5 ms·

Will they pay a GDPR fine as well?

by nik736 3y ago

betaby 3y ago
Government agencies exempted themselves from GDPR and similar. That was discussed on HN in context of the break in Ireland.
- cess11 3y ago
  Really? https://www.edps.europa.eu/press-publications/press-news/press-releases/2024/european-commissions-use-microsoft-365-infringes-data-protection-law-eu-institutions-and-bodies_en https://www.edps.europa.eu/press-publications/press-news/pre...
  - District5524 3y ago
    GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)
    - cccbbbaaa 3y ago
      > Unfortunately, national security services are not subject to GDPR or LED at all They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
      - M2Ys4U 3y ago
        The EU has no legal power to legislate on issues of national security under the treaties. Article 4 of the Treaty on European Union states that "competences not conferred upon the Union in the Treaties remain with the Member States" and "[i]n particular, national security remains the sole responsibility of each Member State". Article 2(2) of the GDPR states that "This Regulation does not apply to the processing of personal data [] in the course of an activity which falls outside the scope of Union law". Article 3(3) of the LED includes similar text (with the word "Directive" replacing the word "Regulation").
        cccbbbaaa 3y ago
        Thank you for the clarification.
  - cccbbbaaa 3y ago
    It's a myth that gets repeated here. In reality, it's more subtle. Laws can be the legal basis for some processing, if it is deemed proportional; and in some countries (eg. France), government agencies cannot be fined. GDPR doesn't apply to EU activities related to foreign policy or law enforcement, but EUCFR articles 7 and 8 still apply, as does regulation 2018/1725 for the former, and directive 2016/680 for the latter–so in theory, some activities are indeed exempted from GDPR, in practice, they're still subject to data protection laws that require essentially the same measures as GDPR. Source: GDPR article 2 and 6. On a more personal note, I've already requested my data under GDPR, cited WP29/EDPB guidelines, and filed complaints against various govt agencies.
bagacrap 3y ago
to whom would they pay it?

Will they pay a GDPR fine as well?

by nik736 3y ago

Will they pay a GDPR fine as well?

Government agencies exempted themselves from GDPR and similar. That was discussed on HN in context of the break in Ireland.

cess11 3y ago
Really? https://www.edps.europa.eu/press-publications/press-news/press-releases/2024/european-commissions-use-microsoft-365-infringes-data-protection-law-eu-institutions-and-bodies_en https://www.edps.europa.eu/press-publications/press-news/pre...
- District5524 3y ago
  GDPR article 2.2-2.3 does define some exceptions. National law enforcement agencies etc. are subject to a similar directive (LED, https://eur-lex.europa.eu/eli/dir/2016/680/oj https://eur-lex.europa.eu/eli/dir/2016/680/oj). Union bodies, just like in your link yet another (article 2.3), but also quite similar (Regulation (EU) 2018/1725, https://eur-lex.europa.eu/eli/reg/2018/1725/oj https://eur-lex.europa.eu/eli/reg/2018/1725/oj) Eurojust belongs to this one. It's a good thing to have EDPS, otherwise it would be much easier to legislate things nobody can comply with in practice. But for most countries, it doesn't make much sense to fine other authorities. (Unfortunately, national security services are not subject to GDPR or LED at all - the only place you can get protection from them is under national law, Charter of the Fundamental Rights, ECHR etc.)
  - cccbbbaaa 3y ago
    > Unfortunately, national security services are not subject to GDPR or LED at all They are AFAIK, but can be exempt of articles 12 to 22 under national law. What did I miss?
    - M2Ys4U 3y ago
      The EU has no legal power to legislate on issues of national security under the treaties. Article 4 of the Treaty on European Union states that "competences not conferred upon the Union in the Treaties remain with the Member States" and "[i]n particular, national security remains the sole responsibility of each Member State". Article 2(2) of the GDPR states that "This Regulation does not apply to the processing of personal data [] in the course of an activity which falls outside the scope of Union law". Article 3(3) of the LED includes similar text (with the word "Directive" replacing the word "Regulation").
      - cccbbbaaa 3y ago
        Thank you for the clarification.
- cccbbbaaa 3y ago
  It's a myth that gets repeated here. In reality, it's more subtle. Laws can be the legal basis for some processing, if it is deemed proportional; and in some countries (eg. France), government agencies cannot be fined. GDPR doesn't apply to EU activities related to foreign policy or law enforcement, but EUCFR articles 7 and 8 still apply, as does regulation 2018/1725 for the former, and directive 2016/680 for the latter–so in theory, some activities are indeed exempted from GDPR, in practice, they're still subject to data protection laws that require essentially the same measures as GDPR. Source: GDPR article 2 and 6. On a more personal note, I've already requested my data under GDPR, cited WP29/EDPB guidelines, and filed complaints against various govt agencies.

bagacrap 3y ago

to whom would they pay it?