Privacy – cearta.ie

The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 [the GDPR]) provides both for public enforcement by data protection authorities and for private enforcement by any person who has suffered damage as a result of an infringement of the Regulation (on this inter-connection, see Johanna Chamberlain & Jane Reichel “The Relationship Between Damages and Administrative Fines in the EU General Data Protection Regulation” 89 Mississippi Law Journal (forthcoming 2020; SSRN)). As to private enforcement by means of damages claims, Article 82(1) GDPR provides that “[a]ny person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered”. CMS legal are tracking fines levied by data protection authorities in the EU – they record that, so far, 186 fines have been levied, for a total of almost €460m (the EDPB gives different numbers (pdf, pp33-34), discussed here). However, there is as yet no equivalent tracker for compensation claims, in part because there have been very few. So far as I can find, there have been eight judgments considering substantive claims for damages pursuant to Article 82 (though there have been other cases in which such compensation was claimed but the substantive issue was not reached).…

The legal basis of the US$170m fine on Google for YouTube’s infringement of children’s privacy

10 September, 2019

| No Comments

| GDPR, Privacy

FTC NYAG Google YouTube logos

At the end of last week, the media was full of stories that Google had been “Fined $170 Million for Violating Children’s Privacy on YouTube” (that’s a headline from the New York Times; see also, for example, NPR | BBC | RTÉ | Silicon Republic). In this post, I want to sketch the legal background to, and consequences of, this fine; and, at the end, I will say a few words about the equivalent position in Europe.

In the US, the Children’s Online Privacy Protection Act of 1998 (15 USC §§ 6501–6506; hereafter: COPPA), and the Children’s Online Privacy Protection Rule (16 CFR § 312; hereafter: the COPPA Rule) made under it, regulate unfair and deceptive acts and practices in connection with the collection and use of personal information from and about children on the internet. In particular, 15 USC §§ 6502(b)(A) COPPA, and 16 CFR § 312.3 COPPA Rule, require the operator of any website or online service directed to children that collects personal information from children, or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child,

(i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and
(ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children; …

Giving further effect to the second paragraph here, 16 CFR § 312.5(b)(1)…

The Great Hack and the dysaguria of Cambridge Analytica

24 July, 201919 August, 2019

| 3 Comments

| Digital Rights, Dysaguria, Media and Communications, Privacy

The Great Hack has just dropped on Netflix (IMDB | Rotten Tomatoes | wikipedia | poster left). It is a documentary that explores “how a data company named Cambridge Analytica came to symbolize the dark side of social media in the wake of the 2016 US presidential election”. Much has already been written about the Cambridge Analytica scandal (eg ICO here and here (pdfs) | Carole Cadwalladr in The Guardian), and a great deal more will be written as the movie is reviewed in the coming days. I don’t propose to add to those torrents here. Rather, I simply want to observe that there is a word for a company that symbolizes the dark side of social media.

Reacting to Thomas More’s coinage of “utopia” as the “perfect state”, from the Greek “eu” meaning “good”, and “topos” meaning “place”, John Stuart Mill coined “dystopia” as the “frightening state”, from the Greek “dys” meaning “bad”, and (again) “topos” meaning “place”. But, whilst “dystopia” is perfect to describe a “frightening state” and its frightened society, it is not particularly apt to describe a “frightening company” and its frightened society. Indeed, we don’t really have the words for when a corporate society goes bad; “dystopia” and “dystopian” have been pressed into service (even in the context of reviewing The Great Hack: “Watching this film, you literally start to wonder if history has been warped towards a sickening dystopia”); but the warped society in that movie is very different to the warped society in classic dystopian fiction (such as, to take the obvious example, Orwell’s 1984).…

Cliff Richard v BBC – Part II – Media speech and publication in the public interest

23 July, 201827 July, 2018

| 1 Comment

| Freedom of Expression, Privacy

The record man said
‘Don’t let it go to your head, I’m gonna make you a star’
… So mama please don’t worry about me, I’m nearly famous now.

Sir Cliff Richard OBE in Greenwich 2017 (via Flickr) (element) 1. Introduction
The words above are in the first verse of “I’m Nearly Famous”, the title track of an album released in 1976 by Sir Cliff Richard [Sir Cliff], pictured left rocking Greenwich, UK, in 2017. Six weeks earlier, the South Yorkshire Police [SYP] had admitted that their tip off to the BBC that he was being investigated in respect of allegations of historic sex abuse infringed his privacy (see, eg, Richard v BBC [2017] EWHC 1648 (Ch) (26 May 2017)). On foot of that tip off, the British Broadcasting Corporation [the BBC] gave those allegations and the search of Sir Cliff’s property in Sunningdale, Berkshire prominent and extensive television coverage. Last week, in Richard v BBC [2018] EWHC 1837 (Ch) (18 July 2018) Mann J held that that the BBC’s broadcasts also infringed Sir Cliff’s privacy, and awarded him £210,000 damages. In a previous post, I have considered Mann J’s analysis that Sir Cliff had a reasonable expectation of privacy under Article 8 of the European Convention on Human Rights [the ECHR] in respect of the police investigation.…