until Easter 2018.

(May 2016: edited to include date of application)
(January 2017: edited to reflect draft E-Privacy Regulation)
(May 2018: edited to cover UK “data protection fee”)

“Model Clauses”; “Model Contracts”; “Standard Contractual Clauses”… For international transfers generally they remain entirely useable and legally valid. For transfers to the USA, now that Safe Harbor can’t be relied upon, they may still [December 2015] be the best option while awaiting a decision on what any successor arragements may look like.

The EU Court of Justice has ruled that we can no longer rely on the Safe Harbor scheme in order to permit transfers of personal data from the EU to the USA, whether to a third party or to a group company. If we haven’t already, the most immediate solution is to sign the European Commission’s Model Clauses…

From 1 October 2015, new specific rules apply to supplies of digital content to consumers. Time to review purchase flows and terms and conditions with end users, as well as contracts with suppliers. (Yes, again.)

If we engage an external party to promote our products, then we could inadvertently create a commercial agency relationship and provisions in our contract may be overridden by laws that protect the agent. As ever, Eden Legal’s recommendation is to consider these matters at the outset. However, even after the fact there may be arguments on both sides.

Adam Farr of Eden Legal will be at the Mobile World Congress again in 2015. For 2015 what are some of the legal issues relevant to MWC?

Late payment is a problem for all. But if we are owed money, then late payment of commercial debts legislation may help us to claim interest and costs, and deter customers from delaying payment.

Update August 2016: UK interest rates were cut to 0.25% so the default intrest rate we can charge will be 8.25%.

In emails there seems to be footer “inflation” and a lot of copying from others, without properly considering either the applicable obligations or the advisability of what is being said. Here we try to cut through this to what is legally required and/or useful to have.

All you want to know is what details to put on your website. However, in the UK, the information is spread over various (overlapping) legal provisions.

We don’t want to be over-legalistic or moralistic. But paying a hacker and covering over the problem could turn out to be more damaging to you and your customers than dealing properly with the issue.

Eden Legal’s description of its services prompted one contact to coin the phrase “Legal Department as a Service”. We like that analogy and so here is a not-so-serious run down of some of the similarities – and not so similarities.

This post was half written when Eden Legal saw Fred Wilson’s post on “his” creative commons licence (looks like Creative Commons with a few extra tweaks). Why don’t we do the same with ours?

What are the hotels on? In some highly publicized cases in the US and the UK, hotels seem to be at the forefront of trying to limit negative reviews on social media though clauses in their standard terms and conditions, and also imposing financial penalties for doing so. These clauses are clearly ill-judged – but potentially also illegal.

Even an apparently indefinite contract can still normally be terminated on reasonable notice. But what is reasonable?

Who makes the law? If you are working with Google Play, iTunes or the Windows Phone store then your first port of call may be their developer agreements – irrespective of what you understand is permitted under applicable laws.

Yes – but this is essentially advertising and so readers must be made aware that it is.

Can’t a butcher or a banker do more harm than a telco? Public authorities inevitably seek to be able to access end user and communications data. Requests may be for user personal data under data protection laws or criminal or civil evidence rules. And legal intercept rules may apply to a much wider group than just providers of electronic communications services.

Yes, so deal with it… In the EU now consumers must have a period of 14 days to change their minds and receive a full refund after buying goods or contracting services online.

In part 1 of this article we focused on defining confidential information, exceptions to confidentiality, and restrictions on use. In this part 2 we look at some final considerations in reviewing or preparing an NDA, such as which employees or representatives get to see the information, injunctions and damages, and “governing law roulette”.

At present this depends on where they are (e.g. the Netherlands and Slovenia have specific “net neutrality” legislation; other EU Member States have codes of practice, guidelines or proposals for legislation). A pan-EU legal obligation to ensure net neutrality may still survive from the European Commission’s “Connected Continent” proposals…

In the spirit of ensuring that your NDA does what you want and that when signing others’ you don’t give away more than you intend, some (non-exhaustive) considerations. Part 1 of a two part article focusing on defining confidential information, exceptions to confidentiality, and restrictions on use. Part 2 here.

There is no right to be forgotten… However, under EU data protection laws, a person can ask a search engine to remove links to information about them and the search engine must do so if the information is “outdated, irrelevant or excessive”.

Now of historical interest only! Please see the latest articles here reviewing the actual provisions now due to enter into effect by early 2018.

The ‘prohibitions’ on linking, framing and caching should probably still remain in your terms of use as outside the EU and even in the EU there are still some means for authors to control certain uses of their works.

UK defamation law was revised and updated with effect from 1 January 2014 with a specific defence being introduced for “website operators” in relation to defamatory statements posted by users.