I HIGHLIGHT Processing of personal data arising from the use of geolocation technologies in the employment context In its Resolution No 7680/2014, dated 28 October 2014, the Portuguese Data Protection Authority (Comissão Nacional de Protecção de Dados (CNPD)) analyses the implications, in terms of employees’ data protection and privacy, of geolocation devices in motor vehicles, on the one side, and in smart mobile devices, on the other, in the scope of employment relations and it establishes the criteria and circumstances under which the processing of personal data concerning geolocation is admissible. The installation of geolocation devices on the equipments in question may enable the employer to achieve legitimate purposes, relating, among others, to the efficiency and quality of the services, the optimization of resources or the protection of assets, provided they are not used as a means of locating the whereabouts of the employer or as a tool of monitoring his or her professional performance, which is clearly forbidden by the law (see Article 20 of the Employment Code). The data relating to the location of the employee, as well as the record of moves and other associated data, constitute information concerning identified or identifiable physical persons, which, because they relate to the private life of the employees, fall within the concept of sensitive data. The consent of the employee is excluded by the CNPD as valid basis of legitimacy for the processing of the personal data in question, on account of the situation of imbalance of power that exists in employment relations that does not guarantee that the consent is given freely, which constitutes an essential condition in the light of the Data Protection Law. Accordingly, the processing of sensitive data can only legitimately occur on the basis of a legal provision. Without prejudice to the fact that geolocation in the employment context is not expressly provided for in any provision of the national legal system, since geolocation devices are technological equipments that enable to control the employees remotely, the CNPD considers that the same amount to a means of remote surveillance, for which reason the Labour Code and the General Law on Public Service Work establish the necessary and indispensable legal provision on which the legitimacy of the data processing must be based. With regard to its purpose, the CNPD considers admissible the processing of data relating to geolocation, in the case of motor vehicles, for the following purposes: (i) management of fleet on external services (in the areas of activity of external/home technical assistance, distribution of goods, passengers transport, transport of goods and private security) and (ii) protection of goods, in the case of transport of hazardous materials (namely inflammable or toxic materials, hazardous waste, weapons, munitions and explosives, medicinal products or drug precursors) and the transport of high-value material (the CNPD has set at 10 thousand euro the maximum limit of the value of the cargo carried).WWW.CUATRECASAS.COM NEWSLETTER I INTELLECTUAL PROPERTY, MEDIA AND IT 3/6 Where the specific purpose of the installation of geolocation devices is to file criminal complaints in case of theft, although the geolocation data are automatically recorded, the employer cannot have access to the data unless the vehicle is stolen. In the case of portable phones or computers, the CNPD does not permit the employer to monitor the geolocation of those equipments, and the employer cannot have access to such information, even if the same is available from the operators, nor can the employer install applications on the smart mobile devices activating GPS sensors. Where the processing of these data indicates the commitment of a crime, such information can be used as grounds for the corresponding criminal complaint. In the cases in which such occurs, it is admitted that the employer may also use such information in the scope of disciplinary proceedings, where those facts constitute, in and of themselves, a breach of the duties of the employee. The CNPD considers that this guarantees the protection of the legitimate interests of the employer, whilst ensuring that there is no deviation from the purpose, and that the personal data are not used to control the performance of the employee. In addition to the aspects listed above, the Resolution under consideration analyses other relevant matters, namely the category of personal data that may be processed and the periods of time during which data can be retained, the processing of the information internally and externally, interconnection and communication of personal data to third parties, transparency and the rights of the data subjects and the security measures to be implemented, for which reason the reading of this text should not dispense with the perusal of the entire Resolution. II LEGISLATION Commission Regulation (EU) No 1196/2014 of 30 October 2014. OJEU L 319/36 of 2014-11-6 Implementing Regulation (EC) No 808/2004 of the European Parliament and of the Council concerning Community statistics on the information society. Rectification of Regulation (EU) No 1169/2011 of the European Parliament and of the Council of 25 October 2011. OJEU L 331/40 of 2014-11-18 On the provision of food information to consumers, amending Regulations (EC) No 1924/2006 and (EC) No 1925/2006 of the European Parliament and of the Council and repealing Commission Directive 87/250/EEC, Council Directive 90/496/EEC, Commission Directive 1999/10/EC, Directive 2000/13/EC of the European Parliament and of the Council, Commission Directives 2002/67/EC and 2008/5/EC and Commission Regulation (EC) No 608/2004.WWW.CUATRECASAS.COM NEWSLETTER I INTELLECTUAL PROPERTY, MEDIA AND IT 4/6 Portaria (Ordinance) No 255/2014. D.R. (Portuguese official gazette) No 237, Series I of 2014-12-09 Amending for the second time Portaria (Ordinance) No 239/2012, of 9 August, establishing additional rules of implementation of Community regulations on the description, presentation and labelling of products of the wine sector. III CASE LAW Judgment of the Court of Justice (Fourth Chamber), of 11 September 2014. (Reference for a preliminary ruling from the Bundesgerichtshof – Germany) – Technische Universität Darmstadt / Eugen Ulmer KG (Case C-117/13). OJEU C 409/11 of 2014-11-17 The concept of «purchase or licensing terms », provided for in Article 5(3)(n) of Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001, on the harmonisation of certain aspects of copyright and related rights in the information society, must be understood as requiring that the rightholder and an establishment, such as a publicly accessible library, referred to in that provision, must have concluded a licensing agreement in respect of the work in question that sets out the conditions in which that establishment may use that work. Article 5(3)(n) of Directive 2001/29, read in conjunction with Article 5(2) of that directive, must be interpreted to mean that it does not preclude Member States from granting to publicly accessible libraries covered by those provisions the right to digitise the works contained in their collections, if such act of reproduction is necessary for the purpose of making those works available to users, by means of dedicated terminals, within those establishments. Article 5(3)(n) of Directive 2001/29 must be interpreted to mean that it does not extend to acts such as the printing out of works on paper or their storage on a USB stick, carried out by users from dedicated terminals installed in publicly accessible libraries covered by that provision. However, such acts may, if appropriate, be authorised under national legislation transposing the exceptions or limitations provided for in Article 5(2)(a) or (b) of that Directive provided that, in each individual case, the conditions laid down by those provisions are met.
Judgment of the Court of Justice (Fourth Section), of 11 December 2014. (Reference for a preliminary ruling from the Nejvyšší správní soud – Czech Republic) - František Ryneš/ Úřad pro ochranu osobních údajů (Case C-212/13) A video surveillance system installed in a family house for the protection of people but which also captures images of a public space cannot be regarded as the processing of data carried out in the exercise of activities which are exclusively personal or domestic, and are therefore subject to the provisions of Directive 95/46/EC.WWW.CUATRECASAS.COM NEWSLETTER I INTELLECTUAL PROPERTY, MEDIA AND IT 5/6 IV RESOLUTIONS, RECCOMMENDATIONS, OPINIONS AND OHTERS Commission Implementing Decision of 7 October 2014. OJEU L 293/48 of 2014- 10-09 Amending Decision 2007/131/EC on allowing the use of the radio spectrum for equipment using ultra-wideband technology in a harmonised manner in the Community. Commission Recommendation of 9 October 2014. OJEU L 295/79 of 2014-10-11 On relevant product and service markets within the electronic communications sector susceptible to ex ante regulation in accordance with Directive 2002/21/EC of the European Parliament and of the Council, on a common regulatory framework for electronic communication networks and services. Commission Recommendation of 10 October 2014. OJEU L 300/63 of 2014-10- 18 On the data protection impact assessment template for smart grid and smart metering systems. Executive Summary of the Opinion of the European Data Protection Supervisor. OJEU C 390/2 of 2014-11-5 In the Opinion under consideration, the European Data Protection Supervisor expresses its opinion on the Commission Proposal for a Directive of the European Parliament and of the Council, on single-member private limited liability companies. Executive Summary of the opinion of the European Data Protection Supervisor on the Commission Decision on the protection of personal data. OJEU C 390/4 of 2014-11-5 Concerning the Commission decision on the protection of personal data in the European e-Justice Portal. Rectification of Commission communication. JOUE C 391/31 of 2014-11-6 Rectifying the Commission communication concerning Article 4(3) of Directive 2009/22/EC of the European Parliament and of the Council, on injunctions for the protection of consumers’ interests, which codifies Directive 98/27/EC concerning the entities qualified to bring an action under Article 2 of this Directive.