No abstract

No abstract

The paper identifies and explores the solutions to certain underdeveloped and lacking legislative solutions and issues in the practice of the national data protection authority (CPDPA), which affect the aims of effective GDPR enforcement and transparency. On a broader level it contributes to the EDPB initiatives toward the harmonization of certain procedural provisions and overcoming the differences in the conduct of cross-border proceedings. Most of the research considerations are supported by a study of the case that received much public attention and involves the first administrative fine in Croatia. Arguments are provided toward prescribing time limits for the resolution of data protection administrative disputes and toward appropriate addressal of the closely related issues of publishing CPDPA rulings, with the concerns of their accessibility worked out through a comprehensive policy. This includes also the particular considerations on the corrective measures issued to public authorities, which cannot be fined, and on the underdeveloped fine-limitation rule for certain other public sector bodies. Public interest concerns should be closely examined in the assessment of communicating information on relevant data protection cases and CPDPA decisions, as well as the interrelation with the freedom of information requests. The publishing of non-anonymous final rulings should be recognized as a form of additional sanction and power of the data protection authority and as such further explored also at the EU level. In terms of more efficient CPDPA functioning it is argued that the prescribed time limits for issuing expert opinions are extended. At the same time resources should be utilized toward better inclusivity and accessibility of relevant information, primarily rulings, on its website.

No abstract

The paper analyses rules pertinent for examination of national data retention measures regulating data processing activities of providers of electronic communication services following invalidation of the Data Retention Directive in 2014, on which subject the CJEU issued a total of five judgments up until June 2021. Focus of this analysis is the issue of applicability of EU law as interpreted in the CJEU case law, most specifically Article 15, paragraph 1 of the ePrivacy Directive containing legal safeguards for the restrictions of rights and obligations in that directive on the confidentiality of communications as well as the processing of traffic and location data. Such restrictions are as a rule manifested in different national data retention measures, which may pursue law enforcement and public security, as well as national security objectives. This examination is supported also by analysis of rules on the scope of ePrivacy Directive and its relationship with the general personal data protection framework. Overall findings in the paper provide a frame for further detailed research on the topic of future regulation of retention measures at national/EU level (Proposal for ePrivacy Regulation, possible new EU data retention legislation) and a comparative assessment of relevant CJEU jurisprudence with that of the European Court of Human Rights in respect of compatibility of retention measures with the guarantees of fundamental rights and freedoms and allowed restrictions thereof in the European legal system.