欧盟EDPS认为欧盟委员会使用Microsoft 365违反了数据保护条例等

点击上方蓝字关注我们

国际新闻速览目录
8 March - 12 March

1. 欧盟EDPS认为欧盟委员会使用Microsoft 365违反了数据保护条例
2. 佛罗里达州《未成年人在线保护法案》在参众两院获得通过并登记注册
3. 《保护美国人免受外国对手侵害的数据法案》被提交至美国众议院

01
EDPS Finds that Commission's Use of Microsoft 365 Infringes Data Protection Law
欧盟EDPS认为欧盟委员会使用Microsoft 365违反了数据保护条例
On March 11, 2024, the European Data Protection Supervisor (“EDPS”) announced that it concluded its investigation into the European Commission's use of Microsoft 365 and found that it infringes the data protection law for EU institutions and bodies (Regulation (EU) 2018/1725).
2024年3月11日，欧盟数据保护委员会（以下简称“EDPS”）宣布结束对欧盟委员会使用Microsoft 365的调查，认为其违反了欧盟的数据保护条例（欧盟第2018/1725号条例）。

EDPS found that the Commission:
failed to provide appropriate safeguards to ensure that personal data transferred outside the EU/EEA are afforded an essentially equivalent level of protection as guaranteed in the EU/EEA; and
did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365.
EDPS认为欧盟委员会：
未能提供适当的保障措施，以确保转移到欧盟/欧洲经济区以外的个人数据获得与在欧盟/欧洲经济区内所保证的基本同等水平的保护；以及
没有充分说明在使用Microsoft 365时要收集哪些类型的个人数据，以及未明确收集数据的具体目的。

In light of the above, the EDPS issued a reprimand to the Commission and imposed the following corrective measures:
suspend, with effect from December 9, 2024, all data flows resulting from its use of Microsoft 365 to Microsoft and to its affiliates and sub-processors, located outside the EU/EEA, not covered by an adequacy decision; and
bring, by December 9, 2024, the processing operations resulting from the use of Microsoft 365 into compliance with Regulation (EU) 2018/1725, namely those regarding purpose limitation, transfers of personal data outside the EU/EEA, and unauthorized disclosures of personal data.
基于上述情况，EDPS 向欧盟委员会发出警示，并责令其进行改正：
自2024年12月9日起，暂停所有因使用Microsoft 365而流向Microsoft及其位于欧盟/欧洲经济区以外、充分性决定范围外的关联公司和次级数据处理者的数据流；以及
在2024年12月9日之前，要求与使用Microsoft 365相关的处理操作需符合第2018/1725号条例的要求，即与目的限制、欧盟/欧洲经济区以外的个人数据传输和未经授权的个人数据披露有关的规定。

上述资讯源自dataguidance，详见：
https://www.dataguidance.com/news/eu-edps-finds-commissions-use-microsoft-365-infringes


02
Florida Online Protections for Minors Bill Passed both Houses and Enrolled
佛罗里达州《未成年人在线保护法案》在参众两院获得通过并登记注册
On March 3, 2024, House Bill 3 for an act relating to online protections for minors was amended and passed the House of Representatives and thereafter enrolled on the same date. The bill also passed the Senate with amendments on March 4, 2024.
2024年3月3日，美国众议院修正并通过了关于《未成年人在线保护法案》的第3号议案，并在同日登记注册。同时经修正的法案也在美国参议院获得通过。

The bill applies to social media platforms, defined as an online forum, website, or application that satisfies each of the following criteria:
allows users to upload content or view the content or activity of other users;
10% or more of the daily active users who are younger than 16 years of age spend on average two hours per day or longer on the online forum, website, or application on the days when using the online forum, website, or application during the previous 12 months or, if the online forum, website, or application did not exist during the previous 12 months, during the previous month;
employs algorithms that analyze user data or information on users to select content for users; and
has addictive features.
该法案适用于社交媒体平台，社交媒体平台是指符合以下各项标准的在线论坛、网站或应用程序：
允许用户上传内容或查看其他用户的内容或活动；
在16岁以下的日活跃用户中，有10%或以上的用户在过去12个月内平均每天在该在线论坛、网站或应用程序上花费两个小时或更长时间；如果时长不足12个月，则10%或以上的用户在前一个月内平均每天花费两个小时或更长时间；
采用分析用户数据或用户信息的算法为用户选择内容；以及
具有令人成瘾的功能。

In particular, the bill prohibits social media platforms from entering into a contract with a minor who is younger than 14 years of age to become an account holder, unless the minor's parent or guardian provides consent for the minor to become an account holder.
需特别注意的是，该法案禁止社交媒体平台与未满14周岁的未成年人签订成为账户持有人的合同，除非该未成年人的父母或监护人同意该未成年人成为账户持有人。

Additionally, the bill requires that social media platforms:
terminate any account held by an account holder younger than 14 years of age, including accounts that the social media platform treats or categorizes as belonging to an account holder who is likely younger than 14 years of age for purposes of targeted content or advertising, and provide 90 days for an account holder to dispute such termination. Termination must be effective upon the expiration of the 90 days if the account holder fails to effectively dispute the termination;
allow an account holder younger than 14 years of age to request to terminate the account. Termination must be effective within five business days after such request;
allow the confirmed parent or guardian of an account holder younger than 14 years of age to request that the minor's account be terminated. Termination must be effective within 10 business days after such request; and
permanently delete all personal information held by the social media platform relating to the terminated account, unless there are legal requirements to maintain such information.
此外，该法案还要求社交媒体平台：
注销由14岁以下账户持有人持有的任何账户，包括社交媒体平台出于有针对性的内容或广告目的而将其视为或归类为可能属于14岁以下账户持有人的账户，并为账户持有人提供90天的时间对终止提出异议。如果账户持有人未能有效地对终止提出异议，注销必须在90天期满后生效；
允许14岁以下的账户持有人申请注销账户。注销必须在提出申请后五个工作日内生效；
允许经确认的14岁以下账户持有人的父母或监护人要求注销该未成年人的账户。注销必须在提出请求后10个工作日内生效；以及
永久删除社交媒体平台持有的与被注销账户相关的所有个人信息，除非法律要求保留此类信息。

上述资讯源自dataguidance，详见：
https://www.dataguidance.com/news/florida-online-protections-minors-bill-passed-both


03
Bill Protecting Americans' Data from Foreign Adversaries Introduced to House of Representatives
《保护美国人免受外国对手侵害的数据法案》被提交至美国众议院
On March 5, 2024, House Bill 7520 for the Protecting Americans' Data from Foreign Adversaries Act of 2024 was introduced to the U.S. House of Representatives, and thereafter referred, on the same date, to the House Committee on Energy and Commerce. In particular, the bill follows the issuance of Executive Order 14117 on Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.
2024年3月5日，《2024保护美国人免受外国对手侵害的数据法案》（House Bill 7520）被提交至美国众议院，并在同日被提交给众议院能源和商业委员会。该法案是在第14117号《关于阻止受关注国家获取美国人的大规模敏感个人数据及合众国政府相关数据的行政命令》发布之后提出的。

The bill highlights a prohibition on the sale, licensing, rent, trade, transfer, release, disclosure, provision of access to, or otherwise making available sensitive data of a US individual to:
any foreign adversary country; or
any entity that is controlled by a foreign adversary.
该法案强调禁止将美国个人的敏感数据以出售、许可、出租、交易、转让、发布、披露、提供访问权限或其他方式提供给：
任何外国敌对国家；或
受外国敌对势力控制的任何实体。

The bill clarifies the concepts of “controlled by a foreign adversary” “data broker” “precise geolocation information” “sensitive data” “service provider” and so on. A violation of such provision shall be considered as an unfair or deceptive act or practice under the Federal Trade Commission Act (the FTC Act).
该法案明确了“由外国对手控制”“数据经纪人”“精确地理位置信息”“敏感数据”和“服务提供商”等概念。根据《联邦贸易委员会法》，违反上述规定的行为将被视为不公平或欺骗性行为或做法。

上述资讯源自dataguidance，详见：
https://www.dataguidance.com/news/usa-bill-protecting-americans-data-foreign-adversaries



没有被设置“星标”的微信公众号
收到的推送极其有限，时间也会大大延迟
如果您想要收到我们的第一手推送
请为我们设个“星标”吧！
设星标，不迷路！
01
点击下方卡片关注公众号
02
点击右上角···
03
设为星标


想要获得更多资讯内容
请扫码关注我们
M姐 数据合规评论
微信号｜M_DigitalLawandLife