Title Text

In our July newsletter, you will find the following topics:

EDPB publishes guidelines on web scraping, anonymisation and blockchain
Cybersecurity Act and Critical Entities Resilience Act have been definitively adopted
CJEU clarifies the distinction between the concepts of digital services and digital content
CJEU clarifies the classification of data relating to athletes’ doping offences
Commission publishes guidelines on transparency obligations under the AI Act

EDPB publishes guidelines on web scraping, anonymisation and blockchain

On 7 July, the European Data Protection Board (EDPB) published three new guidelines. The guidelines cover web scraping of personal data, anonymisation and the application of the GDPR to blockchain technology.

Web scraping is a technique for automatically collecting large amounts of data from websites. Examples include collecting personal data from public posts and profiles on social media, online forums or news websites. In the guidelines on web scraping, the EDPB emphasises that the fact that personal data is publicly available does not mean that this data may be collected and reused without further ado. Organisations that scrape personal data must ensure that they comply with the GDPR, which means that they must have a valid legal basis for processing, actively inform data subjects about the processing, and comply with the principles of purpose limitation and data minimisation.

Furthermore, the rise of generative AI has given web scraping a new impetus, as large volumes of data available online are often used to develop and train AI models. Against this background, the EDPB emphasises that the GDPR remains fully applicable when publicly available personal data is processed for such purposes.

The guidelines on anonymisation provide a comprehensive framework for assessing whether data have been properly anonymised and therefore fall outside the scope of the GDPR. The EDPB emphasises that the classification of data as anonymous depends on the outcome of the measures applied and not on the use of a specific technique. Data are only anonymised when natural persons can no longer be identified with reasonable effort and resources. Furthermore, the EDPB confirms (in line with the EDPS/SRB judgment) that anonymity is a relative concept. When assessing whether data is anonymous, account must be taken of the specific context of the processing, the available supplementary data and the means reasonably available to a party to identify individuals. In this regard, the risk of re-identification remains an important factor.

The guidelines on processing via blockchain technologies clarify how the GDPR relates to the inherent characteristics of blockchain networks, such as immutability and decentralisation. These characteristics may give rise to conflicts with obligations under the GDPR, such as the right to erasure and the principle of data minimisation. The EDPB emphasises that organisations must take privacy-by-design into account right from the design phase and must choose solutions that minimise the storage of personal data on the blockchain itself as much as possible. In this regard, it highlights, amongst other things, the use of off-chain storage and other technical measures designed to prevent re-identification.

Read the EDPB’s guidelines on web scraping, anonymisation and blockchain here.

The guidelines on web scraping and anonymisation have been published for public consultation, whilst the guidelines on blockchain technologies have been adopted in their final form.

Read the accompanying EDPB press release here

Cybersecurity Act and Critical Entities Resilience Act have been definitively adopted

On 7 July, the Senate approved the Dutch Cybersecurity Act (Cbw) and the Dutch Critical Entities Resilience Act (Wwke). These Acts have therefore been definitively adopted. Both Acts will come into force on 15 August and implement the NIS2 Directive and the CER Directive in the Netherlands, respectively.

The Cbw significantly expands the number of organisations subject to cybersecurity obligations. These include organisations in the energy, healthcare, financial and public sectors, amongst others. ICT suppliers providing services to these organisations will also need to take this into account, as these organisations are also responsible for the security of the supply chain for their ICT services. The Act also sets out obligations relating to risk management, incident response, reporting requirements and directors’ responsibilities. The supervisory authorities will be granted extensive enforcement powers, including the ability to temporarily suspend board members and impose administrative fines.

The Wwke focuses on the physical and organisational resilience of critical entities. These are organisations that are designated as such and that fulfil essential social functions, such as operators of energy and electricity networks, drinking water companies, hospitals, providers of transport infrastructure, digital infrastructure and certain government bodies. Critical entities must carry out risk analyses, implement appropriate resilience measures and report serious incidents. This creates a separate framework for the protection of vital societal functions, alongside the cybersecurity regime.

For organisations falling within the scope of these new laws, the date of entry into force is significant because the preparation time is limited. Furthermore, directors will need to actively ensure that they have sufficient knowledge in the field of cyber governance and compliance with the new obligations. Directors may, in fact, be held personally liable for damage resulting from a breach of this obligation.

Click here for the press release from the Dutch government

CJEU clarifies the distinction between the concepts of digital services and digital content

On 9 July, the Court of Justice of the European Union (CJEU) handed down a judgment in a case between Sky Österreich and an Austrian consumer organisation concerning the classification of streaming services under Directive 2011/83/EU on consumer rights (the Directive).

The central issue was whether a streaming subscription should be classified as the supply of ‘digital content’ or as a ‘digital service’. This distinction is relevant to the scope of consumers’ right of withdrawal. In the case of digital content, the right of withdrawal may, under certain conditions, lapse as soon as the supply begins, whereas different rules apply to digital services.

The CJEU ruled that a streaming service with a dynamic offering, continuous access to content and ongoing involvement by the provider should be classified as the supply of a digital service. The CJEU points out that the mere fact that users are granted access to digital data is insufficient to constitute ‘digital content’ within the meaning of Article 16(m) of the Directive. According to the CJEU, a streaming subscription is characterised precisely by the fact that the provider actively performs a service throughout the entire term of the contract, including by keeping content available, updating the range of content, making personalised recommendations and maintaining the technical infrastructure. It therefore involves more than the one-off or continuous supply of specific digital files. In doing so, the CJEU aligns with Recital 30 of the Omnibus Directive, which notes that video and audio streaming services may qualify as digital services due to the provider’s ongoing involvement.

The classification of streaming subscriptions as digital services has implications for consumers’ right of withdrawal. Unlike in the case of the supply of digital content, a provider cannot automatically rely on the exception in Article 16(m) of the Directive as soon as the supply of the service begins. However, this does not mean that consumers can use a streaming service free of charge during the withdrawal period. If a consumer requests immediate performance of the contract during the withdrawal period and subsequently exercises their right of withdrawal, the provider may, pursuant to Article 14(3) of the Directive, demand proportionate compensation for the part of the service that has been provided. The judgment thus clarifies that many modern subscription and platform services will have to be classified as digital services rather than digital content. This is relevant not only to streaming services, but possibly also to cloud, platform and other subscription-based digital services.

Read the judgment of the CJEU here

CJEU clarifies the classification of data relating to athletes’ doping offences

On 14 July, the CJEU handed down a judgment in response to preliminary questions from an Austrian court in a case involving the Austrian anti-doping authority (case C‑474/24; NADA Austria). The central issue was how personal data relating to doping offences committed by professional sportspeople should be classified under the GDPR and under what conditions such data may be made publicly available online.

The CJEU first ruled that information concerning a doping offence does not automatically qualify as health data within the meaning of articles 4(15) and 9 GDPR. According to the CJEU, this is, in principle, only the case where information about the data subject’s physical or mental state of health can be inferred from the publication -for example, by mentioning the prohibited substance or method used in combination with other data. The mere fact that an athlete has breached an anti-doping rule does not, therefore, automatically mean that sensitive personal data is being processed.

Furthermore, the Court clarifies that data relating to breaches of anti-doping rules and the sanctions imposed for such breaches do not qualify as personal data relating to criminal offences and convictions within the meaning of article 10 GDPR. According to the CJEU, this concerns a specific disciplinary regime that applies exclusively to a particular group of persons, namely athletes. The sanctions are aimed at enforcing rules of conduct within that group and cannot therefore be equated with criminal sanctions.

Finally, the CJEU ruled that, in principle, the GDPR does not preclude the publication of the names of professional sportspeople who have breached anti-doping rules, the duration of their suspension and the reasons for it. The CJEU recognises that the fight against doping constitutes an objective of general interest, which contributes to the integrity of sport, equal opportunities for athletes and the protection of their health. However, prior to publication, an individual balancing of interests must take place and the controller must be able to demonstrate that the disclosure complies with the principle of proportionality.

The judgment is relevant because it clarifies that data relating to doping offences do not automatically qualify as health data within the meaning of article 9 GDPR. If no information regarding the data subject’s physical or mental state of health can be inferred from the processed information, in principle no exception to the prohibition on processing under article 9 GDPR needs to be invoked for its processing. In doing so, the CJEU appears to be introducing some nuance in relation to its earlier Lindenapotheke judgment (C‑21/23), in which the concept of health data was interpreted broadly. The NADA Austria judgment confirms that, in order to classify data as health data, one must always consider the specific content of the data being processed and the context in which it is processed.

Read the Court’s judgment here

Commission publishes guidelines on transparency obligations under the AI Act

On 20 July, the European Commission (the Commission) published final guidelines on the transparency obligations set out in article 50 Act. The guidelines are intended to assist organisations in complying with the transparency obligations, which will apply from 2 August.

Among other things, the guidelines clarify when users must be informed that they are interacting with an AI system, what requirements apply to the labelling of AI-generated content, and how providers should deal with deepfakes and other synthetic media. In addition, the Commission addresses the transparency obligations applicable to emotion recognition systems and biometric categorisation.

The Commission emphasises that article 50 AI Act contains a separate set of transparency obligations, which is independent of the classification of an AI system as high-risk. The transparency rules may therefore also apply to AI systems to which no other specific obligations under the AI Act apply.

Furthermore, the Commission clarifies that the manner in which these obligations are met depends on the context in which an AI system is used. In this regard, account may be taken of users’ reasonable expectations and the extent to which the use of an AI system is recognisable to them.