to the point: technology & digitalisation l February 2022

Since the first month of this young year has passed by all too quickly, and because – while writing these lines – we are in the midst of the Olympics, I may greet you with a "Happy Chinese New Year!" And I am happy to announce that our newsletter is back! Also in 2022, our legal experts will share their thoughts and opinions with you and keep you informed about all recent developments related to technology and the law.

Speaking of recent developments, on 26 January 2022 the European Commission (EC) published its draft declaration on digital rights and principles (the "European Declaration on Digital Rights and Principles for the Digital Decade"). This declaration will establish a framework for European policymakers and companies when dealing with new technologies. The EC aims at nothing less than building a better digital world, which is an excellent opportunity to recall the three values of Olympism: excellence, friendship and respect.

The EC's proposed digital rights and principles are shaped around six chapters:

• putting people and their rights at the centre of the digital transformation;
• supporting solidarity and inclusion;
• ensuring freedom of choice online;
• fostering participation in the digital public space;
• increasing safety, security and empowerment of individuals;
• promoting the sustainability of the digital future.

With this declaration, the EC is promoting a digital transition shaped by European values to protect people's rights, support democracy and ensure a fair and safe online environment. This seems to be in line with International Olympic Committee founder Pierre de Coubertin's spirit: the joy found in effort, the educational value of a good example and respect for universal ethical principles.

We will keep you posted about further developments. Meanwhile, please enjoy our update on innovative legal topics across all areas of technology and digitalisation.

In 2020, the European Commission proposed two legislative initiatives to upgrade rules governing digital services in the EU: the Digital Services Act (DSA) and the Digital Markets Act (DMA). Together they will form a single set of new rules applicable across the whole EU to "create a safer and more open digital space". The new rules under the DSA aim to better protect consumers, establish transparency and accountability and foster innovation, growth and competitiveness within the single market. The DSA provides for different rules for different players, depending on their role, size and impact in the online ecosystem. All online intermediaries offering their services in the single market, whether established in the EU or outside it, will have to comply with the new rules. Micro and small companies will have obligations proportionate to their ability and size while ensuring they remain accountable. More information on the DSA can be found at EU commission website.

On 20 January 2022, the European Parliament approved the text of the DSA, introducing several changes to the European Commission's proposal, including further exemptions for micro and small enterprises, targeted advertising, compensation for damages due to noncompliance with certain obligations and the prohibition of deceiving or nudging techniques to influence users' behaviour through "dark patterns". The changes can be reviewed European Parliament website. The Council will now review the text of the DSA and decide whether or not the Parliament's position is accepted (in which case the text will be final and binding) or if it will propose amendments (in which case the amendments will go into a second reading in the European Parliament). Once adopted, the new rules will be directly applicable across the EU.

The Luxembourg Stock Exchange recently announced that it will allow security tokens if they qualify as financial instruments within the meaning of Article 4 (1) (15) of MiFID II, to be registered on the Securities Official List (SOL). While this listing does not constitute inclusion for trading on a regulated market or MTF/OTF, it could entail certain incentives and benefits for their issuers, such as the following:

• the listing may increase the visibility of the security tokens and thereby help attract investors to them;
• it may also promote the dissemination of an indicative price and security data of the security tokens.

This announcement by LuxSE is another important step in the creation of a secondary market for security tokens. Although security token trading on regulated exchanges still faces significant legal challenges, the continued momentum in this area inspires confidence in the future of tokenised financial instruments and blockchain technology.
 
Further information from LuxSE can be found here: www.bourse.lu/SecurityTokens

2021 was a record year for start-ups in Europe and also in Austria according to the latest "EY Start-up Investment Barometer Austria 2021". In short:

• the total value of investments in Austrian start-ups rose to a record high of EUR 1.23bln in 2021 - around five times as much as in 2020;
• Austrian investors were involved in 55 % of the financing rounds - one third was purely supported by domestic investors;
• however, domestic investors hardly play a role in large financing rounds: More than 75 % of venture capital comes from purely foreign investor groups;
• the larger the round, the fewer Austrian investors are involved: None of the six largest deals involved a domestic investor;
• most financing rounds were in the software, eCommerce and healthcare sectors.

For more info check out: https://www.ey.com/de_at/news/2021/12/ey-start-up-barometer-oesterreich-2021

The hype around the NFT industry has not ended but has spread into almost all imaginable and unimaginable business fields.

Starting with the classical art sector, the Belvedere is the first Austrian federal museum to have divided one of its most important works, Klimt's "The Kiss", into 10,000 individual NFTs and is now selling these unique digital items as Valentine's Day gifts.

The sports industry also wants a piece of the lucrative NFT market

An exciting NFT project was launched for the current Olympic Games. Fans can now purchase their favourite athletes from the German Olympic team as NFT collectibles. The Austrian national team is also now issuing its players, such as David Alaba and others, as NFTs.

Completely new NFT use cases are also developing in the sports sector. For example, a tennis player auctioned off a lifetime advertising space on her forearm as an NFT on opensea for the first time. The NFT buyer receives a 15x8 cm tattoo advertising space between her elbow and shoulder, which is highly visible, especially when the young player serves.

Charmin

Digital toilet paper is definitely on the shortlist of most outrageous NFTs. US toilet paper manufacturer Charmin is now issuing the first digital NFT toilet rolls. The digital toilet paper is individually designed with colourful flowers and grasses. As an NFT, it is merely an image, but it costs a very real USD 4,100. Charmin reportedly keeps only 0.01 % of the revenue for itself. The rest goes to a humanitarian organisation.

It will be curious to see which creative business cases will be established in the NFT sector in the future. But one thing is certain: there are plenty of ways for companies to participate in the NFT hype.

The Digital Markets Act ("DMA") moves ahead on its path to adoption this year, as a draft of the new legislation was approved by the European Parliament in December 2021 and is expected to be ratified by Member States in mid-2022. This means it's about time for us to share how we think the upcoming platform rulebook will impact Austrian public and private antitrust enforcement. Will the Austrian Competition Authority be able to make additional use of the DMA in its enforcement practice? And will private individuals be able to successfully assert claims under the DMA before Austrian courts? Find out in our latest newsletter.

In a recent decision, the Austrian Data Protection Authority ("DPA") held that the use of Google Analytics does not meet the GDPR's requirements for the safe transfer of personal data. In the aftermath of the ECJ's Schrems II ruling, the DPA held that the transfer of personal data collected by Google Analytics to the US is unlawful, because intelligence services are (still) entitled to request disclosure or transfer of personal data and the supplementary measures in place are not sufficient. The key takeaway from this decision is that it's time for companies to accept their active role as a data controller and get their international data transfers in order.

See here for an analysis of the decision and its key takeaways.

On 19 January 2022 the European Data Protection Board (the "EDPB") adopted Guidelines on the Right of Access, which are currently under public consultation. The Guidelines are intended to clarify the scope of the right of access, the information the controller must provide to the data subject, the format of the access request, the main modalities for providing access, and the notion of manifestly unfounded or excessive requests. Additionally, the EDPB adopted a letter addressing the harmonisation of cookie consent interpretation throughout the EEA.

Moreover, on 2 February 2022, the EDPB adopted its first opinion on certification criteria submitted by the Luxembourg Supervisory Authority (General Data Protection Regulation (Regulation (EU) 2016/679) Certified Assurance Report-based Processing Activities). The opinion aims to ensure the consistency and correct application of certification criteria among supervising authorities in the European Economic Area. According to the information published by the EDPB, the draft certification criteria is still a work in progress and requires a number of amendments.

Through its 11 November 2021 law ("Law 175/2021"), the Moldovan Parliament passed certain amendments to existing legislation with the goal of digitalising the national economy. As a result, the norms implemented have made it simpler to establish, operate and sell companies in Moldova. As of 10 January 2022, the following documents will no longer require a notary authentication: constitutive documents of limited liability and joint-stock companies and the share sale/transfer agreements in limited liability companies. In addition, the reinforcement of e-signatures and e-PoAs means managing directors no longer have to submit a signature specimen. Besides easy online payments, this has paved the way for decisions and extracts to be issued electronically and for an e-filing service that allows entities or changes in relation to them to be registered. Read full article on our website. 

This year got off to a rocky start for website owners in Europe. It began with the Austrian Data Protection Authority ruling that Google Analytics is not GDPR compliant. This decision alone affects around half of all European websites.

The Regional Court of Munich took it one step further and attacked another very popular tool: Google Fonts API. When Google Fonts API is implemented on a website, the user's IP address is automatically transferred to the Google servers (in the US). According to the court, this transfer requires the prior consent of the user. The court established that the defendant's website used Google Fonts API and that the plaintiff was not asked for consent when visiting the site. It also rejected the defendant's argument that processing was necessary to pursue a legitimate interest, arguing that the defendant could have used the self-hosted version of Google Fonts, which does not transfer any user data to Google. The court thus concluded that the defendant had no legal basis to transfer the plaintiff's IP address to Google and awarded the plaintiff EUR 100 in damages for the discomfort suffered. And if that weren't enough, the court ordered the defendant to refrain from using Google Fonts API in the future and, in case of non-compliance, threatened to impose a fine of up to EUR 250,000 or six months' imprisonment.

As absurd as the decisions may seem, they are direct consequences of the ECJ's Schrems II judgment. And both decisions seem to follow the ECJ's rational: the World Wide Web ends at the European border. This puts European website owners on the spot. Their next steps should be:

1. self-host all your content and resources (libraries, fonts, etc.);
2. switch to European service providers (hosting, CDN, analytics, etc.);
3. consult your privacy lawyer.

The transition phase to implement the Schrems II judgment is coming to an end as Member States start enforcing the new legal framework. If you have not yet reviewed your international data transfers and adapted accordingly, this may be your last chance.

At the end of last year, Dealroom and Vienna Business Agency joined forces to establish Vienna's own online start-up database. On vienna.dealroom.co you can find a constantly growing database showing up-to-date figures and news about the Austrian start-up ecosystem. Dealroom is the leading European data provider on start-ups, growth companies and tech ecosystems.
 
The open-access start-up database aims to bring start-ups, investors, business angels, organisations and institutions together for networking and information exchange. Currently, vienna.dealroom.co lists more than 1,000 start-ups, around 200 investors, more than 1,000 people in the start-up scene and around 1,000 job openings. The data originates from various sources. Dealroom feeds the database with globally available data. Start-ups, investors, etc. can add missing data or profiles by themselves.
 
Dealroom is used by international venture capitalists to research start-ups in specific European regions or technological fields. Although not all available information seems to be verifiable, Vienna's Dealroom is a great chance for start-ups to improve their international visibility and to connect with investors and other stakeholders. Vienna.dealroom.co even allows you to track the latest Vienna-related financing rounds and start-up exits. For 2021, Dealroom reveals record-breaking EUR 1.4b fundings for Vienna-based start-ups. Our Schoenherr team had the pleasure of advising on many of such funding rounds.

In April 2021, Apple released the AirTag, a small piece of technology that according to the Silicon Valley firm has been "designed to track items not people". The idea is simple but smart: just attach an AirTag to anything you don't want to lose. However, more and more cases have come to light of AirTags being used by stalkers, even though this is exactly what the product is supposed to prevent. When an AirTag that's not yours appears to be following you, it should start making sounds and your iPhone should warn you. Unfortunately, by following a short YouTube tutorial, criminals can easily disable the device's speakers while keeping the rest of the AirTag intact. The iPhone's warning often comes too late, when victims are already at home. One can only hope that the company will come up with a better solution to this serious problem as soon as possible.

USD 68.7bln is what Microsoft will pay to acquire Activision Blizzard. If the deal goes through, it will vault the software maker to number three in the gaming industry worldwide, behind only Tencent and Sony.

In so doing, Microsoft is not only strengthening its Game Pass subscription service platform with world-famous IPs like Warcraft, Overwatch and Call of Duty, but also setting itself up for the new metaverse age of the internet.

Immersive internet worlds allow people to buy and sell digital real estate and artwork, visit amusement parks and art galleries or even hold business meetings. People connect in these worlds. It is therefore not surprising that Microsoft has cast its eye on Activision Blizzard. Not least, the company has proven since 2004 with the online game World of Warcraft that they are able to create virtual (open) environments in which millions of people come together. The ideas behind these virtual worlds in massive multiplayer online games will in any case play a major role in the development of a metaverse.

It remains to be seen whether the trend will go mainstream. But the tech giants appear determined to create a metaverse and it will be exciting to see how the industry will react to Microsoft's move.