Blog Bucharest

Was a pleasure for our partners to participate at Back 2 Business event.

Friday, 27 of October, 2023, Neil McGregor participated in the 2023 Prahova Top Companies Gala, at the invitation of Mr. Aurelian Gogulescu, President of the Prahova Chamber of Commerce and Industry.

The CJEU decided in the case concerning Meta that competition authorities can rule on the compliance or non-compliance of the undertaking with the GDPR in the context of a decision on an abuse of dominant position. CJEU ruled on all six legal basis to process data, further clarifying the interpretation of Article 6 (1) GDPR.

Basically, a national competition authority can find, in the context of the examination of an abuse of a dominant position, that the GDPR has been infringed.

Meta Platforms Ireland operates the online social network Facebook within the European Union. When they register with Facebook, its users accept the general terms drawn up by that company and, consequently, the data and cookies policies. According to those policies, Meta Platforms Ireland collects data about user activities on and off the social network and links them with the Facebook accounts of the users concerned. The latter data, also known as “off-Facebook-data”, are data concerning visits to third-party webpages and apps as well as data concerning the use of other online services belonging to the Meta group (including Instagram and WhatsApp). The data thus collected serve, inter alia, to create personalised advertising messages for Facebook users.

The German Federal Cartel Office prohibited, in particular, the use of social network Facebook by private users resident in Germany from being subject, in the general terms, to the processing of their off-Facebook data and those data from being processed without their consent.

In its judgment, the Court of Justice states as it is shown also in the press release that, in the context of the examination of an abuse of a dominant position by an undertaking, it may be necessary for the competition authority of the Member State concerned also to examine whether that undertaking’s conduct complies with rules other than those relating to competition law, such as the rules laid down by the GDPR. However, where the national competition authority identifies an infringement of the GDPR, it does not replace the supervisory authorities established by that regulation. The sole purpose of the assessment of compliance with the GDPR is merely to establish an abuse of a dominant position and impose measures to put an end to that abuse on a legal basis derived from competition law. In order to ensure the consistent application of the GDPR, the national competition authorities are required to consult and cooperate sincerely with the authorities monitoring the application of that regulation. In particular, where the national competition authority takes the view that it is necessary to examine whether an undertaking’s conduct is consistent with the GDPR, it must ascertain whether that conduct or similar conduct has already been the subject of a decision by the competent supervisory authority or the Court. If that is the case, it cannot depart from it, although it remains free to draw its own conclusions from the point of view of the application of competition law. Furthermore, the Court observes that the data processing operation carried out by Meta Platforms Ireland appears also to concern special categories of data that may reveal, inter alia, racial or ethnic origin, political opinions, religious beliefs or sexual orientation, and the processing of which is in principle prohibited by the GDPR. It will be for the national court to determine whether some of the data collected may actually allow such information to be revealed, irrespective of whether that information concerns a user of that social network or any other natural person. As to whether the processing of such ‘sensitive’ data is exceptionally permitted due to the fact that they were manifestly made public by the data subject, the Court clarifies that the mere fact that a user visits websites or apps that may reveal such information does not in any way mean that the user manifestly makes public his or her data, within the meaning of the GDPR. In addition, the same applies where a user enters information into such websites or apps or where he or she clicks or taps on buttons integrated into them, unless he or she has explicitly made the choice beforehand to make the data relating to him or her publicly accessible to an unlimited number of persons.

Lastly, the Court notes that the fact that the operator of an online social network, as controller, holds a dominant position on the social network market does not, as such, prevent its users from validly giving their consent, within the meaning of the GDPR, to the processing of their personal data by that operator. However, since that position is liable to affect the freedom of choice of those users and create a clear imbalance between them and the data controller, it constitutes an important factor in determining whether the consent was in fact validly and, in particular, freely given. This is for the operator to prove.

The full text of the Decision C-252/21 can be read here. 

The long-awaited foreign direct investment (“FDI”) screening legislation has now come into force through Law 164/2023 (the “FDI Law”), which was published in the Official Gazette of Romania on 7 June and came into effect on 10 June.

The FDI Law amended Government Emergency Ordinance no. 46/2023 (“GEO 46”) – which implemented Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union.  [LM1] 

The main changes that FDI Law made to GEO 46 are very important as they not only modified GEO 16 but also expended its scope, as follows:

1. the term investor now refers, in addition to non-EU investors, to natural persons who are citizens of an EU member state, and to legal person whose registered office is in an EU member state, which have carried out or intend to carry out an investment in Romania.  Also classified as an investor are legal entities, whose registered office is in an EU member state, which have made or intend to make an investment in Romania, in which control is directly or indirectly exercised by a natural person who is a citizen of an EU member state, or a legal person whose registered office is in an EU member state, or another legal entity, without legal personality, organized under the laws of an EU member state.

• the obligation of examination and approval is extended not only to non-EU investments but also to investments of any nature establishing or maintaining commercial relationships with a Romanian company.

• the structure of the Commission for the Examination of Foreign Direct Investments has changed, a representative of the Ministry of Energy having been added to the Commission in view of the great interest in this sector.

• a very awaited matter is the method of establishing the value of the investment, and the law provides that this will be provided by instructions of the Competition Council.

There are still many practical aspects that FDI Law has not clarified, such as those regarding the continuous investments started before GEO 46, or what happens to the examination taxes paid if in fact the business did not have to notify the FDI screening commission but did so, taking into account the breadth of the targeted fields, but probably practice and / or delegated legislation will in due course clarify these matters.

Digital Service Act (”DSA”) is a legislation which establishes responsibilities for all the parties involved in the digital field as well as the essential elements of the institution of Digital Services Coordinator. DSA enforces more strict requirements for very large online platforms. In order to understand the reason behind imposing such measures to some of the economic actors, we must clarify the definition of very large online platforms. A very large online platform is the platform having over 45 million monthly users during one calendar year, in the EU, and this aspect is considered to be an important risk for the society.

Once the Commission nominates a platform as VLOP (“Very Large Online Platforms – VLOP”) or a search engine as VLOSE (”Very Large Online Service Entreprise”) based on the number of users supplied by the platforms or search engines, which they were obliged to publish until 17 February 2023, regardless of their size, then the respective platform or search engine must comply with the DSA within 4 months. The platforms and search engines shall need to update these numbers at least once every six months, as provided by DSA.

This nomination triggers specific norms for approaching the specific risks which these large services are causing to European citizens and for the society e in respect of illicit content, as well as the impact thereof over the fundamental rights, the public safety and wellbeing.

The Commission shall revoke its decision if the platform or search engine no longer reaches the 45 million monthly users during one calendar year threshold.

On 25 April 2023, the Commission has nominated as VLOP and VLOSE the following:

VLOP – Alibaba Aliexpress, Magazinul Amazon, Apple AppStore, Booking.com, News, Google Maps, Google Shopping, etc.

VLOSE –Google Search and others.

The nominated very large platforms shall have to observe the regulation sooner than the other economic actors.

Some of the VLOP and VLOSE obligations are:

• To establish a contact point;
• To denounce the infringements;
• To provide terms of use which are easy to navigate and use;
• To be transparent in respect of advertising, recommendation systems or decision to moderate the content;
• To identify and assess the risks in connection to:
• Illicit content;
• Fundamental rights such as freedom of speech, mass-media freedom and pluralism, discrimination, customer protection and children rights;
• Public safety and election processes;
• Gender violence, public health, minor’s protection and mental and physical wellbeing.

Part of the conformity procedure is to enforce a risk management system. This system entails the identification and mitigation of the potential dangers for the society, such as the harmful content.

The procedure to manage the risks entails that the very large platforms should apply annually the relevant mitigation measures. These measures shall be verified by independent auditors. Then, the audit company shall present its risks evaluation report before the European Commission and the national authorities of the member state where the headquarters is located.

The responsibilities in respect of enforcement of the measures shall be divided between the EU Executive, as the main agent of enforcement of measures regarding the very large platforms and, for the smaller actors, the coordinator of digital services which shall collaborate with other competent national authorities.

The Digital Service Council shall ensure the consistent cross-border enforcement and cooperation.

The Member States shall be able to delegate some of the tasks to other authorities than the coordinator, which would remain the single point of contact between the companies established within its territory and in order to present the national position before the Council.

The Digital Services Coordinator – have, among others, the task to perform joint investigations, to cooperate with their colleagues in case of cross-border cases or to request the European Commission to assess if a large platform represents a systemic issue.

The EU Council could cooperate with EU bodies and agencies in matters regarding data protection, competition and non-discrimination.

Each member state is allowed another year to nominate its Digital Services Coordinator. This means that also Romania should nominate, by the end of 2024, a politically independent institution as digital services coordinator. This independent institution shall have to be created and coordinated according to the DSA provisions and it will practically supervise the digital platforms and shall ensure that the DSA regulation is being enforced.

If the Government shall not choose to establish a new national authority to perform this role, one of the existent authorities such as – ANCOM, CNA, the Ombudsman, the Ministry of Research, Innovation and Digitalisation or the National Directorate for Cybernetic Security –  most probably will cover this function.

The digital services coordinator holds the role of users’ complaints office, as provided by article 53 of the DSA, but it also offers researchers access to the date generated by the very large platforms. According to art. 36 of the DSA, in crisis situations, the Coordinator may make recommendations in its field of expertise. There are some special situations when a certain content from one online platform is illegal in  one member state, but it is allowed in other member state and in this case the Coordinator may initiate a request for deletion of content. 

The Ethics Guidelines for Trustworthy Artificial Intelligence (AI) is a document drafted by the High-Level Expert Group on Artificial Intelligence (AI HLEG). This independent High-Level Expert Group was created by the European Commission in 2018, as a part of their strategy in respect of the artificial intelligence.

The parties interested in creating such AI systems should be aware of the key requirements which must be observed by AI technologies. These requirements have been issued pursuant to the fundamental rights and ethical principles and shall apply to all interested parties taking part in the life cycle of AI systems, namely – developers (the ones researching, designing and/ or developing AI systems), implementers (the public or private entities using AI systems within their business processes and for supplying products or services to third parties) and the final users (the ones involved directly or indirectly into the AI system), as well as the society in general (meaning any other parties which are directly or indirectly affected by the AI systems).
Each of the parties mentioned above have obligations in respect of ensuring the observation of requirements, as follows:

• The developers – must implement and apply the requirements for design and development processes;
• The implementers – must ensure that the systems they are using and the products and services they are offering observe the requirements;
• The final users and the society in general – should be informed in respect of these requirements and should be able to request the observance thereof.
  The list of requirements published in the Guideline is not exhaustive and it provides systemic, individual and social aspects:

1. Human agency and supervision – the AI systems should support the human autonomy and decision making as provided by the principle of observing the human autonomy. This requires that the artificial intelligence systems should act as favouring factors for the society, supporting the agency of the user, promoting the fundamental rights and allowing the human supervision;
2. Technical robustness and safety (including the resistance to security attacks an, withdrawal plan and general safety, accuracy, fiability and replicability) – this requirement represents a crucial component of a trustworthy AI and it is closely connected to the principle of avoidance of harm. The technical robustness requires that the AI systems should be developed in a preventive manner in respect of risks and their behaviour should be according to the intent, by reducing at the same time the unintended and unexpected damages and preventing the unacceptable damages. This principle should also apply to the operation environment or to the presence of other agents (human or artificial) which may interact with the system in a contradictory manner. Moreover, the physical and mental integrity of humans must be ensured through legal provisions;
3. Confidentiality and data governance (including the observance of confidentiality, quality and data integrity and also data access) the confidentiality which is also a fundamental right especially affected by the AI systems, is in close connection to the principle of prevention of harm. The prevention of harm towards the private life also needs an adequate data governance to cover the quality and integrity of the data used, the relevance thereof in the light of the field where the AI systems shall be implemented, the access protocols and the capacity to process the data in a way which protects the intimacy;
   Transparency (including traceability, explicability and communication) – this requirement is closely connected to the principle of explicability and comprises the transparency of the relevant elements for an AI system: the data, system and business models;
4. Diversity, non-discrimination and correctness (including the avoidance of unfair bias, accessibility, the universal design and the participation of the interested parties) – in order to obtain a trustworthy AI we must allow the inclusion and diversity durng the entire life cycle of the AI system. Besides the taking into consideration and the involvement of all affected interested parties during the entire process, this shall also imply the ensurance of equal access by inclusive design processes as well as equal treatment. This requirement is closely connected to the principle of equity;
5. The walfare of society and envirnonment (including the durability and respecting the environment, the social impact, the society and the democracy) – according to the principles of equity and prevention of harm, the society in general, other persons and the environment should also be considered to be interested parties during the entire life cycle of the AI system. The sustenability and the ecological responsibility of the artificial intelligence systems should be encouraged within the AI solutions aproaching domains of global interest, as, for example, the objectives of durable development. Ideally, the AI systems should be used to the benefit of all human beings, including the future generations;
6. Responsibility (including auditability, minimisation and reporting of the negative impact, compromising and repairing) – this responsibility request supplements the above mentioned requirements and is closely connected to the principle of equity. Certain legal mechanisms need to be established in order to ensure the responsibility for the AI systems and the results therefrom for the period before and after the development, implementation and use thereof.

All the above requirements are equally important, are supporting each other and must be implemented and evaluated during the entire life cycle of the AI system.
The implementation of these requirements should take place during the entire life cycle of an AI system. While most of the requirements apply to all AI systems, a special attention is given to the ones affecting directly or indirectly the individuals. Therefore, for some of the apps, as the ones for the industrial field, this can have a lower relevance.
The above requirements include also elements which in some cases are already reflected in the existent legislation. According to the first component of Trustworthy AI – it is the AI practitioner’s responsibility to ensure they are observing the horizontally applicable regulations as well as the specific regulations in the field.