On 5 February 2009 the European Commission has adopted a new Decision updating the "controller to processor" standard contractual clauses, which had been approved by Commission Decision 2002/16/EC, in order to provide companies with a tool which ensures adequate protection for personal data when they transfer personal data to processors outside the EU/EEA.

The Decision adopted modifies current " controller to processor" standard contractual clauses to take account of the expansion of processing activities and new business models of companies for international processing of personal data. Under certain conditions specific provisions allow the outsourcing by the processor of its processing activities (sub-processing) to other sub-processor(s) so as to continue to ensure the protection of data subjects.

The Decision is expected to be published in the Official Journal of the EU L39 on 12 February 2010  and be in force on 15 May 2010.

For the full press release click here.

For a copy of the clauses click here.

Commission adopts new standard contractual clauses for the exchange of personal data geschreven door Isa Dora Tytgat op 10-03-10 in News & announcements.

In 2004 werd Scarlet (destijds Tiscali) door Sabam voor de rechter gedaagd omdat klanten van Scarlet auteursrechtelijke inbreuken zouden gepleegd hebben. Met behulp van peer-to-peer software en de toegang tot internet van Scarlet zouden deze klanten auteursrechtelijk beschermde werken uitwisselen.

In een tussenvonnis verklaarde de rechter in eerste aanleg de inbreuken op het auteursrecht bewezen en beval verder onderzoek naar mogelijke oplossingen. In zijn uiteindelijke vonnis van 2007 verzocht de rechter aan Scarlet peer-to-peer verkeer van haar klanten te filteren. Onder verbeurte van een dwangsom dient Scarlet de nodige software te installeren en te beheren zodat bestandsuitwisseling via peer-to-peer software wordt gecontroleerd en bij eventuele inbreuken op het auteursrecht wordt geblokkeerd. Wegens onmogelijkheid van uitvoering kreeg Scarlet op haar verzoek echter tijdelijk uitstel.

Tegen het vonnis ging Scarlet vervolgens in hoger beroep bij het Hof van Beroep van Brussel. Hierin kreeg zij bij wijze van interventie de hulp van ISPA (Belgian internet service providers association), vertegenwoordigd door Geert Somers en Jos Dumortier van Time.lex, en van Belgacom. Scarlet benadrukte in haar hoger beroep dat het filteren een disproportionele maatregel is, verder het beoogde doel niet bereikt en dat het bovendien helemaal niet aan de ISP’s (meer specifiek de acces-providers) toekomt het internetverkeer te filteren.

In haar beslissing van 28 januari 2010 stelt het Brussels Hof van Beroep twee prejudiciële vragen aan het Europees Hof van justitie. Vooreerst vraagt zij of de nationale rechters, rekening  houdende met de Europese wetgeving, bevoegd zijn om aan internet-access-providers de verplichting op te leggen het peer-to-peer verkeer van haar klanten te controleren en om bij eventuele auteursrechtelijke inbreuken de overdracht van deze bestanden te blokkeren. Indien het hof oordeelt dat dit het geval is vraagt het Brussels Hof van Beroep in een tweede prejudiciële vraag of de rechter bij het opleggen van deze maatregel het proportionaliteitsbeginsel moet toepassen wanneer hij zich moet uitspreken over de effectiviteit en het ontradend karakter van de maatregel.

Door deze prejudiciële vragen van het Hof van Beroep wordt de verdere beslechting van deze zaak minstens anderhalf jaar uitgesteld. Dat het hof van Beroep de hulp van het Europese hof van justitie  inroept onderstreept dat zij zich bewust is van de impact die haar uitspraak kan hebben op de ISP's. Het antwoord van het hof wordt dan ook met spanning afgewacht.

Voor het arrest in pdf, klik hier.

Zaak Sabam tegen Scarlet naar het Europese Hof van Justitie. geschreven door Boris Tshiananga op 10-03-10 in News & announcements, E-pinion.

In a recent article on the Belgian ICT law market, time.lex was profiled by Corporate INTL as a leading law firm in this sector.  Edwin Jacobs was interviewed on behalf of time.lex on current issues in the domain, including predominant e-commerce questions and data protection concerns, both of which are issues in which time.lex has a particular expertise. Following the article, time.lex was identified as a Corporate INTL recommended firm.

Corporate INTL is an international on-line publication for business leaders, professional advisers and providers of finance throughout the world. For more information on Corporate INTL, click here.

Time.lex is a Corporate INTL recommended firm geschreven door Hans Graux op 10-03-10 in News & announcements.

Sedert oktober is Edwin Jacobs een erkende dienstverlener voor KMO-portefeuille binnen de pijler Advies. De KMO-portefeuille is de Vlaamse opvolger van de eerdere BEAmaatregel en de vroegere opleidings- en adviescheques. Het gaat om een stelsel waarmee Vlaamse KMO's en vrije beroepen financiële ondersteuning kunnen krijgen voor bepaalde aspecten van hun bedrijfsvoering, waaronder juridische ondersteuning binnen de adviespijler.

Deze erkenning geeft voor bepaalde dossiers die voldoen aan de toekenningsvoorwaarden recht op een overheidssteun ten belope van 50% van de dossierwaarde. Voor meer inlichtingen, klik hier.

Erkenning als dienstverlener voor KMO-portefeuille geschreven door Hans Graux op 10-03-10 in News & announcements.

In September, time.lex finalised a study examining  the legal framework for eHealth in each of the Member States, and identifying any regulatory barriers for the interoperable exchange of health information. The purpose of this study was to contribute to the creation of a framework for greater legal certainty of eHealth products and services' liability in the context of existing product liability legislation. The study, which was conducted for the European Commission - DG INFSO, identified and analysed the range of legal and regulatory frameworks for electronic health delivery and services in each Member State and proposed recommendations to facilitate cross-border services when provided via eHealth applications.

The final report of the study has now been published  by the European Commission, and can be downloaded here, along with individual country reports for each Member State. 

New report on the Legal framework of Interoperable eHealth in Europe geschreven door Hans Graux op 10-03-10 in News & announcements, E-health.

As a part of its policies on free consumer access to internet services in the EU, the European Commission recently requested time.lex to conduct a study in relation to spam, spyware and malicious software. The Study contains up-to-date information on the actions taken in EU Member States by competent national authorities and by electronic communication network and service providers against spam, spyware and malicious software. It was drafted on the basis of answers obtained from time.lex' national correspondent network, spanning all Member States.

 A full copy of the study can be found here, and the Commission's press release can be found here.

Time.lex study on Spam and Spyware published geschreven door Hans Graux op 10-03-10 in E-business, News & announcements, Privacy & data protection.

In the recent case of Infopaq / Danske Dagblades Forening, the Court of Justice was confronted with a number of  interesting questions regarding the legitimacy of creating and commercially exploiting brief automatically generated snippets of newspaper articles. Danish company Infopaq offered a clippings service, which consisted of the digitisation of newspaper publications and of analysing these for the presence of specific keywords, as requested by its customers. If a specific article contained a monitored keyword, Infopaq would copy that word along with the five words preceding and following it, to create an 11-word snippet. This snippet was then communicated to the customer, along with a source reference for the original article.

Danish newspaper industry body Danske Dagblades Forening (DDF) considered this to be an infringement of the copyrights that its member organisations held over these articles. Infopaq disagreed, and brough the matter before the Danish courts in order to obtain a declaratory ruling. DDF argued that the creation of the snippets constuted an unlawful reproduction of a protected work, whereas Infopaq held that its reproductive activity would be permissible under the exceptions created by the 2001/29 EC Copyright Directive. This Directive contains a specific exception for so-called transient or incidental acts of temporary reproduction, which do not require permission of the rights holder provided that they constitute an essential part of a technological process and whose sole purpose is to enable (a) a transmission in a network between third parties by an intermediary, or (b) a lawful use of a work or other subject-matter to be made, and which have no independent economic significance. Infopaq argued that this exception applied to the creation of its scans and the resulting snippets.The Danish Supreme Court (Højesteret) decided to request a preliminary ruling from the European Court of Justice.

However, the European Court of Justice rejected Infopaq's line of reasoning in its ruling of 16 July 2009. While the scanning of newspaper articles or the creation of digitised text files through OCR (optical character recognition) processes might be considered as a transient or incidental act of temporary reproduction, the Court rules that this qualification certainly wouldn't apply anymore to the finalised snippets communicated to Infopaq's customers: 

"By the last act of reproduction in the data capture process, Infopaq is making a reproduction outside the sphere of computer technology. It is printing out files containing the extracts of 11 words and thus reproduces those extracts on a paper medium. Once the reproduction has been affixed onto such a medium, it disappears only when the paper itself is destroyed." In short, the fact that the snippets were fixated in a more or less stable medium means that they cannot be considered to be transient in nature, and thus the appeal to the exception in the Copyright Directive is denied. 

Since the exception no longer applied, the Court ruled that the snippets could be a reproduction of a protected work:

"The possibility may not be ruled out that certain isolated sentences, or even certain parts of sentences in the text in question, may be suitable for conveying to the reader the originality of a publication such as a newspaper article, by communicating to that reader an element which is, in itself, the expression of the intellectual creation of the author of that article. Such sentences or parts of sentences are, therefore, liable to come within the scope of the protection provided for in Article 2(a) of that directive."

Of course, this should certainly not be taken to mean that any 11-word quote from a protected article automatically constitutes an infringement of the rights holder's copyright. In order for this to be the case, the quote itself would need to reproduce a sufficient number of key elements from the protected work that collectively are a reflection of the author's intellectual creation.

At least from a Belgian perspective, this criterion was already affirmed by the Court of Cassation in 2003 in relation to summaries of protected texts. In that specific case, the Court also ruled that a summary should be found to be infringing if it copies from the original text those elements which can be deemed to constitute its originality. The summary is to be considered a copy rather than a new (and potentially also protected) work if it reflects the protected characteristics of the original work to such an extent that the global impression left by both works differs insufficiently. This ruling of 25 September 2003 can be found here (in Dutch).

The new ruling of the Court of Justice thus seems to follow this same logic. While legally consistent, it is also clear that this test is frequently difficult to apply in practice and does not lend itself particularly well to new business models which rely on the automated creation or aggregation of short summaries. Undoubtedly, this will not be the last ruling in this domain.

Infopaq / Danske Dagblades Forening: automatically generated 11-word quotes can be infringing geschreven door Hans Graux op 10-03-10 in Copyright & other IP, E-business, News & announcements.

Hoe kan een HR consultant of werkgever sociale media inzetten om kandidaten te vinden en succesvol te contacteren? En hoe zit het dan met de privacy? Mag ik de gevonden informatie in overweging nemen bij de beoordeling van een CV? Welke rechten heeft de werknemer bij het gebruik van sociale media of internet in het bedrijf? Mag ik controleren of mijn medewerkers op internet surfen of op een sociaal netwerk zitten tijdens de werkuren? Mag ik een werknemer ontslaan omwille van overdreven internetgebruik tijdens de werkuren? Van wie zijn de contactgegevens in een sociaal netwerk eigenlijk? Mag mijn ex-medewerker die gebruiken na zijn ontslag?

Op deze en andere vragen vindt u een antwoord in onze bijdrage "FAQ over juridische aspecten van HR & sociale media" in het nieuwe boek van An De Jonghe, Sociale Media voor HR Professionals, een publicatie die een praktijkgerichte multidisciplinaire blik biedt op de mogelijkheden en risico's van sociale media.

Voor meer informatie en bestellingen verwijzen we naar de homepage van de publicatie.

Publicatie: Sociale Media voor HR Professionals geschreven door Hans Graux op 10-03-10 in News & announcements.

A recent judgment of the European Court of Justice of 7 May 2009 (Case C-553/07) has important consequences for the question how long access logs need to be archived when an application provides access to personal data.

Article 12 of the European Data Protection Directive 95/46/EC dealing with the ‘right of access' states that every data subject has the right to obtain from the controller "without constraint, at reasonable intervals and without excessive delay or expense, confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed". In Belgium this provision has, almost literally, been transposed in Art. 10 of the Law of 8 December 1992.

One of the practical consequences of the data subject's access right is the duty, for controllers, to keep log files in order to be able to provide the list of recipients to whom the data have been disclosed. How essential this obligation is considered in the context of the privacy protection has been demonstrated last year in the judgment of the European Court of Human Rights in the "I v. Finland" case.

An important question is how far backwards in time a data subject can request information as to the recipients or categories of recipients to whom the personal data have been disclosed.

Mr Rijkeboer requested the local administration of the city of Rotterdam to notify him of all instances in which data relating to him from the local-authority personal records had, in the two years preceding the request, been disclosed to third parties. He wished to know the identity of those persons and the content of the data disclosed to them. Mr Rijkeboer, who had moved to another municipality, wanted to know in particular to whom his former address had been disclosed.

Unfortunately for Mr Rijkeboer the Dutch law on personal data held by local authorities (Wet gemeentelijke basisadministratie persoonsgegevens) provides that the local authority is to retain details of any communication of data for one year following that communication. According to this provision the data requested by Mr Rijkeboer dating from more than one year prior to his request were automatically erased.

Mr Rijkeboer lodged a complaint with the local authority against the refusal to give him the requested information relating to the recipients over the two years preceding his request. That complaint having been rejected, the case finally came to the Raad van State which decided to stay the proceedings and to refer a prejudicial question to the European Court of Justice.

In its judgment of 7 May 2009 the ECJ emphasizes first that a data subject should be able to control that his personal data are processed in a correct and lawful manner, that is to say, in particular, that the basic data regarding him are accurate and that they are disclosed to authorised recipients.

With regard to the right to obtain information on the recipients or categories of recipient of personal data and on the content of the data disclosed, the Directive does not make it clear whether that right concerns the past and, if so, what period in the past.

First the ECJ confirms that this right must of necessity relate to the past. If that were not the case, the data subject would not be in a position effectively to exercise his right to have data presumed unlawful or incorrect rectified, erased or blocked or to bring legal proceedings and obtain compensation for the damage suffered.

As to the scope of that right in the past, the Court states, in the second place, that the setting of a time-limit with regard to the right to access to information on the recipients or categories of recipient of personal data and on the content of the data disclosed must allow the data subject to exercise the different rights laid down in the Directive. The length of time the basic data are to be stored may constitute a useful parameter without, however, being decisive. Where the length of time for which basic data are to be stored is very long, the data subject's interest in exercising the rights to object and to remedies, may diminish in certain cases. If, for example, the relevant recipients are numerous or there is a high frequency of disclosure to a more restricted number of recipients, the obligation to keep the information on the recipients or categories of recipient of personal data and on the content of the data disclosed for such a long period could represent an excessive burden on the controller.

Following the judgment of the ECJ a number of parameters may accordingly be taken into account in particular the applicable legal provisions on time-limits for bringing an action, the more or less sensitive nature of the basic data, the length of time for which those data are to be stored and the number of recipients.

In the particular case of Mr. Rijkeboer the ECJ estimates that rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of one year and correspondingly limiting access to that information, while basic data is stored for a much longer period, do not constitute a fair balance of the interest and obligation at issue, unless it can be shown that longer storage of that information would constitute an excessive burden on the controller.

In Belgium the law doesn't fix a time-limit for storage of information on the recipients or categories of recipient of personal data. Consequently the controller needs to establish himself a balance between, on the one hand, the interest of the data subject in protecting his privacy and, on the other, the burden which the obligation to store that information represents for the controller.

ECJ Judgement in the Rijkeboer Case geschreven door Jos Dumortier op 10-03-10 in Privacy & data protection, News & announcements.

time.lex werd twee jaar geleden opgericht. Inmiddels zijn we uitgegroeid tot een vooraanstaand nichekantoor. Onze focus ligt op telecommunicatie, IT/IP, media en e-business. Onze cliënten variëren van multinationals en de Europese, federale en regionale overheden tot en met start-ups. Een goede work/life balance en autonoom en flexibel werken is onderdeel van de kantoorfilosofie. 


Onze ploeg heeft uitbreiding nodig wegens aanhoudende groei. 
Wij zijn op zoek naar nieuwe voltijdse of deeltijdse kantoorgenoten:

• ervaren advocaat-medewerkers 
met minimaal 4 jaar ervaring in ICT-recht
• gevorderde advocaat-stagiaires 
met kennis van en interesse in ICT-recht

Je dient over de volgende eigenschappen en ervaring te beschikken:

• Aantoonbare affiniteit met ICT- en mediarecht
• Een goede kennis van het Nederlands, Engels en Frans
• In staat om zelfstandig te werken

Indien je zelf je eigen expertise of bepaalde gebieden binnen ICT verder zou willen uitbouwen, dan krijg je daartoe de kans. Wij waarderen eigen initiatief. Wij bieden ook de mogelijkheid om opleidingen te volgen. Het actief participeren in de ICT sector door het geven van lezingen of te publiceren wordt aangemoedigd. Wij kunnen je hierbij begeleiden.

Aantrekkelijk en competitief vergoedingspakket in functie van ervaring en mogelijkheden.


Zin in leven en carrière? Stuur dan je CV naar Edwin Jacobs, edwin.jacobs@timelex.eu, of 0476/40.11.70

Vacature time.lex geschreven door Hans Graux op 10-03-10 in News & announcements.