ADVANCED BUSINESS LAW Contrebande
ADVANCED BUSINESS LAW Contrebande
ADVANCED BUSINESS LAW Contrebande
SESSION 1
INTRODUCTION
Jurisdiction: A jurisdiction is a national legal system. The tribunal’s jurisdiction is its scope of
authority or competence.
International disputes
Fundamental questions are:
- Which jurisdiction is enforcing it?
- What law is applied?
Hold on… You mean a judge in the UK may apply French law? But aren’t there international
tribunals? What about the European Court of Justice or the European Court of Human Rights?
Is there no ‘international law’?
A. WHAT IS A CONTRACT?
The law of contract varies from one country to another one given the different legal systems.
French law: “a contract is an agreement by which one or more persons obligate themselves
to one or more other persons to give, or to do or not to do, something.”
American Second Restatement on Contracts: “a contract is a promise or a set of promises for
the breach of which the law gives a remedy or the performance of which the law in some way
recognizes as a duty.”
English law doesn’t provide a legal definition of contract owing to the fact it is judge-made-
law (absence of written law).
In short, a contract is the result of an agreement concluded between the parties which generates
legal rights and obligations for both of them.
The international character of a contract may be defined in a great variety of ways, ranging
from a reference to:
- legal criterion: is international a contract that contains a foreign element, meaning
it is in contact with one or more foreign legal systems, e.g. the place of business or habitual
residence of the parties in different countries, the nationality of the parties.
- economic criterion: is international a contract that affects the interests of
international trade or that involves a transfer of goods and/or services
- Letter of intent: non-binding unless it is shown that an agreement was in fact reached by
the parties – importance of the contents/intention or commitments.
- Agreement in principle: non-binding unless it contains the necessary elements of a
contract, matter of appreciation by the court.
- Memorandum of Understanding: the parties agreed on specific issues to be discussed
during the negotiations: confidentiality, exclusivity, good faith, disclosure of parallel
negotiations, due diligence
Breach of the negotiations: damages for tort (bad faith, abuse of right) and not for contractual
liability unless exceptions.
B. MODALITIES/CONDITIONS OF THE FORMATION OF THE CONTRACT
The offer must be “sufficiently definite” and indicate the “intention of the offeror to be
bound” in case of acceptance. It will simply be, otherwise, an invitation to negotiate.
Possible cancellation of the offer when it has not yet reached the other party or not before
the end of the time limit fixed by the offeror or within a reasonable time limit.
The acceptance must be “clear” and “simple”. It does not need to take any particular form of
words. An acceptance may be by conduct and exceptional silence.
- Freedom to fix the rules governing their relationship (focus on the parties’ rights and
obligations; choice of the applicable law, see above; choice of the settlement of the dispute,
arbitration vs court proceedings)
- Limits: mandatory rules (domestics or EU law) failing which the contract or the contractual
clause may be deprived of its effect.
In absence of any choice by the parties, determination of the applicable law to the contract
will be made according to:
- conflict of laws
- Rome Regulation of the applicable law to the contractual obligations
. principle of autonomy of the parties
. in absence of any express or tacit choice of law, application of the criteria which is “most
connected to the contract”.
Examples:
A contract for the sale of goods shall be governed by the law of the country where the seller
has his habitual residence.
A contract for the provision of services shall be governed by the law of the country where the
service provider has his habitual residence.
A franchise contract shall be governed by the law of the country where the franchise has his
habitual residence.
- Force majeure the event is unforeseeable, beyond the will of the parties and irresistible,
thus making the performance of the contract impossible
- Hardship: unforeseeable situation beyond the control of the parties, which affects the
equilibrium of the contract, making the performance of the contract more expensive for one
party, does not free the disadvantage party in principle, possible renegotiations.
VOCABULARY:
The ‘v’ means ‘versus’ but is pronounced ‘and’.
When a contract is signed, the technical word is ‘executed’.
When you send somebody to court, you ‘sue’ them.
SESSION 2: BUSINESS DISPUTE RESOLUTION (LITIGATION, MEDIATION,
ARBITRATION)
I. WHAT IS NEGOTIATION?
Negotiating is a basic means of getting what you want from others. It is back-and-forth
communication designed to reach an agreement when some interests are shared and others are
opposed.
Negotiation is done directly by the parties in conflict (not assisted by a third-party neutral like
a mediator or arbitrator).
A) PRINCIPLED-BASED NEGOTIATION
I.WHAT IS MEDIATION?
A) CHARACTERISTICS OF MEDIATION
- is on almost all business matters (national legislations usually only exclude ordre
public, labor or employment matters)
- involves an international element (parties or companies established in different
countries, many connection points pointing to different legal systems, languages etc.)
- more flexible, parties take control of the process and may generate more creative
and less relationship-damaging solutions
- parties choose a mediator based on specific characteristics (expertise, nationality,
profession, languages, mediation styles etc.)
- it can be combined with other ADR (Med-Arb clause) to improve the changes of
solving the dispute
- Non-mandatory mediation: the parties may at any time, without prejudice to any other
proceedings, seek to settle any dispute arising with the present contract in accordance with the
International Chamber of Commerce mediation rules.
- Mandatory mediation: in the event of any dispute arising with the present contract, the
parties agree in the first instance to discuss and consider referring the dispute to the ICC
mediation rules.
- Med-Arb: in the event of any dispute arising with the present contract, the parties shall first
refer the dispute to proceedings under the ICC Mediation Rules. If the dispute has not been
settled pursuant to the said Rules within 45 days following the filing of a Request for Mediation
or within such other period as the parties may agree in writing, such dispute shall thereafter be
finally settled under the Rules of Arbitration of the International Chamber of Commerce by
one or more arbitrators appointed in accordance with the said Rules of Arbitration.
Arbitration is a process by which a private third neutral party renders a binding determination
of an issue in dispute.
A. CHARACTERISTICS OF ARBITRATION
- arbitration is another form of ADR, it is adjudicative (the arbitrator, not the parties
decide the conflict, unlike negotiation and mediation)
- arbitration can be domestic or international (involving parties, transactions, goods
and services rendered across jurisdictions)
- the arbitrator can be single (called ad-hoc) or collegiate (or institutional arbitration)
- the binding determination of an arbitration is called an award, while the binding
determination of a Court is called a judgment
- the enforcement of arbitral awards requires the collaboration of a country’s legal
system (the arbitrator lacks imperium). State’s laws require parties to honor their
contractual obligation to arbitrate, provides for limited judicial supervision of arbitral
awards (no appeal, usually only annulment based on serious grounds) and supports the
enforcement of the arbitral awards.
Enforcement of award: If a party does not comply with an award, the other party may
apply to a court for the recognition and enforcement of the award using that court’s
enforcement processes
The tribunal’s powers and duties are fixed by the terms of the parties’ agreement (including,
in particular, any arbitration rules which have been adopted) and the national laws which apply
in each case.
The tribunal is obliged to follow due process and ensure that each party has a proper opportunity
to present its case and defend itself against that of its opponent. However, in other respects, the
procedure can be very flexible.
Ad hoc arbitration = An ad hoc arbitration is not administered by any institution; the parties
have to determine by themselves all aspects of the arbitration (number of arbitrators,
appointment process, substantive applicable law, procedure for conducting the arbitration etc.)
Parties can also refer to national laws, institutional rules or soft regulations (UNCITRAL)
May be cheaper than institutional arbitration. However, it may increase the chance of
revision of the award by a Court of law.
Difference between international and national contracts for arbitration: the example of French
law:
French Supreme Court (Cassation): Constantly affirming Arbitrage as the ‘normal way of
resolving disputes of international business’.
The UK has encouraged private arbitration to find solutions outside courts. For instance, the
real estate business, even B2B, is regulated by UK Housing Act 2004, and it is mandatory to
offer arbitration through government authorized “deposit protection” scheme.
In case of issue, both parties can agree not to form a small claim court filling and accept an
arbitrage instead, which is already paid for and quicker.
Arbitration Litigation
Private proceedings Public proceedings
Adjudicated by experts in the field Adjudicated by a generalist judge
Confidential No guarantee on confidentiality
Can be fast Can be slow
Expensive (it depends) Expensive/Cheaper (it depends)
Autonomy of the parties (law, Parties have no say on the process, who the judge
arbitrators, etc.) is etc.
Easier enforcement of foreign award Difficult enforcement or foreign judicial
decisions
TO SUM UP:
Litigation may not always be suitable to solve international business disputes. There are
different ADR methods to choose from (negotiation, mediation, arbitration), each of them with
advantages and disadvantages. No method is better in absolute terms, selection depends on the
specificities of each case, costs, relationship management, etc. A manager must select the best
dispute resolution tool strategically. Combinations of different ADR methods is possible.
SESSION 3: INTERNATIONAL CONTRACTS AND COMPLIANCE-RELATED
ISSUES
A. INTRODUCTIVE NOTIONS
Intellectual property refers to creations of the mind, such as inventions; literary and artistic
works; designs; and symbols, names and images used in commerce.
We have IP to save creators interests; to encourage the production and circulation of creativity
and innovation; to boost the competition in the market.
B. COMMON PRINCIPLES
1. Exclusivity
IPRs are property rights -> they create monopolies
Exclusive rights are strongly criticized by part of the doctrine mainly because:
- they limit creativity and innovation that could be fostered by the current
technological facilities
- they mainly protect the interests of big firms and limit the SMEs in accessing the
market
2. Intangibility
Intangibles are obiquous (omnipresent) and therefore in more places at the same time.
Rights on the tangible item and on the intangible creation/invention are independent and
circulate autonomously.
Because of the internet, IRPs circulate broadly and can be explained in different countries at
the same time.
3. Territoriality
IPRs are protected only within the limits of the State that granted them.
Which law is applicable? The applicable law is the one of the country where the IPR is
exploited/infringed.
Specifically, TRIPS requires WTO members to provide copyright rights, covering authors and
other copyright holders, as well as holders or related rights, namely performers and
broadcasting organizations; geographical indications; industrial designs; integrated circuit
layout-designs, patents, new plant varieties, trademarks; trade names and undisclosed or
confidential information.
II.PATENT
A. UTILITY PATENT
The utility patent is a form of legal protection granted to the functional aspect of an item, such
as the discovery of any new and useful process, machine, manufacture or composition of matter.
B. DESIGN PATENT
A design patent is a form of legal protection granted to the ornamental design of a functional
item. Design patents are a type of industrial design right. Ornamental designs of jewelry,
furniture, beverage containers, and computer icons are examples of objects that are covered by
design patents.
C. DIFFERENCES
III.TRADEMARK
IV.COPYRIGHT
Copyright is the exclusive right given to the creator of a creative work to reproduce the work,
usually for a limited time. The creative work may be in a literary, artistic or musical form.
Copyright is intended to protect the original expression of an idea in the form of a creative
work, but not the idea itself. It is often share among multiple authors, each of whom holds a set
of rights to use or license the work, and who are commonly referred to as right holders. These
rights frequently include reproduction, control over derivative works, distribution, public
performance, and moral rights such as attribution.
Copyright infringement (piracy) is the use of works protected by copyright law without
permission for a usage where such permission is required.
Copyright (common low) and the “right of the author” (civil code)
It could be said that the Latin version of authors’ rights puts the emphasis on the author as a
person, as opposed to the Anglo-Saxon copyright, literally the right to copy, associated with the
work itself.
These systems, however, are not perfectly homogenous, nor are they diametrically different in
their application.
In Australia, an author has three moral rights:
- the right to be identified as he author of their work (the right of attribution)
- the right not to have a person falsely assert or imply that they are the author of the work (the
right no to have authorship falsely attributed)
- the right not to have their work subjected to derogatory treatment which is prejudicial to their
honor or reputation (right of integrity of authorship).
V.TRADE SECRET
Trade secrets are not disclosed to the world at large. Instead, owners of trade secrets seek to
protect trade secret information from competitors by instituting special procedures for handling
it, as well as technological and legal security measures. Legal protections include non-
disclosure agreements and work-for-hire and non-compete clauses.
Misappropriation = Companies often try to discover one another’s trade secrets through
lawful methods and reverse engineering or employee poaching on one hand, and potentially
unlawful methods including industrial espionage on the other. Acts of industrial espionage are
generally illegal in their own right under the relevant governing laws, and penalties can be
harsh. The importance of that illegality to trade secret law is: if a trade secret is acquired by
improper means, then the secret is generally deemed to have been misappropriated.
Copyrights and patents stimulate creativity in the fields of arts and literatures, and innovations
in the field of science and industry.However, they should be a bit re-designed for fostering
creativity and innovation.
Some protectionist people want to modify the copyrights and patents for different reasons:
- To extend to other fields, like photography, database, etc.
- To create some functional creations covered by copyright, like software, databases,
designs
- To wider the scope of protection (more rights and longer)
- To increase the available protection (protection of semiconductors, double protection
of designs, etc.)
CHAPTER 4: EMPLOYMENT
Employment law is something technical and complex. We will focus on the following:
- French employment law
- UK and Common law employment law
- EU and International public body regulation impact on employment law
The right to work is a right that in all jurisdiction, is automatic for citizens.
Article 23 of the Universal Declaration of Human Rights:
Everyone has the right to work, to free choice of employment, to just and favorable conditions
of work and to protection against unemployment. Everyone, without any discrimination, has
the right to equal pay for equal work.
Some countries have bilateral agreements authorizing citizens of other countries to work
automatically. In other cases, the right to work is subject to a Visa requirement.
The ILO (International Labor Organization) was established in 1919. Now it is an agency of
the United Nations, and it is charged with setting universal labor standards. It is a tripartite
body comprising representatives of government, employers and workers. De-colonization
has meant that its membership has grown from 52 states in 1946 to 177 in 2003. The 1944
Declaration of Philadelphia redefined the ILO’s objectives and reaffirmed the key principles on
which the ILO is based:
- labor is not a commodity
- freedom of expression and association are essential to sustained progress
- poverty anywhere constitutes a danger to prosperity everywhere.
ILO standards are set by the International Labor Conference in the form of conventions and
recommendations. If a state ratifies a convention, it undertakes to ensure that its domestic
law conforms to the convention’s standards. Recommendations do not create legal
obligations. Any dispute relating to ratified conventions can be referred to the International
court in Justice in The Hague. The effectiveness of the ILO and of labor standards has been
widely criticized. In particular, it lacks effective sanctions against states which argue that
downscaling labor standards is necessary to remain competitive and attract investment.
II. FRENCH EMPLOYMENT LAW (BASICS)
French law makes a distinction between Public and Private. Workers in public jobs are not
subject to the Employment code, and in case of litigation, they cannot sue a public body in an
Employment Tribunal, instead they need to go to an Administrative Court.
In France, the legal length of the working week is 35 hours in all types of companies. The
working day may not exceed 10 hours. Furthermore, employees may not work for more than
4,5 hours without a break. The maximum working day may be extended to 12 hours under a
collective agreement. Overtime must be paid for as follows:
- 25 percent an hour for each of the first eight hours of overtime
- 50 percent for each hour after that.
Annual paid leave: works are then entitled to two and a half working days leave for each month
worked (5 weeks per year)
In France, in top of Employment Code, most jobs are subjects to Bargaining agreements, these
can be:
- per type of business
- at branch level
- at company level
In France, Employment law is therefore discussed by employers’ unions, employees’ unions
and sometimes the French government, these are referred to as the Social Partners. In particular,
in first degree of jurisdiction for private work, these Social partners are giving an advice in
Council of Prudhomme.
The principle of Unions are social care for workers is fundamental of French law, and is part of
the Constitution, these are referred as the “principles particularly necessary to our time”.
Losing a job may be the fact of the employee (resignation) or from employer with lay off; or
mutual agreement of both with compromise agreement.
The termination may be for economic reasons, when the company has financial difficulties: is
at the initiative of employer, for one or more causes not linked to the person, and resulting in
suppression or transformation of the job.
Any other cause for laying off staff has to be real and serious. Employees can legally be laid
off as a result of a ‘faute grave’ or ‘faute lourde’ (gross negligence or willful misconduct) but
not for small negligence. Nevertheless, a repetition of small negligence can be considered as a
gross negligence.
Rules are technical and complex, but as a general principle, the more the employee is the cause
for his termination from economical to willful misconduct will impact the exit package.
The free labor market model: this was gradually introduced from 1979 to support the wider
economic policies of Thatcherism. It decisively broke the prevailing consensus on industrial
relations policy – which, admittedly, had been subject to considerable strains since the 60s. The
principles underlying this model were reflected in several broad policy approaches:
- deregulation of the labor market. This involved the removal of certain protective
measures for employees which were characterized as ‘burden on business’.
Furthermore, EU employee protection policies were challenged because they were seen
as obstructing overriding free market objectives
- cost-effectiveness, competitiveness and flexibility in the use of labor.
- individualism in the employment relationships and the marginalizing of collective
interests and collective representation
- the curbing of trade unions power by abolishing, rather than reforming, statutory
recognition rights and by constraining unions’ ability to organize industrial action. The
policies pursued were principally driven by the economic interest of employers.
Arguably, the countervailing interests of working people received much less
consideration. The exceptions were in relation to discrimination law and health and
safety. Here the initiatives to improve protection largely derived from EU policies and
from ruling of the European court of justice
B. TYPES OF EMPLOYMENT STATUS IN THE UK: EMPLOYEE, WORKER OR
SELF-EMPLOYED
> Employee status: an employee is an individual who has entered into or work under the terms
of a contract of employment. The contract can be expressly agreed (in writing or orally) or
implied by the nature of the relationship. To have an employee status:
- an individual must be obliged to do the work personally
- the employer needs to be obliged to provide the work and the employee is obliged to
accept the work
- the employer needs to have some control over the way the employee carries out the
work
> Worker status: worker status is sometimes seen as a ‘half-way house’ between employee
and self-employed status. Workers are entitled to fewer statutory rights than employees, but do
have some key legal rights, including:
- protection from discrimination
- protection against unlawful deduction from wages
- entitlement to the national minimum wage
- self-employed status (the self-employed enjoy no statutory employment rights)
What is the significance of the distinction? Legal protections: some core legal protections
only apply to employees. For example, the rights not to be unfairly dismissed and the right to
receive a statutory redundancy payment.
Health and safety: employers owe employees statutory health and safety protection. Self-
employed contractors may not be covered under these duties, although they will be covered
under an employer’s occupier’s liability.
> Self-employed: a person is self-employed if they run business from themselves and take
responsibility for its success or failure. Self-employed workers aren’t paid through PAYE, and
they don’t have the employment rights and responsibilities of employees.
Employment rights = Employment law doesn’t cover self-employed people in most cases
because they are their own boss. However, if a person is self-employed: they still have
protection for their health and safety, and in some cases protection against discrimination.
Their rights and responsibilities are set out by the terms of the contract they have with their
client.
Someone is probably self-employed and doesn’t have the rights of an employee if they’re
exempt from PAYE and most of the following are also true:
- they put in bids or give quotes to get work
- they’re not under direct supervision when working
- they submit invoices for the work they’ve done
- they’re responsible for paying their own National Insurance and tax
- they don’t get holiday or sick pay when they’re not working
- they operate under a contract (contract for services or consultancy agreement) that uses
terms like self-employed, consultant or independent contractor.
C. THE ZERO-HOUR CONTRACT (ZHC)
A zero-hour contract is a type of contract between an employer and a worker, where the
employer is not obliged to provide any minimum working hours, while the worker is not obliged
to accept any work offered.
The employee may sign an agreement to be available for work as and when required, so that no
particular number of hours or times of work are specified. Depending on jurisdiction and
conditions of employment, a zero-hour contract may differ from casual work. They are often
used in agriculture, hotels and catering, education and healthcare sectors. They are used to
enable on-call scheduling.
Zero-hours workers are entitled to statutory annual leave and the National Minimum Wage in
the same way as regular workers.
You cannot do anything to stop a zero-hour worker from getting work elsewhere. The law says
they can ignore a clause in their contract if it bans them from looking for work, accepting work
from another employer. You are still responsible for health and safety of staff on zero-hours
contracts.
Redundancy: your employer can declare your job redundant if the requirement for the work you
are doing has either ceased or diminishing. It does not automatically follow from being put at
risk of redundancy that it is you who will ultimately be made redundant. It depends on the
criteria for selection that your employer adopts.
Dismissal is when your employer ends your employment – they don’t always have to give you
notice. If you’re dismissed, your employer must show they’ve a valid reason that they can
justify, acted reasonably in the circumstances.
They must also:
- be consistent (do not dismiss you for doing something they let others do)
- have investigated the situation fully before dismissing you
> Unfair dismissal; your dismissal could be unfair if your employer doesn’t:
- have a good reason for dismissing you
- follow the company’s formal disciplinary
> Constructive dismissal: is when you’re forced to leave your job against your will because
of your employer’s conduct.
The reasons you leave your job must be serious, for example they:
- don’t pay you or suddenly demote you for no reason
- force you to accept unreasonable changes to how you work (tell you to work night
shifts when your contract is only for day work)
- let other employees harass or bully you.
Your employer’s breach of contract may be one serious incident or a series of incidents that are
serious when taken together.
You should try and sort any issues out by speaking to your employer to solve the dispute. If
you do have a case for constructive dismissal, you should leave your job immediately – your
employer may argue that, by staying, you accepted the conduct or treatment.
A Belgian Muslim female citizen working as security agent for G4S in Belgium refused to
remove her hijab, despite her employer stating an internal regulation on the staff neutrality of
clothing.
She was eventually dismissed and filed against her employer on discrimination for religion
grounds. G4S counter-argued it was their right to keep a religiously neutral image for their
clients.
The case was escalated up to the Belgium Supreme court, which forwarded it to the ECJ asking
to clarify if this was or wasn’t discrimination under EU law.
The court verdict: "the prohibition on wearing an Islamic headscarf, which arises from an
internal rule of a private undertaking prohibiting the visible wearing of any political,
philosophical or religious sign in the workplace, does not constitute direct discrimination based
on religion or belief within the meaning of that directive.“ (Directive 2000/78/EC — Equal
treatment )
The finances of the state are based on a model where most people in society are full time
employees, with employer and employee paying taxes.
Case law is facing worldwide challenges on how to qualify the “gig economy”.
Uber UK (UK Court of Appeal declared Uber as Workers status, being forwarded to UK
Supreme Court)
Two of the judges found that Uber exerted a high degree of control over drivers, entitling them
to the status of worker. They also supported the view that having the Uber app switched on and
being ready to work was enough to constitute working.
In a dissenting judgment, Lord Justice Underhill equated the relationship between Uber and its
drivers to that of a standard minicab company – a business model where drivers are considered
to be self-employed. He said that while Uber's technology was much more sophisticated, the
position taken by the company was neither unrealistic nor artificial. He went on to say that
giving gig economy workers greater protection required statutory intervention.
Deliveroo France : 09/11/2017 Court of Appeal of Paris rejects the claim that a bicycle delivery
person would hold a contract of employment.
Uber France Court of Appeal of Paris requalified Uber as Employment contracts (10/01/2019),
and forwards the case to Cassation
Employment tribunals are slow, cost lawyer fees and administration fees, and during the
proceedings it is sometimes difficult to work in another job. As such, before an employee
decides to file a lawsuit with an employment tribunal, it is very important to consider that
whatever happened before, it is unlikely that the employee will ever go back to do the same job,
but instead may win monetary compensation.
Common Law Courts are always inviting parties to negotiate a solution by themselves
whenever possible. If successful, the negotiation will take the form of a “Without Prejudice”
letter and after acceptation a “Compromise Agreement”. In UK law a Compromise agreement
has to be reviewed by a solicitor working for the employee, and in most cases, the employer
will refund part of these costs.
In France, litigation is free, in the UK to reduce the number of cases heard by courts, fees were
introduced, then abolished by the UK Supreme Court in 2017.
Databases containing data on people are source of potential economic value, as well as a
potential threat on personal freedoms.
The increased digitalization of the world has increased the volume of data existing on people,
which can be used for many purposes.
Regulations on data were initially connected to Privacy and Security for people, and are directly
connected to the development of Computer Engineering.
In France, an Independent Public Body (CNIL) was created to regulate these issues since
1978.
Personal data are ‘any information about an individual maintained by an agency, including
any information that can be used to distinguish or trace an individual’s identity, such as name,
social security number, date and place of birth, mother’s maiden name or biometric records,
and any other information that is linked or linkable to an individual, such as medical,
educational, financial and employment information.’
Personal Data: Exponential regulation adapting to the boom of IT
Why is the EU a lot more advanced on personal data protection compared to the US?
A large influence of German law into EU law.
During the war, use of personal data on a large scale made the identification of target of nazi
identifiable.
FRG (West Germany) was observing (GDR (East Germany) methods and it became a strong
political drive to protect personal data from Government.
Data protection is not explicitly enshrined in Germany’s constitution, aslo known as the Basic
Law, but is does enjoy protection by virtue of what is known as the census ruling by Germany’s
highest court. Inn this 1983 landmark case, the court decided that citizens have a basic right to
self-determination over their personal data.
- the data subject has given consent to the processing of his or her personal data for one or
more specific purposes
- processing is necessary for the performance of a contract to which the data subject is party
or in order to take steps at the request of the data subject prior to entering into a contract
- processing is necessary for compliance with a legal obligation to which the controller is
subject
- processing is necessary in order to protect the vital interests of the data subject
- processing is necessary for the performance of a task carried out in the public interest or in
the exercise of official authority vested in the controller.
- processing is necessary for the purposes of the legitimate interests pursued by the controller
or by a third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject, which require protection of personal data, in particular
where the data subject is a child. This does not apply to processing by public authorities.
B. PERSONAL DATA
Types of data: there are two main types of data under the GDPR: personal data and special
category personal data.
Personal data: under the GDPR, personal data is the data that related to or can identify a living
person, either by itself of together with other available information (a person’s name, phone
number, bank details and medical history).
Organizations that collect or use personal data are known as data controllers and data
processors.
The data controller determines the purposes for which and the means by which personal data is
processed. So, if your company decides why and how personal data should be processed, it is
the data controller. Employees processing personal data within your organisation do so to fulfil
your tasks as data controller.
The data processor processes personal data only on behalf of the controller. The data processor
is usually a third-party external to the company. However, in the case of groups of undertakings,
one undertaking may act as a processor for another undertaking.
The duties of the processor towards the controller must be specified in a contract or another
legal act. For example, the contract must indicate what happens to the personal data once
the contract is terminated. A typical activity of processors is offering IT solutions, including
cloud storage. The data processor may only sub-contract a part of its tasks to another processor
or appoint a joint processor when it has received prior written authorization from the data
controller.
Special category personal data means personal data relating to any of the following:
- the data subject’s racial or ethnic origin, their political opinions or their religious or
philosophical beliefs
- whether the data subject is a member of a trade union
- the data subject’s physical or mental health or condition or sexual life
- whether the data subject has committed or allegedly committed any offence
- any proceedings for an offence committed by the data subject, the disposal of such
proceedings or the sentence of any court in such proceedings
The processing of special category data is prohibited unless the data subject has given
their explicit consent before processing begins or the processing is authorized by the law, for
example, to protect the interests of a data subject, to comply with employment legislation or for
reasons of public interest.
Personal data relating to criminal convictions and offences may only be processed under the
control of an official authority.
Data subjects: a data subject is the individual to whom the personal data relates.
Data controller: persons or organisations that determine the purpose and means of processing of
personal data. Examples of data controllers include medical professionals, banks, government
departments, and voluntary organisations. A local hairdresser or supermarket may be a data controller
if that business keeps customer details on file, for example, to make appointments or to operate a
promotional points system.
Data processors are persons or organisations that process personal data on behalf of a controller.
Examples of data processors include payroll companies and market research companies, all of which
may hold or process personal information on behalf of a data controller. The GDPR defines data
processing as any operation(s) performed on personal data, for example, collecting, storing, distributing
or destroying.
Many controllers also process personal data and do not require a separate data processor.
Profiling: is a specific form of processing; it means any form of automated processing of personal data
to evaluate certain personal aspects for any person. For example, the processing of data to analyse or
predict a person's performance at work, economic situation, health, personal preferences, interest,
behaviour, location or movement.Controllers and processors who carry out profiling have to inform data
subjects about how the profiling mechanism works before processing.
A. SHARED PRINCIPLES
There are three shared principles: (1) loyalty; (2) proportionality; (3) purpose-bond.
- Loyalty: the data controller acts in good faith, and lets the data subject know the purposes of
the data treatment.
- Proportionality: a balance between the data controller, the data subject, the use of data, the
purpose, and the duration of the data retention.
The data subject has three main rights: (1) the right to access; (2) the right to rectify, update,
and remove; (3) the right to oppose data processing.
1-Right to Access = anyone can access the entire set of her/his data, upon a mere request.
She/he can receive a copy of its data. The data controller has to answer in the two-months
following the request. However, the data controller can refuse abusive access requests, and
the controller can reject the access request when data are stored in a way that the infringement
of data subjects’ privacy is excluded, and for a lapse of time not exceeding the time necessary
for statistics or research purposes.
2-Right to Rectify, Update, and Remove = each data subject can ask to correct or update
her/his data. In order to make sure that the request is successful, a data subject can ask to a data
controller the evidence of any requested modification, for free.
3-Right to Oppose Data Processing = the data subject has the right to oppose to the data
process as far as his/her personal data are concerned for legitimate reasons:
• - She/he has the right to oppose to the data process for the purpose of receiving
advertising material upon request and for free
• - She/he has the right to be informed before the data are communicated to third
parties for the purpose of receiving advertising material, as well as to be informed of the
possibility to oppose such a communication.
There are strict principles of data protection under the GDPR. Data controllers are responsible
for these principles and must be able to show that they comply with them. Data processing
under the GDPR is lawful only if it satisfies one the defined legal bases of lawful processing.
Consent must also be given by data subjects.
The GDPR primarily applies to controllers and processors located in the European Economic
Area with some exceptions. Individuals risk losing the protection of the GDPR if their personal
data is transferred outside the EEA.
On that basis, the GDPR restricts transfers of personal data outside the EEA, or the protection
of the GDPR, unless the rights of the individuals in respect of their personal data is protected
in another way, or one of a limited number of exceptions applies.
A transfer of personal data outside the protection of the GDPR most often involved a transfer
from inside the EEA to a country outside the EEA.
1. Are we planning to make a restricted transfer of personal data outside of the EEA?
If no, you can make the transfer. If yes go to Q2
2. Do we need to make a restricted transfer of personal data in order to meet our purposes?
If no, you can make the transfer without any personal data. If yes go to Q3
3. Has the EU made an ‘adequacy decision’ in relation to the country or territory where the
receiver is located or a sector which covers the receiver?
If yes, you can make the transfer. If no go to Q4
4. Have we put in place one of the ‘appropriate safeguards’ referred to in the GDPR?
If yes, you can make the transfer. If no go to Q5
Example
A family books a holiday in Australia with a UK travel company. The UK travel company sends
details of the booking to the Australian hotel.
Each company is a separate controller, as it is processing the personal data for its own purposes
and making its own decisions.
The contract between the UK travel company and the hotel should use controller to controller
standard contractual clauses.
- Criminal identity theft (posing as another person when apprehended for a crime)
- Financial identity theft (using another’s identity to obtain credit, goods or services)
- Identity cloning theft (using another’s information to assume his or her identity in daily life)
- Medical identity theft (using another’s identity to obtain medical care or drugs)
- Child identity theft.
Identity theft may be used to facilitate or fund other crimes including illegal immigration,
terrorism, phishing and espionage. There are cases of identity cloning to attack payment
systems, including online credit card processing and medical insurance.
These new criminal attacks are leading to a worldwide increase in legislation and sanctions.
European states legislations are often less specific on identity theft, and consider it under the
more general fraudulent misrepresentations, forged documents laws and other existing legal
tools.
> 50 million Facebook profiles harvested for Cambridge Analytica in major data breach
> Facebook denies that the harvesting of tens of millions of profiles by GSR and Cambridge
Analytica was a data breach. It said in a statement that they “gained access to this information
in a legitimate way and through the proper channels” but “did not subsequently abide by our
rules” because he passed the information on to third parties.
It then used the test results and Facebook data to build an algorithm that could analyse
individual Facebook profiles and determine personality traits linked to voting behaviour.
The algorithm and database together made a powerful political tool. It allowed a campaign to
identify possible swing voters and craft messages more likely to resonate.
Facebook agreed with the Federal Trade Commission to pay $5 billion of fine.