On 5 February 2009 the European Commission has adopted a new Decision updating the "controller to processor" standard contractual clauses, which had been approved by Commission Decision 2002/16/EC, in order to provide companies with a tool which ensures adequate protection for personal data when they transfer personal data to processors outside the EU/EEA.

The Decision adopted modifies current " controller to processor" standard contractual clauses to take account of the expansion of processing activities and new business models of companies for international processing of personal data. Under certain conditions specific provisions allow the outsourcing by the processor of its processing activities (sub-processing) to other sub-processor(s) so as to continue to ensure the protection of data subjects.

The Decision is expected to be published in the Official Journal of the EU L39 on 12 February 2010  and be in force on 15 May 2010.

For the full press release click here.

For a copy of the clauses click here. 

Commission adopts new standard contractual clauses for the exchange of personal data written by Isa Dora Tytgat on 10-03-10 in News & announcements.

In an intermediate ruling, the Brussels court of first instance considered the copyright infringements proven and appointed a technical expert to assess the viability of possible solutions. In the final ruling of the first instance court  in 2007, Scarlet was ordered to filter any infringing exchanges out of the peer-to-peer traffic of its customers. Subject to a penalty payment per day of non-compliance with the court order, Scarlet was thus required to install and maintain the necessary software to monitor this traffic. Should any infringement of copyright be detected by such software, Scarlet would have to block the transfer of those files on its network. In the months thereafter, Scarlet argued before the same court the technical impossibility to comply with the order, keeping into account the state of the art of filtering technology, and obtained temporary relief.

Scarlet also appealed the said order before the Court of Appeals of Brussels. During this case, the Belgian Internet Service Providers Association (ISPA), represented by Geert Somers and Jos Dumortier of time.lex, and the major internet service provider Belgacom, intervened in the proceedings. Scarlet stressed in its appeal, among other points, the disproportionality of the order to filter all P2P traffic, and the complete ineffectiveness of the requested measure. Also, Scarlet argued that the systematic surveillance of internet users by their ISPs was illegitimate.

In its decision of 25 January 2010, the Brussels Court of Appeal referred the case to the  European Court of Justice for a preliminary ruling on two questions. Firstly, the appeals court seeks to know whether the national courts, taking into account European legislation, may legitimately order Internet access providers to filter the peer-to-peer traffic of their customers and, if copyright infringements are detected, to block the transfer of the infringing files. If the Court in Luxembourg  would answer the first question in the affirmative, then the Brussels Court of Appeal additionally seeks to know whether it should, when imposing this measure, apply the proportionality principle when judging the effectiveness and deterrent nature of the measure.

Because of this new procedural step, a ruling to settle the matter definitively is not expected  within the next two years. The referral to the European Court of Justice illustrates that the Brussels Court of Appeal is conscious of the importance of the matter and the potential impact of its ruling on the entirety of the European Internet sector. The response of the Luxembourg court is therefore eagerly awaited.

 For a copy of the ruling of the Brussels Court of Appeal, click here.

The "Sabam vs Scarlet"-case will be continued before the European Court of Justice. written by Boris Tshiananga & Geert Somers on 10-03-10 in News & announcements.

In September, time.lex finalised a study examining  the legal framework for eHealth in each of the Member States, and identifying any regulatory barriers for the interoperable exchange of health information. The purpose of this study was to contribute to the creation of a framework for greater legal certainty of eHealth products and services' liability in the context of existing product liability legislation. The study, which was conducted for the European Commission - DG INFSO, identified and analysed the range of legal and regulatory frameworks for electronic health delivery and services in each Member State and proposed recommendations to facilitate cross-border services when provided via eHealth applications.

The final report of the study has now been published  by the European Commission, and can be downloaded here, along with individual country reports for each Member State. 

New report on the Legal framework of Interoperable eHealth in Europe written by Hans Graux on 10-03-10 in News & announcements, E-health.

As a part of its policies on free consumer access to internet services in the EU, the European Commission recently requested time.lex to conduct a study in relation to spam, spyware and malicious software. The Study contains up-to-date information on the actions taken in EU Member States by competent national authorities and by electronic communication network and service providers against spam, spyware and malicious software. It was drafted on the basis of answers obtained from time.lex' national correspondent network, spanning all Member States.

 A full copy of the study can be found here, and the Commission's press release can be found here.

Time.lex study on Spam and Spyware published written by Hans Graux on 10-03-10 in E-business, News & announcements, Privacy & data protection.

In the recent case of Infopaq / Danske Dagblades Forening, the Court of Justice was confronted with a number of  interesting questions regarding the legitimacy of creating and commercially exploiting brief automatically generated snippets of newspaper articles. Danish company Infopaq offered a clippings service, which consisted of the digitisation of newspaper publications and of analysing these for the presence of specific keywords, as requested by its customers. If a specific article contained a monitored keyword, Infopaq would copy that word along with the five words preceding and following it, to create an 11-word snippet. This snippet was then communicated to the customer, along with a source reference for the original article.

Danish newspaper industry body Danske Dagblades Forening (DDF) considered this to be an infringement of the copyrights that its member organisations held over these articles. Infopaq disagreed, and brough the matter before the Danish courts in order to obtain a declaratory ruling. DDF argued that the creation of the snippets constuted an unlawful reproduction of a protected work, whereas Infopaq held that its reproductive activity would be permissible under the exceptions created by the 2001/29 EC Copyright Directive. This Directive contains a specific exception for so-called transient or incidental acts of temporary reproduction, which do not require permission of the rights holder provided that they constitute an essential part of a technological process and whose sole purpose is to enable (a) a transmission in a network between third parties by an intermediary, or (b) a lawful use of a work or other subject-matter to be made, and which have no independent economic significance. Infopaq argued that this exception applied to the creation of its scans and the resulting snippets.The Danish Supreme Court (Højesteret) decided to request a preliminary ruling from the European Court of Justice.

However, the European Court of Justice rejected Infopaq's line of reasoning in its ruling of 16 July 2009. While the scanning of newspaper articles or the creation of digitised text files through OCR (optical character recognition) processes might be considered as a transient or incidental act of temporary reproduction, the Court rules that this qualification certainly wouldn't apply anymore to the finalised snippets communicated to Infopaq's customers: 

"By the last act of reproduction in the data capture process, Infopaq is making a reproduction outside the sphere of computer technology. It is printing out files containing the extracts of 11 words and thus reproduces those extracts on a paper medium. Once the reproduction has been affixed onto such a medium, it disappears only when the paper itself is destroyed." In short, the fact that the snippets were fixated in a more or less stable medium means that they cannot be considered to be transient in nature, and thus the appeal to the exception in the Copyright Directive is denied. 

Since the exception no longer applied, the Court ruled that the snippets could be a reproduction of a protected work:

"The possibility may not be ruled out that certain isolated sentences, or even certain parts of sentences in the text in question, may be suitable for conveying to the reader the originality of a publication such as a newspaper article, by communicating to that reader an element which is, in itself, the expression of the intellectual creation of the author of that article. Such sentences or parts of sentences are, therefore, liable to come within the scope of the protection provided for in Article 2(a) of that directive."

Of course, this should certainly not be taken to mean that any 11-word quote from a protected article automatically constitutes an infringement of the rights holder's copyright. In order for this to be the case, the quote itself would need to reproduce a sufficient number of key elements from the protected work that collectively are a reflection of the author's intellectual creation.

At least from a Belgian perspective, this criterion was already affirmed by the Court of Cassation in 2003 in relation to summaries of protected texts. In that specific case, the Court also ruled that a summary should be found to be infringing if it copies from the original text those elements which can be deemed to constitute its originality. The summary is to be considered a copy rather than a new (and potentially also protected) work if it reflects the protected characteristics of the original work to such an extent that the global impression left by both works differs insufficiently. This ruling of 25 September 2003 can be found here (in Dutch).

The new ruling of the Court of Justice thus seems to follow this same logic. While legally consistent, it is also clear that this test is frequently difficult to apply in practice and does not lend itself particularly well to new business models which rely on the automated creation or aggregation of short summaries. Undoubtedly, this will not be the last ruling in this domain.

Infopaq / Danske Dagblades Forening: automatically generated 11-word quotes can be infringing written by Hans Graux on 10-03-10 in Copyright & other IP, E-business, News & announcements.

Hoe kan een HR consultant of werkgever sociale media inzetten om kandidaten te vinden en succesvol te contacteren? En hoe zit het dan met de privacy? Mag ik de gevonden informatie in overweging nemen bij de beoordeling van een CV? Welke rechten heeft de werknemer bij het gebruik van sociale media of internet in het bedrijf? Mag ik controleren of mijn medewerkers op internet surfen of op een sociaal netwerk zitten tijdens de werkuren? Mag ik een werknemer ontslaan omwille van overdreven internetgebruik tijdens de werkuren? Van wie zijn de contactgegevens in een sociaal netwerk eigenlijk? Mag mijn ex-medewerker die gebruiken na zijn ontslag?

Op deze en andere vragen vindt u een antwoord in onze bijdrage "FAQ over juridische aspecten van HR & sociale media" in het nieuwe boek van An De Jonghe, Sociale Media voor HR Professionals, een publicatie die een praktijkgerichte multidisciplinaire blik biedt op de mogelijkheden en risico's van sociale media.

Voor meer informatie en bestellingen verwijzen we naar de homepage van de publicatie.

Publicatie: Sociale Media voor HR Professionals written by Hans Graux on 10-03-10 in News & announcements.

A recent judgment of the European Court of Justice of 7 May 2009 (Case C-553/07) has important consequences for the question how long access logs need to be archived when an application provides access to personal data.

Article 12 of the European Data Protection Directive 95/46/EC dealing with the ‘right of access' states that every data subject has the right to obtain from the controller "without constraint, at reasonable intervals and without excessive delay or expense, confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed". In Belgium this provision has, almost literally, been transposed in Art. 10 of the Law of 8 December 1992.

One of the practical consequences of the data subject's access right is the duty, for controllers, to keep log files in order to be able to provide the list of recipients to whom the data have been disclosed. How essential this obligation is considered in the context of the privacy protection has been demonstrated last year in the judgment of the European Court of Human Rights in the "I v. Finland" case.

An important question is how far backwards in time a data subject can request information as to the recipients or categories of recipients to whom the personal data have been disclosed.

Mr Rijkeboer requested the local administration of the city of Rotterdam to notify him of all instances in which data relating to him from the local-authority personal records had, in the two years preceding the request, been disclosed to third parties. He wished to know the identity of those persons and the content of the data disclosed to them. Mr Rijkeboer, who had moved to another municipality, wanted to know in particular to whom his former address had been disclosed.

Unfortunately for Mr Rijkeboer the Dutch law on personal data held by local authorities (Wet gemeentelijke basisadministratie persoonsgegevens) provides that the local authority is to retain details of any communication of data for one year following that communication. According to this provision the data requested by Mr Rijkeboer dating from more than one year prior to his request were automatically erased.

Mr Rijkeboer lodged a complaint with the local authority against the refusal to give him the requested information relating to the recipients over the two years preceding his request. That complaint having been rejected, the case finally came to the Raad van State which decided to stay the proceedings and to refer a prejudicial question to the European Court of Justice.

In its judgment of 7 May 2009 the ECJ emphasizes first that a data subject should be able to control that his personal data are processed in a correct and lawful manner, that is to say, in particular, that the basic data regarding him are accurate and that they are disclosed to authorised recipients.

With regard to the right to obtain information on the recipients or categories of recipient of personal data and on the content of the data disclosed, the Directive does not make it clear whether that right concerns the past and, if so, what period in the past.

First the ECJ confirms that this right must of necessity relate to the past. If that were not the case, the data subject would not be in a position effectively to exercise his right to have data presumed unlawful or incorrect rectified, erased or blocked or to bring legal proceedings and obtain compensation for the damage suffered.

As to the scope of that right in the past, the Court states, in the second place, that the setting of a time-limit with regard to the right to access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed must allow the data subject to exercise the different rights laid down in the Directive. The length of time the basic data are to be stored may constitute a useful parameter without, however, being decisive. Where the length of time for which basic data are to be stored is very long, the data subject's interest in exercising the rights to object and to remedies, may diminish in certain cases. If, for example, the relevant recipients are numerous or there is a high frequency of disclosure to a more restricted number of recipients, the obligation to keep the information on the recipients or categories of recipient of personal data and on the content of the data disclosed for such a long period could represent an excessive burden on the controller.

Following the judgment of the ECJ a number of parameters may accordingly be taken into account in particular the applicable legal provisions on time-limits for bringing an action, the more or less sensitive nature of the basic data, the length of time for which those data are to be stored and the number of recipients.

In the particular case of Mr. Rijkeboer the ECJ estimates that rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation at issue, unless it can be shown that longer storage of that information would constitute an excessive burden on the controller.

In Belgium the law doesn't fix a time-limit for storage of information on the recipients or categories of recipient of personal data. Consequently the controller needs to establish himself a balance between, on the one hand, the interest of the data subject in protecting his privacy and, on the other, the burden which the obligation to store that information represents for the controller.

ECJ Judgement in the Rijkeboer Case written by Jos Dumortier on 10-03-10 in Privacy & data protection, News & announcements.

time.lex werd twee jaar geleden opgericht. Inmiddels zijn we uitgegroeid tot een vooraanstaand nichekantoor. Onze focus ligt op telecommunicatie, IT/IP, media en e-business. Onze cliënten variëren van multinationals en de Europese, federale en regionale overheden tot en met start-ups. Een goede work/life balance en autonoom en flexibel werken is onderdeel van de kantoorfilosofie. 


Onze ploeg heeft uitbreiding nodig wegens aanhoudende groei. 
Wij zijn op zoek naar nieuwe voltijdse of deeltijdse kantoorgenoten:

• ervaren advocaat-medewerkers 
met minimaal 4 jaar ervaring in ICT-recht
• gevorderde advocaat-stagiaires 
met kennis van en interesse in ICT-recht

Je dient over de volgende eigenschappen en ervaring te beschikken:

• Aantoonbare affiniteit met ICT- en mediarecht
• Een goede kennis van het Nederlands, Engels en Frans
• In staat om zelfstandig te werken

Indien je zelf je eigen expertise of bepaalde gebieden binnen ICT verder zou willen uitbouwen, dan krijg je daartoe de kans. Wij waarderen eigen initiatief. Wij bieden ook de mogelijkheid om opleidingen te volgen. Het actief participeren in de ICT sector door het geven van lezingen of te publiceren wordt aangemoedigd. Wij kunnen je hierbij begeleiden.

Aantrekkelijk en competitief vergoedingspakket in functie van ervaring en mogelijkheden.


Zin in leven en carrière? Stuur dan je CV naar Edwin Jacobs, edwin.jacobs@timelex.eu, of 0476/40.11.70

Vacature time.lex written by Hans Graux on 10-03-10 in News & announcements.

time.lex strongly supports a campaign launched, amongst others, by the Flemish, French and German bar associations to disapprove the draft legal framework imposing general and preventive obligations on communications providers to retain traffic data, location data and identification data of fixed, mobile and IP communication of their users. Such data include the source, destination, time and duration of privately held communication. The proposed data retention obligation entails serious risks for the privacy of all citizens, in particular also the confidentiality of communications with lawyers.

Please join us by signing the petition at www.bewaarjeprivacy.be. For further information, see also the position paper issued by ISPA Belgium (EN), and an article on the subject from Geert Somers (NL), as published in De Tijd.

Petition against excessive data retention rules written by Geert Somers on 10-03-10 in Telecommunications, Privacy & data protection, News & announcements.

Since the second half of 2008, time.lex has been conducting a study for the European Commission into the legal framework for interoperable eHealth in European Member States. The study aims to identify and analyse the range of legal and regulatory frameworks for electronic health delivery and services in each Member State, and will propose recommendations to facilitate cross-border services when provided via eHealth applications.

Interim country reports, collected by time.lex via its correspondent network, are now available on the Studies part of the ICT for Health website.

Direct links to the interim reports by country (pdf format):

Time.lex national reports on European e-Health are published written by Hans Graux on 10-03-10 in E-health, News & announcements.