Brazil’s Data Protection Law and the culture change in the laboral routines of companies: the use of the data protection theme as a strategic tool to improve the business work environment Despite being clear that Brazil’s Data Protection Law (”LGPD”) applies to employment relationships, it is not usual to discuss the...
FOUR YEARS OF GDPR: The Danish approach to data protection, or absence thereof? 25th May 2022 marked the 4th anniversary of the entry into force of the General Data Protection Regulation (GDPR) and the...
Bulgarian PDPC adopted a list of processing operations requiring prior consultation Bulgarian PDPC has adopted a list of processing operations that require prior consultation which is addressed to the authorities...
Largest cyber attack in the history of Costa Rica: Does the state of emergency continue? On May 11, 2022, the Costa Rican government declared a National State of Emergency throughout the public sector for cybercrimes...
The Annual Report for 2021 of the Macedonian Personal Data Protection Agency is released Compared to the previous year, the number of supervisions carried out in 2021 by the Macedonian Personal Data Protection Agency is...
A New Direction for UK Data Protection Law: the Data Protection and Digital Information Bill The UK government’s Department for Digital, Culture, Media & Sport ("DCMS") has published proposed legislation that will make...
Decision of the Slovak court regarding requested disclosure of personal data In today's society, the issue of fulfilling the characteristics of personal data is the subject of many disputes as well as legal...
A brief overview of the legal framework for the use of cookies on websites in Austria The question of cookies and data protection is always present, but what are cookies, are they always person-related, what is the...
Use of Google analytics (still) breaches the GDPR – austrian data protection authority rejects risk based approach The Austrian Data Protection Authority (DPA) decided in another decision (22nd of April 2022, D155.026, 2022-0.298.191) that the use...
Slovenia: Publication of an E-mail Address not a Waiver of the Right to Privacy The Constitutional Court of the Republic of Slovenia annulled the criminal conviction for the development, advertising, and selling...
Klarna Bank AB - the importance of transparency in privacy notices Earlier this spring, the Swedish Authority for Privacy Protection issued an administrative fine of approximately EUR 724 000 against...
Can an employer ask the candidate to provide him with a court certificate that criminal proceedings are not being conducted against him, when establishing an employment relationship? When establishing an employment relationship, employers often ask the candidates for a court confirmation that no criminal...
A new member has joined the INPLP: Fabian Solis (Costa Rica) Aguilar Castillo Love’s vision for their role as a law firm is borne of their heritage. Their ethos is drawn from many models,...
Finding a balance between fighting crime and privacy – the use of metadata Last April, the Portuguese Constitutional Court declared unconstitutional the provisions of articles 4, 6, and 9 of Law 32/2008 of...
Can a controller rely on legitimate interest in Nigeria? Legitimate interest is one of the lawful bases for processing personal information. However, the Nigeria Data Protection Regulation...
Monaco: New legislation on the protection of personal data eagerly awaited The government's bill for a major reform of Monaco's personal data protection legislation is currently being examined by the...
The use of CCTV in light of the Luxembourg National Commission for Data Protection’s sanctions. In 2021, the Luxembourg National Commission for Data Protection (the “CNPD”) issued 48 decisions following assessments. 18 of these...
Access Granted: DSAR changes for data controllers granting access to health data Updated regulations in Ireland regarding data subjects' access to their health data emerged in March 2022. The new regulations have...
AP applies incremental penalty authority to the fullest It is the first time in history that the Dutch Data Protection Authority (DPA) has identified six violations of the GDPR in only one...
Cross Border Transfers: Recent Developments Generally, data transfers to third countries are prohibited unless the receiving country has received an adequacy decision from the...
A new member has joined the INPLP: Lia Hernández Pérez (Panama) Legal IT Abogados is the first legal boutique specialized in Digital Law in Panama. They offer legal solutions in the world of...
Shaping the limits of the Right to be Notified in 2022 Israel. The Israeli Privacy Protection Authority recently published a new memo aimed to clarify the scope of interpretation of the obligation...
Facial recognition systems: 20 million fine against the American company Clearview. "Not everything that is technically possible is legally and ethically lawful." These are the words of Guido Scorza, member of the...
The INPLP is growing worldwide INPLP: We continue our path to success and are pleased to welcome our new members from Mexico and Panama and thus further expand our...
5th INPLP online Webinar Topics of this meeting were:MEET&GREET: New member Héctor Guzmán (MEXICO)BELEN: Next EU-US framework for international data...
A new member has joined the INPLP: Héctor Guzmán-Rodríguez (Mexico) BGBG provides solutions and highly specialized advice in an agile, clear, and sincere manner, generating positive results for their...
Seven Key figures from the Irish Data Protection Commission’s 2021 Annual Report On 24 February 2022, the Data Protection Commission released its 2021 Annual Report (the “Report”) running to over one hundred pages....
Data retention overturned? Aftermath to the private sector? The European Court of Justice has not just brought its settled case-law on data retention in line. Furthermore the ECJ also provides...
Argentina's Data Protection Authority publishes its 2021 Annual Report Argentina’s data protection authority, the Agency of Access to Public Information, i.e. the controlling authority pursuant to Data...
Can audio surveillance be justified? At the end of 2021, the Estonian Data Protection Inspectorate (DPA) issued a precept to a gas station using audio surveillance in its...
China’s New Regulations on Controlling Algorithmic Recommendations in Applications The Cyberspace Administration of China (CAC) has circulated the Regulations on the Management of Algorithm Recommendations for...
Three criteria for the elaboration of the Regulation to the Ecuadorian data protection law Ecuador continues to build its personal data protection system, for which those responsible for developing the regulation must...
Unpacking the New Privacy Regime in India: The When, Who, What, and How? The new Indian Privacy law mimics GDPR when it requires a ‘privacy by design’ architecture, sets up a central data protection...
The destruction of the algorithm: the new sanction for breaching the GDPR? Since 2019, The Federlñ Trade Commission (FTC) has been seeking ways to punish the new digital unfair practices, consisting on...
Personal data protection in Ecuador, a few steps forward The process of designating the Personal Data Protection Authority, the next milestone in the construction of the national data...
CCTV monitoring and the practice of the Hungarian DPA CCTV monitoring has long been a key field for the Hungarian DPA. The article summarizes the DPA’s practice, as well as the related...
Expensive update for Tesla: Car seller liable for failing to provide essential information In September 2021, Munich’s regional court (the LG Munich) awarded a plaintiff 130,446 euros in damages. A vehicle purchased by the...
Schrems II resolved? Unpacking the EU-US Trans-Atlantic Data Privacy Framework The United States and the European Commission have agreed in principle to a new Trans-Atlantic Data Privacy Framework (the...
Important concepts in cross-border transfer of data from China The Data Security Law (“DSL”) and Personal Information Protection Law (“PIPL”) of mainland China, which came into force last year,...
First European Code of Conduct for the pharma industry approved A Code of Conduct regulating the processing of personal data in the field of clinical trials and other clinical research and...
CNIL orders 3 websites to stop using Google Analytics The French supervisory authority has adopted 3 formal notices against famous French websites requiring them to stop using Google...
The Polish DPA rules about the right to access the personal data contained in trackers The Polish DPA (the President of the Personal Data Protection Office, further as "the Polish DPA") has reprimanded a webiste operator...
INPLP Activity Report 2021 published The past year was immensely impactful for the INPLP and characterized by strong collaboration, hard work, continued growth of the...
The Telecommunication Telemedia Data Protection Act – a new “cookie law” for Germany On 1 December 2021, the Telecommunication Telemedia Data Protection Act (“TTDSG”) came into effect. Amongst others, it was meant to...
A new member has joined the INPLP: Rob Corbet (Ireland) Rob Corbet is a Partner and Head of Technology & Innovation at Arthur Cox. He leads a market leading team dedicated to specialist...
Dutch GDPR class action against Oracle and Salesforce declared inadmissible The first major GDPR class action under the Dutch Act on Mass Damages Settlement in Class Actions (WAMCA) has been declared...
Representation of data processors under the new Swiss Data Protection Act (FADP) Switzerland has made an effort to renew its Federal Act on Data Protection (revFADP) in order to modernise its data protection law...
Clearview AI: Alignment in Global Enforcement Approach Investigations into US facial recognition firm Clearview AI by Canadian regulators and UK/Australia yeilded similar findings...
Bulgarian Supreme Administrative Court with Decision on Processing Data for Journalistic Purposes Bulgarian Supreme Administrative Court issued a decision setting out criteria relevant for assessing the balance between the right to...
What has to be in a copy? – Art 15 GDPR on the European test bench The first preliminary ruling of the Federal Administrative Court concerning information proceedings For the first time since the entry into force of the General Data Protection Regulation, the Federal Administrative Court has...
Supermarket chain fined for breach of data security duty Argentina’s data protection authority, the Agency of Access to Public Information, i.e. the controlling authority pursuant to Data...
Securing privacy compliance for Virtual Voice Assistants Virtual Voice Assistants (“VVA”) continue to grow in popularity as the precision of the technology improves. The European Data...
2021 in GDPR fines The EU General Data Regulation (GDPR) is among the world's toughest data protection laws. In this article you will have a general...
Activity of the Personal Data Supervisory Authority in Monaco The Personal Data Supervisory Authority (hereinafter "CCIN") has published its 12th Activity Report covering the year 2020. This...
A new member has joined the INPLP: Katie Hewson (United Kingdom) Stephenson Harwood is a law firm with over 1100 people worldwide, including more than 180 partners. They assemble teams of bright...
UK’s proposed data protection reforms - a step in the wrong direction? The proposed reforms to data protection laws by the UK government are ones that have been longed promised in a post-Brexit world and...
New members have joined the INPLP: Vikram Jeet Singh and Prashant Mara (India) BTG Legal is a disputes and transactional law firm with best-of-breed technical expertise, a culture of innovation, and an...
PROCESSING COVID-19 VACCINATION DATA OF EMPLOYEES IN ROMANIA: OPTIONS AND EXPECTATIONS The processing of COVID-19 related health data is certainly a hot and/or unsettled legal matter everywhere in the world. This article...
Ecuador is building its future on data (protection) Ecuador joins the party of personal data protection with the issuance of its new law on the subject and leaves the group of regional...
Athletes' Performance Data & Project Red Card This article provides an insight to the ever increasing market of performance analysis and the intersection with athlete's...
The new Slovak Electronic Communication Act shall change opt-out regime to opt-in regime for cookies The use of cookies will therefore no longer be linked to the passivity of the users concerned (opt-out). Anyone who stores or obtains...
Use of Google analytics violates the GDPR - Recent decision of the austrian data protection authority The Austrian Data Protection Authority (DPA) decided in a recent groundbreaking decision (22nd of December 2021, D155.027...
The Norwegian Data Processing Authority issues USD 7.2 million fine to U.S. company Grindr LLC Following an investigation carried out by the Norwegian Consumer Council, the Norwegian Data Processing Authority on 13 December 2021...
New members have joined the INPLP: Charlotte Gerrish and Anthi Pesmazoglou (France) Gerrish Legal offers Enterprise Solutions, Law Firm Services and Automated Law to clients being a multi-national company, a small to...
Data posted on Facebook vs GDPR in the light of the Warsaw WSA judgement What the exemption from the application of the Regulation due to private and domestic purposes is? Polish Regional Administrative...
A new member has joined the INPLP: Christian Espinosa Velarde (Ecuador) ECIJA GPA is recognized by prestigious international legal classification and research directories, offering legal services in all...
Constitutional Court: No IP address to be Revealed Without a Court Order The Constitutional Court of the Republic of Slovenia annulled the criminal conviction for an online defamation, which was based on...
Are you a controller or a processor? Assess carefully. It often happens that we get confused by the difference between a controller and a processor. The problem may arise when a controller...
Why Is Nigeria’s Obligatory Mandate And Safeguards On International Data Transfer Topical? Transfer of data has become a major subject of international trade, and understanding the prerequisite for such transfer is...
6th INPLP conference – great success The 6th INPLP Conference was successfully held in Vienna under the auspices of EuroCloud Europe and organised by Sourcing...
Malta amends its rules relating to personal data processing in education Malta has recently amended its rules in relation to the processing of personal data in the educational sector. ...
SCCs and CoCs and BCR – Untangling the Web and Spotting the Difference Under GDPR, data export to third countries is only permitted if the conditions under Chapter 5 are met. The adequacy decision by the...
New draft law on the "right to be forgotten" for those who have overcome serious illness Last October, the Portuguese parliament approved in a final vote a draft law that establishes the "right to be forgotten", preventing...
China’s New Data Laws China has recently introduced two new data laws which as well as bringing the rules in relation to personal data in China up to date...
When AI met privacy How to fulfil the data protection obligations when using artificial intelligence? One of the main issues of concern is the use of...
New guidelines on teleworking by the Greek Data Protection Authority Responding to the extensive and intensive remote working during the Covid-19 pandemic and the risks that are lurking for employees’...
Class actions against big tech in the Netherlands Big tech is getting sued for billions. What are these claims based on and who is supporting them? A short article on the recent...
Back to work: open sesame! The health situation in Luxembourg has been stable for several weeks now which allows for a possible return to a pre-crisis...
Additional Six Months Period For Implementation Of The New Law On Personal Data Protection Facing the fact that the complaince with the new Law on Personal Data Protection was not in line with the planned dynamics, the...
Cry and pray some more: Garante issues Schrems II decision Garante prohibits further data transfer and fines university 200,000EUR and for SchremsII failures in retaining a US based processor...
Third Amendment of the Japanese Privacy Law – Amendment based on the Digital Arrangement Act The Digital Arrangement Act was promuglated on May 19 of this year, which requires the Act on the Protection of Personal Information...
Ministry of Health of the Province of San Juan Receives Sanction for Database Vulnerability Argentina’s data protection authority, the Agency of Access to Public Information, i.e. the controlling authority pursuant to Data...
Tracking of employee location data is a significant violation of privacy according to the Israeli Privacy Protection Authority In recent years, and especially in recent times when remote work has become more common, the practice of employers using...
New Rules on Automotive Data Security to be Effective on 1 Oct 2021 The Cyberspace Administration of China (CAC) has circulated the Provisions on the Management of Automotive Data Security (Trial) 2021...
GAFAM or not GAFAM, that is (still) the question? After the “Schrems II” decision of the European Court of Justice invalidating the Privacy Shield framework and raising further doubts...
Part II: What Could Privacy Reform Look Like in Canada? Insights from Bill C-11 Bill C-11 died on the order paper in August when the Canadian federal election was called. In this article we explore how the...
The Spanish Data Protection Authority (AEPD) publishes its Annual Report summarizing last year’s activities including enforcement cases This Annual Report comprehensively collects the activities carried out by this institution, most relevant facts and figures,...
Polish administrative court rules that the GDPR does not grant power to the data protection to order the disclosure of personal data to third parties at their request The Provincial Administrative Court in Warsaw ruled that Polish Data Protection Supervisory Authority is not competent to order a...
New Italian cookie Guidelines: this is how the regulation of users' browsing data changes. On 9 July 2021, the Italian DPA released the new guidelines on the use of cookies. The purpose of these new guidelines is to achieve...
Nothing to risk – data transfers to third countries under the GDPR Due to their extreme importance in an increasingly digitalised and globalised economy, data transfers to third countries have been in...
First GDPR code of conduct for a European sovereign cloud The CISPE code of conduct simplifies data processing contracts under the GDPR and lays the foundations for a sovereign cloud. ...
Data breach in the Estonian Information System Authority results in photos of almost 300,000 people stolen A hacker was able to obtain the identification document photos of almost 300,000 people from a state database. Criminal...
New members have joined the INPLP: Marie-Hélène Tonnellier and Charlotte Barraco-David (France) Latournerie Wolfrom Avocats (LWA), a multidisciplinary and independent business Law Firm, is recognised for its technical expertise,...
Ecuador: 3 challenges to progress and avoid the nightmare The first ecuadorian data protection law have just came into force the last May 26th. Ecuador now starts a long and decesive journey...
Right of access pursuant to Art. 15 GDPR – News from Germany Germany’s Federal Court of Justice decided on the scope of data subject’s rights under Art. 15 GDPR - and set certain limits....
Blockchain and the GDPR: Clash of the Titans At the legal intersection between the emerging distributed ledger technolgies and data privacy a lot has been said and written in...
FDPIC publishes guidance on auditing the transfer of personal data abroad The Federal Data Protection and Information Commissioner (FDPIC) has published in its new guidance how to proceed with data transfer...
Technical Cooperation Agreement between the National Data Protection Authority (“ANPD”) and the Brazilian Antitrust Authority (“CADE”) Following one of ANPD’s main goals set out in its strategic agenda for 2021-2023, which includes establishing an effective regulatory...
Request for Preliminary Rulings on Data Controllers Liability in Case of a Data Breach The Bulgarian Supreme Administrative Court has referred several questions to the CJEU regarding preliminary rulings on the liability...
A new member has joined the INPLP: Pablo Arteaga (Ecuador) M. Bodero & Asociados is an Ecuadorian Law Firm, specialized in investment issues, complex transactions, business conflicts,...
Damages For GDPR Violation – Austrian Supreme Court Refers Several Questions To Court Of Justice Of The European Union (Cjeu) The Austrian Supreme Court paved the way for a more coherent interpretation of the GDPR regarding damages by initiating the...
Data protection in teleworking context. Romanian perspective The pandemic context has accelerated the use of telework and triggered a shift towards additional flexibility of work that will most...
Based on the appeal of the controller, the imposed fine for several GDPR violations has been increased almost 15 times! By filing an appeal against the first-instance decision, the controller worsened its situation when the supervisory body increased...
Tracking the slow demise of third-party cookies – A UK update. Regulatory pressure and heightened consumer concern around the use of third-party cookies to track users online and to deliver...
Argentina's Data Protection Authority publishes its 2020 Annual Report Argentina’s data protection authority, the Agency of Access to Public Information, i.e. the controlling authority pursuant to Data...
Recent decisions of the Austrian Data Protection Authority (DPA) The pandemic year did not make data protection obsolete. Instead, a large amount of personal data was collected and processed in...
"Schrems - Counter-Schrems" New Bill sets to Impose Limitations on Transfers of Personal Data FROM the US to countries to which export of personal data would...
E-Health, Data Protection and Data Security: Legal foundations and practical implementation of data transfer management in the health sector Fitness trackers, electronic health cards, online consultations – the digital age has long since arrived in the world of medicine....
Artificial Intelligence and the Law Francisco Perez Bes (INPLP member representing Spain) has edited the book "Artificial Intelligence and the Law" with the goal to...
New Hungarian regime aiming to reform local digital economy and introduce data wallets Hungary’s new draft Act on National Data Assets introduces a new regime, where data held by state agencies and local governments...
Data Localization Rules Imposed on Social Media Companies in Turkey On Oct. 1, 2020, amendements to the Regulation of Internet Broadcasts and Prevention of Crimes Committed through Such Broadcasts (Law...
China's First DPO-like Pilot Roll-out Similar to GDPR, China’s draft Personal Information Protection Law also requires the designation of a Responsible Person for Personal...
Slovenian Information Commissioner authorises publication of data on Police staff salaries and other personal data Following a strike announcement by two Police unions (over low pay, among other issues), the Ministry of Interior published on its...
The Swedish Authority for Privacy Protection has published its privacy protection report for 2020 In January 2021, the Swedish Authority for Privacy Protection (“IMY”) published its privacy protection report for 2020 (the...
Can an employer use video surveillance to monitor whether its employees abide by preventive measures and wear protective masks? The on-going pandemic of Covid-19 has put many challenges before the society. In order to ensure healthy working environment, many...
INPLP Activity Report 2020 published INPLP continues its path of robust and professional growth and expects to welcome its 100th member in 2022.
A new member has joined the INPLP: Diego Fernandez (Argentina) Marval O’Farrell Mairal was founded in 1923 and is the largest law firm in Argentina. Being a market leader at both local and Latin...
Will co-regulation finally work? The first EU level codes of conduct are approved under the GDPR in Belgium and France Like the old Data Protection Directive, the GDPR allows the private sector to draft codes of conduct to help demonstrate compliance...
The way to the right for employee sobriety checks – Polish perspective The article presents a current issue concerning sobriety data in the context of personal data protection and labour law from the...
New members have joined the INPLP: Dániel Necz and Kinga Madocsai (Hungary) SimpLEGAL is a Budapest-based state-of-the-art digital law firm both in the sense of practice areas and its client service methods....
Portuguese Data Protection Authority activity report 2019/2020 As part of the fulfilment of the duties assigned to it by the General Data Protection Regulation (hereinafter “GDPR”), the National...
Data breach reported to late? That’s a €475,000 fine! The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a €475,000 fine on Booking.com because the company took...
Enforcement of the GPDR in Luxembourg: an issue at stake? Max Schrems and his organisation NOYB (None Of Your Business) have recently begun a new battle, taking place in Luxembourg! Legal...
Monaco: Overview Of The Prior Control Activity Of The Personal Data Protection Authority (“Ccin”) Since 2020 According to the current Monegasque legislation, the automated processing of personal data is subject to the control of the CCIN...
Amendment on Enforcement Rules of the Japanese Privacy Law The amendment on Enforcement Rules for the Act on the Protection of Personal Information was promulgated on March 26 of this year. ...
A new member has joined the INPLP: Peter Hense (Germany) Spirit Legal is based in Leipzig, although they advise domestic and foreign businesses with an international focus, regardless of...
German Federal Cartel Office vs. Facebook – The one who wins the battle might not win the war The dispute between the German Federal Cartel Office and Facebook continues before the ECJ. This may mean that business models of the...
The challenges related to the transfer of personal data from the perspective of the new Law on Personal Data Protection The purpose of this Article is to provide an overview of the legal mechanisms by which personal data can be transferred from the...
Personal data breach resulting from data subjects' mistakes have to be notified! The Polish Data Protection Authority has imposed on WARTA. S.A, a Polish insurance and reinsurance company, a new administrative...
Scientific research using health data: Is the GDPR in contradiction with FAIR principles? Medical research is becoming increasingly reliant on the analysis of large amounts of biologically derived data. Greater scientific...
EDPB’s Guidelines on the concepts of controller and processor in the GDPR The European Data Protection Board issued the Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version...
GDPR Fines: Ramping up and DPAs Setting standards European Supervisory Authorities imposed more than €158m in fines under the GDPR during 2020; close to a 40% increase on the previous...
When is the right to privacy more important than the right to life itself? In Israel, as in many other countries, the coronavirus is rampant. There are various strategies available to contend with this...
Data breaches in healthcare due to human errors: two hospitals and a Local Health Administration Unit sanctioned by the Italian Data Protection Authority Data breaches are violations of database security that may result not only from cyber attacks, as it is usually assumed, but also...
Hong Kong’s Stale Data Protection Laws When it was introduced twenty years ago, Hong Kong’s data protection law was one of the leading regimes of its type in Asia. But time...
A new member has joined the INPLP: Justyna Matuszak-Leśny (Poland) e|s|b Adwokaci i Radcowie Prawni (e|s|b Legal) is a boutique law firm with an international atmosphere and scale of activity, located...
Does the draft Data Governance Act signal a more economic approach of personal data in the EU? The draft Data Governance Act, which was published by the European Commission last November, aims to foster the availability of both...
Swiss Federal Supreme Court rules: Smart Metering infringes informational self-determination right In one of its most recent decisions, the Swiss Federal Supreme Court ruled on smart metering. It decided that the permanent...
A new member has joined the INPLP: Ana Popović (Republic of Serbia) Živković Samardžić is one of the Serbia’s leading full-service independent law firms. Their 10 partners / 23 lawyers strong team...
Romanian public authorities sanctioned for GDPR breaches Towards the end of 2020, the Romanian Data Protection Authority (ANSPDCP) disclosed on its website information regarding the...
When Can Information On Criminal Records Be Requested By Employers A recent Opinion of the Bulgarian data protection authority and certain legislative changes lead to the conclusion that in Bulgaria...
A new member has joined the INPLP: Kirsten Wolgast (Germany) Pinsent Masons is a full-service international law firm. They respond to the pressures and opportunities facing businesses globally...
Denmark´s first GDPR fine to date On February 12th 2021 the city Court in Aarhus handed down the first verdict in Denmark that has led to a fine based on GDPR. The...
Right to access of origin of the information based on Swiss Federal Act on Data Protection (FADP) The Swiss Federal Supreme Court has made an interesting decision on the scope of the right to information under Swiss Federal Act on...
Schrems II: An opportunity for the Sovereign Cloud As personal data crossborder flows cannot benefit from the “EU-US privacy shield” anymore, as a consequence of the Schrems II...
When privacy became an investment risk. Shall companies report its security incidents to the market? Potential investors are being warned of the negative impact that the GDPR sanctions may have on the expected profitability of the...
No surprise here – the EU Court confirms again that public authorities’ access to telecom data is strictly limited Public authorities’ access to electronic communications data has always been and continues to be a hot topic, even (or especially)...
Dramatic Changes are Coming to the Privacy Landscape in Canada This article discusses how the proposed legislation seeks to strike a balance between protecting consumer’s personal information, and...
Brazil’s Data Protection Law: A Brief Overview Despite being no stranger to data privacy regulation, only recently has Brazil enacted a comprehensive set of rules to regulate the...
Cyprus Data Protection Watchdog imposes fine on major banking institution for integrity and confidentiality violations. On 19 October 2020, The Office of the Commissioner for Personal Data Protection ('the Commissioner') announced its decision to fine...
No GDPR fines for public sector bodies at all? No discrimination, and no problem! The GDPR explicitly allows Member States to determine whether and to what extent administrative fines can be imposed on public...
A new member has joined the INPLP: Wendy Wagner (Canada) Gowling WLG provides its clients with in-depth expertise in key global sectors and a suite of legal services at home and abroad...
A Privacy Law for 25% of the World’s Population: China’s Personal Information Protection Law China published the Personal Information Protection Law (Draft) ("PIPL") for public consultation on 21 October 2020. This is the...
A new member has joined the INPLP: Paul Haswell (Hong Kong) Pinsent Masons is a full-service international law firm. We respond to the pressures and opportunities facing businesses globally...
Can data protection rules affect the assignment of receivables in Bulgaria? For many years, a common practice in Bulgaria is debtors to submit complains to the Bulgarian DPA for unlawful processing of their...
Are fines imposed by the Luxembourg Data Protection Authority for breach of data protection regulations insurable? There is no shortage of recent examples of cyber-attacks and the current COVID-19 pandemic is undoubtedly contributing to an...
A new member has joined the INPLP: Fábio Lacaz (Brazil) ALV Advogados is a mid-sized commercial law-firm established in 2006, with the purpose of assisting domestic and foreign clients in...
Austrian Data Protection Authority Ruling On The Right To Obtain A Copy (Art 15 Para 3 Gdpr) Art 15 GDPR does not only enable the data subject to obtain information on the content of his/her data undergoing processing, but...
Recent decisions of the Austrian Data Protection Authority This article presents interesting decisions on Austrian data protection law, in particular the decisions on (1) disclosure of trade...
Detecting Online Terrorist Content and the Confines of Privacy Terrorist attacks aren’t new: they’ve been a feature of warfare ever since humans formed societies. As humanity evolves, the methods...
A new member has joined the INPLP: Jonathan Kirsop (United Kingdom) Pinsent Masons is a full-service international law firm. We respond to the pressures and opportunities facing businesses globally...
Switzerland’s Data Protection Landscape post Schrems II and Brexit On 25th of September 2020, the Swiss parliament has adapted the Federal Act on Data Protection (FADP). However, the FADP - which aims...
A new member has joined the INPLP: Francisco Pérez Bes and Esmeralda Saracíbar (Spain) ECIX is a consultancy specializing in data protection and regulatory compliance, helping its clients meet the challenges that the...
A new member has joined the INPLP: Jasmina Brezovska and Katerina Rumenova (North Macedonia) BONA FIDE is a full-service corporate law firm based in the Republic of North Macedonia and specialized in general corporate/M&A,...
When use of chat apps and social media platforms backfire on companies and data subjects' rights On 17 December 2020, the Romanian Data Protection Authority (ANSPDCP) has published on its website a new administrative sanction in...
Digital Platformer Regulations in Japan The Act on Improvement of Transparency and Fairness in Trading on Specified Digital Platforms
Letter to the EDPB in response to the recently adopted recommendations published by the EDPB With a letter to the European Data Protection Board (EDPB), the International Network of Privacy Law Professionals (INPLP) made use...
Monaco: the 2019 Report of the Personal Data Protection Authority published The Monegasque Data Protection Authority (hereinafter “CCIN”) has just published its 11th Activity Report covering the year 2019, of...
A Path Forward – Draft Guidance Published For Dealing With International Data Transfers Post-Schrems II In the wake of the decision of the Court of Justice of the European Union (CJEU) in Schrems II, controllers and processors have been...
Scientific Research across Europe. Does the GDPR ensure an aligned approach? The GDPR aims to establish a uniform legal framework applicable to the processing of personal data across Europe, while allowing...
Personal data breaches: guidelines to support data controllers released The Spanish Data Protection Authority (AEPD) has just released a tool to help data controllers decide whether to communicate or not a...
Data Privacy And Protection Regulations In Nigeria Challenges Confronting Implementation Of Data Privacy And Protection Regulations In Nigeria
U.S. Outlines Privacy Safeguards for Post-Schrems II Data Transfers The U.S. government has published a whitepaper that outlines the robust limits and safeguards in the United States pertaining to...
Schrems II recommendations Important recommendations EDPB (European Data Protection Board) after Schrems II and new standard contractual clauses ...
5th annual INPLP conference The International Network of Privacy Law Professionals hosted its 5th annual conference
The Czech Republic: Is There A Possibility To Further Process Legally Published Personal Data That Are Not Open Data? The concept of open data in the European Union was firstly brought up by directive 2003/98/EC on the re-use of public sector...
600.000 EUR fine to Google Belgium for misapplying the right to be forgotten The right to be forgotten is one of the more complex rights in the GDPR, requiring a careful balancing of principles and interests....
Draft Code of Conduct of lawyers, law firms and lawyers’ unions on the processing of personal data issued in Greece Under the GDPR, Codes of Conduct (CoC) constitute an effective accountability tool for achieving self-regulation and transparency of...
Romanian DPA fines the lack of cooperation with the supervisory authority The Romanian Data Protection Authority ("Romanian DPA") has recently sanctioned three entities (two private companies and a...
Slovak country-wide COVID-19 testing from the perspective of personal data protection Slovakia has recently witnessed a significant increase in the number of confirmed COVID-19 cases. The country exceeded the threshold...
The Danish Data Protection Agency is investigating the research area The Danish Data Protection Agency has decided to supervise a number of activities in the research area. The Authority also initiates...
Facial recognition technologies from a Swedish data protection perspective Technologies for facial recognition - capable of identifying and/or verifying a physical person automatically from a digital image or...
Judicial remedy against decisions issued by Turkish data protection board Under the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board (“Board”) has the authority to...
The norwegian data protection authority threatens to impose legal measures against the international baccalaureate organization The DPA considered IBO’s processing to be in violation of the fairness requirement, transparency requirement and the accuracy...
The handbook on the protection of privacy by transport entities in a digital environment in Israel The Israeli Privacy Protection Authority published a handbook for transport entities on the protection of privacy by in a digital...
Microsoft cloud contracts under a cloud amid GDPR concerns (continuation — and conclusion?) In April 2019, the “EDPS” or European Data Protection Supervisor, launched an investigation into the use of Microsoft products and...
GDPR versus ISO 27701 Although some jurisdiction such as EU's GDPR provide a mechanism for an organization to demonstrate its compliance to GDPR (Article...
Spanish Data Protection Authority (AEPD) releases new Guidelines on the use of Cookies The Spanish Data Protection Authority (AEPD) has just updated the Guide on the use of “cookies” to adapt it to the Guidelines 05/2020...
Overview on the Amendment of the Act on the Protection of Personal Information The Act on the Protection of Personal Information (“APPI”) of Japan was established in 2003, and had only been amended once, in 2015....
The British Data Protection Authority ICO considers operating systems that are no longer supported inadequate security. If systems such as Windows 7 and Windows Server 2008 R2 SP1 are no longer supported by Microsoft, this may result in inadequate...
New member has joined the INPLP. Mr. Fredrik Roos and Ms. Linda Källström (Sweden) Setterwalls is one of Sweden’s leading full-service business law firms, as well as one of Sweden’s largest law firms, with some 190...
Judicial remedy against decisions issued by Turkish data protection board Under the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board (“Board”) has the authority to...
The Bulgarian Data Protection Authority Issued Opinions on the Processing of Personal Data by Employers During the COVID-19 Pandemic In its Newsletter 4 (85) of July 2020 the Bulgarian Commission for Personal Data Protection (CPDP) released two opinions that provide...
An extensive article on data privacy and data protection law in nigeria The transformational value of data in today’s world cannot be overemphasised. The right to data privacy and protection is an...
DATA PROTECTION AND CORONAVIRUS: A difficult challenge for Businesses. In the context of the coronavirus pandemic, companies are implementing exceptional measures to protect the health and safety of their...
GDPR and Artificial Intelligence – A Conscious Coupling It is an undeniable fact that Artificial Intelligence (“AI”) has rapidly evolved in recent years and has even more swiftly been...
New Dutch class action legislation makes it possible to claim damages in a collective action to ensure enforcement of the GDPR On 1 January 2020, a new Act allowing representative entities to seek damages in a collective action came into effect in the...
The Italian Data Protection Authority Published Its Annual Report: In 2019, Public And Private Entities Notified 1443 Data Breaches The annual report summaries the different issues on which the Italian Data Protection Authority (“Italian DPA” or “Authority”) worked...
The Unauthorised Access to Personal Data by the Slovenian Police On July 10, 2020, a press conference was held in the hall of Slovenia’s legislative body by Jožef Horvat, MP, a member of one of the...
Gaia-X: European sovereign cloud guidelines unveiled The guidelines of the European Gaia-X cloud are now known.
German Federal Court - Finally clarified: tracking cookies not without active consent The discussion is not new. The European Court of Justice (ECJ) had already decided on 01.10.2019. But only the German Federal Court...
Estonia wants to introduce administrative fines into its legal system to allow for a more effective response to data protection law violations On 6 May 2020, the Estonian Ministry of Justice sent for coordination round the concept of administrative fines. The goal is to...
New member has joined the INPLP. Mr. Uche Val Obi SAN (Nigeria) Alliance Law Firm is a dynamic partnership registered under the laws of the Federal Republic of Nigeria. With a seamless blend of...
Appointment of director of Croatian supervisory authority As everyone already knows, Article 53(2) of the General Data Protection Regulation prescribes the criteria that the director of a...
Is it possible and if it is, how can an employer in Serbia collect personal data of the employees that refer to their criminal records Criminal records contain personal data on the perpetrator of a criminal offense, on the criminal offense for which he was convicted,...
First GDPR fines in Ireland: Big Tech Fines on the horizon In May 2020 the Data Protection Commission (DPC) in Ireland issued its first fines under the GDPR, just prior to the second...
2 years of GDPR, 1 year of Portuguese implementation law The 25th of May marked the second anniversary of the application of the General Data Protection Regulation (GDPR) in the European...
Revision of the Swiss Federal Data Protection Act (FDPA) Due to the Covid-19 pandemic, the last debates in the Swiss parliament were postponed to the autumn session. However, an outlook can...
New member has joined the INPLP. Mr. Chris Yau (Hong Kong) SGS Hong Kong Limited is the Hong Kong branch of SGS group. Established in 1878, SGS is the world’s leading inspection, verification,...
The Swedish and Norwegian Data Protection Authorities have recognized the Danish standard contractual clauses in relation to data processor agreements The Danish Protection Authority has adopted standard contractual clauses in accordance with article 28(3) of the GDPR. The national...
Statement by the Spanish Data Protection Authority (AEPD) on processing of certain health data in the context of Covid-19 The Spanish DPA (AEPD) issued this May a statement regarding the practice of taking the temperature to data subjects in shops, work...
Body temperature readings and the Covid-19. What should we do? Short synopsis of the Romanian status During the Covid-19 pandemic we received numerous and various questions from our clients regarding body temperature readings of...
Fight against covid-19 pandemic in Monaco: temperature taking, camera detection of facemask wearing, and diagnostic tests In early May 2020, the Monegasque Data Protection Authority (Commission de Contrôle des Informations Nominatives, in brief “CCIN”)...
Austrian Court Ruling on Immaterial Damages for GDPR violation – A Mere Violation Of Data Protection Regulations Is Not Enough In February, the first decision of an Austrian Appellate Court regarding a claim for immaterial damages under Art 82 GDPR has been...
New member has joined the INPLP. Mr. George Dimitrov and Mrs. Desislava Krusteva (bulgaria) Dimitrov, Petrov & Co. (DPC) is a full-service business law firm, pioneer in the dynamic field of technology law and data protection...
New member has joined the INPLP Mr. Satoshi Shono (Japan) Matsuda & Partners is a one-stop shop, offering a variety of legal services that cover business related practice including corporate...
Greek data protection watchdog makes its presence clear During the unprecedented Covid-19 pandemic, but also before its appearance, the Greek Data Protection Authority (“DPA”) has taken an...
Presentation of the casebook on Data Protection INPLP member, Olumide Babalola (Lagos, Nigeria), cordially invites the general public to the (virtual) presentation of a book titled...
When is it legal to be named as a reference? For many companies, it is significant for customer acquisition not only to present the advantages of their own products and services,...
New member has joined the INPLP. Mr. Michel Molitor and Mrs. Virginie Liebermann (Luxemburg) Founded in 1996, MOLITOR Avocats à la Cour is a highly respected and independent law firm in Luxembourg City, a full-service firm...
New member has joined the INPLP. Mrs Nicole Beranek Zanon (Switzerland) Nicole Beranek Zanon is a founding partner of de la cruz beranek Attorneys at Law Lt, which is one of the leading IT boutique law...
EU Guidance on Apps Supporting Fight against COVID-19 Pandemic in Relation to Data Protection At the end of April, the European Union published non-binding guidance on apps supporting the fight against COVID 19 pandemic in...
New member has joined the INPLP. Mr Xawery Konarski (Poland) Xawery Konarski is Senior Partner at Traple Konarski Podrecki & Partners which is one of the leading law firms on the Polish market...
Facial recognition and GDPR compliance: the impossible convergence? The use of photographs in police investigations is nothing new. It is the use of algorithms so that a machine, using template image...
United Kingdom’s Supreme Court erred on liability of joint-data controllers UK Supreme Court decision on an employer’s liability for data breach in the case of WM Morrison Supermarkets versus Various...
New Member has joined the INPLP. Mr Olumide Babalola (Lagos, Nigeria) Olumide is the managing partner of Olumide Babalola, LP - his flagship full service law office with particular bias for digital...
The Belgian data protection authority fines a data controller 50,000 EUR for appointing a DPO with a potentially conflicting position It is not too uncommon for a single person to be in charge of general compliance in an organisation, and to also act as its DPO. Is...
A US$ 6 Million Judgment was Passed in Israel, for the Sale of Location Data On March 23, 2020, a 5 year class action that was until now under a gag order, was finally lifted and the Judgment (authorization of...
Protection of Personal Data vs. Citizen’s Health At the time of the fight against the corona virus pandemic, the need to establish an imaginary border between the protection of...
Using data from mobile phone apps in the combat of COVID-19 in Norway The COVID-19 pandemic and the measures to combat the spread of the virus are having a severe impact in a number of countries,...
Covid-19 and personal data protection in turkey – Frequently asked questions This article answers many freuqently asked questions concerning data protection in turkey during times of Covid-19. ...
Protection of personal data of employees (and other persons) during the state of emergency in the Republic of Serbia One of the possible solutions for processing personal data based on a legitimate interest of companies.
Italian data protection authority against the unlawful data processing through telemarketing activities The Italian Data protection Authority (Italian DPA) issued two fines against Tim and Eni Gas e Luce, for a total amount of almost 36...
EDPB Issues Guidance on GDPR Compliance in the Age of COVID-19 After many data protection authorities (in the European Union and beyond) provided guidance and FAQ's on the relationship between...
The re-use of public sector information The re-use of Public Sector information has to be built on a balanced approach where the public interests of such use have to be...
GDPR through the prism of coronavirus epidemic The difficulty of drawing a hard-and-fast line between the right to privacy and the rights of other people to stay healthy ...
Fine for a lack of legal basis of scoring sick leaves of employees An administrative Fine of 82,000 EURO was imposed by the Cyprus Data Protection Authority concerning the lack of legal basis of...
Fine for Dutch tennis association for unlawfully selling personal data The Dutch DPA imposed a fine of 525,000 euros for the unlawful sale of personal data by the Dutch national tennis association the...
Recent decisions of the Austrian Data Protection Authority (DPA) This article presents interesting decisions on Austrian data protection law, which deal in particular with the admissibility of...
Five tips on preparing for ‘whistleblowing’ rules In order to guarantee protection of people who report breaches, I.E. Whistleblowers, employers will soon be obliged to create a clear...
Enforcement of GDPR Infringements by Third Parties – First Decision of the Austrian Supreme Court While the GDPR deals extensively with the rights and claims of data subjects, it mainly leaves the provisions for the assertion of...
Romanian DPA published its activity report for 2019 On the European Data Protection Day 2020 (i.e. on 28 January 2020), the Romanian DPA published (in Romanian and English languages) a...
GDPR news from Croatia at the beginning of 2020 The topic discussed here is the difference between personal data protection before the GDPR entered into effect and the current data...
Data Protection round-up: Key stories of 2019 and forecast for 2020 2019 was a year of major developments for privacy and data protection in Ireland and abroad. According to Ireland, the year 2020 will...
Microsoft under a cloud amid GDPR concerns over its cloud contracts Since the implementation of the GDPR, cloud players have been forced to both rethink their tools and review their contracts. ...
Data breach notification obligation under turkish data protection law In Turkey, the Personal Data Protection Law No. 6698 (the "Law") requires data controllers to take all necessary technical and...
5 takeaways from the first year and a half of GDPR fines The end of the year is usually the time for reflections. Although the first year of GDPR officially ended at the end of May 2019, now...
Report on the State of Privacy in Slovakia The Office for Personal Data Protection of the Slovak Republic (hereinafter referred to as “Office”) pursuant to the provisions of §...
The Danish Data Protection Agency has published new rulings regarding email encryption within the security of processing area Article 32 of the GDPR on the security of processing has been one of the main focus areas of the Danish Data Protection Agency (the...
The Belgian data protection authority issues a fine for unlawful use of the national identity card as a tool for customer card enrolment The Belgian electronic identity card system has been in vogue for a number of years now as a reliable means for electronic...
Administrative fine of 14.500.000 Euro imposed against German Real Estate Company The Berlin Data Protection Authority has imposed an administrative fine against a Berlin real estate company for 14,5 Million euros...
Conditions for imposing administrative fines – The German Data Protection Authorities’ approach On 16 October 2019, the German Data Protection Authorities (DPAs) published their concept of how to determine administrative fines. ...
Portugal: recent fines for the breach of the GDPR More than a year has passed since the General Data Protection Regulation (hereinafter “GDPR”) has been applicable in all EU member...
iGaming and Privacy in Malta: Tensions? Data, and not FIAT or digital currency, is the real currency that measures the worth of a gambling operation, and the single common...
Privacy News from Israel On November 24, 2019 the Israeli Privacy Protection Authority (the “IPPA”) announced that it had hosted an inter-sectoral roundtable...
Draft Guidelines on Data Protection by Design and by Default issued by the EDPB On 20 November 2019, the European Data Protection Board (EDPB) issued a draft of Guidelines on Data Protection by Design and by...
PERSONAL DATA PROTECTION LAW IN MONACO: A “STRUCTURAL MODIFICATION” ANNOUNCED The preparatory work for the reform of the Monegasque data protection law (Act No. 1.165 of 23 December 1993, consolidated), carried...
Significant fines imposed by the Bulgarian Commission for Personal Data Protection Earlier in 2019 the Bulgarian data protection supervisory authority – the Bulgarian Commission for Personal Data Protection (“CPDP”)-...
CNIL on monitoring employee software / internet use Use of video recording of screens, coupled with recordings of telephone conversations in a professional setting, may be proportionate...
Obligation of Notification of Personal Data Violations to Turkish DPA Law on Protection of Personal Data numbered 6698 provides under the article titled “Data Security Liabilities” that, data controllers...
Serbia - readiness/lack of readiness of controllers and processors and knowledge of individuals regarding application of the new Law on Personal Data Protection In August 2019, Serbia started applying new Law on Personal Data Protection. Many challenges were expected before initiation of the...
New European judgment on cookies In its recent judgment in the “Planet49 case”, the Court of Justice of the European Union (“CJEU”) held that consent for cookies...
New Greek law on GDPR Following a fast track procedure, the Greek Parliament adopted Law 4624/2019, which frames the provisions of the GDPR in Greece and...
Does the California Consumer Privacy Act Apply to Me? The California Consumer Privacy Act (CCPA), a broad-based law protecting information that identifies California residents, was passed...
If at First You GDPR, CCPA, CCPA Again The California Consumer Privacy Act (CCPA), which takes effect in 2020, has been dubbed “GDPR-Lite” or “California GDPR” because it...
On The Road Again: Practical First Steps On Your Way to Compliance with the CCPA The California Consumer Privacy Act (CCPA), a broad-based law protecting information that identifies California residents, will take...
20 Questions (and Short Answers) on the California Consumer Privacy Act (CCPA) The California Consumer Privacy Act (CCPA), a broad-based law protecting information that identifies California residents, was passed...
Recent decisions of the Austrian Data Protection Authority (3/3) This article presents the third out of three interesting decisions on Austrian data protection law, in particular dealing with...
Would you like some cookies? When users browse through the internet, cookies perform multi-faceted functions for the benefit of both the webmasters and users...
Recent decisions of the Austrian Data Protection Authority (2/3) This article presents the second out of three interesting decisions on Austrian data protection law, in particular dealing with...
The Italian Data Protection Authority Limits the Sending of Advertising and Promotional Contents to Fidelity Cards Holders For the first time, the Italian Data Protection Authority has exercised its power of "warning" provided by the GDPR, through which it...
Recent decisions of the Austrian Data Protection Authority (1/3) This article presents the first out of three interesting decisions on Austrian data protection law, in particular dealing with...
The Spanish DPA (AEPD) issues a model report to help carry out data protection impact assessments for public administrations The AEPD published in July 2019 a model report to help Public Administrations carry out im-pact assessments on data protection. ...
€ 150.000,- GDPR fine imposed on PWC by Greek Data Protection Authority for being not accountable The Greek HDPA (Hellenic Data Protection Authority) imposed a fine of € 150.000,- on PWC Greece.
GDPR - the real threat to privacy? Over 2 years, GDPR and personal data protection has been discussed across the EU. Vast majority of companies, public authorities and...
Fine of € 460.000,- imposed on Dutch Haga Hospital by Dutch Data Protection Officer, the first Dutch fine under GDPR (July 19, 2019) This first fine under the GDPR is imposed on the Dutch Haga Hospital for having an insufficient internal security of patient records...
Slovenia’s DPA says mere possession of processing equipment does not amount to personal data processing Slovenian courts have in place a system for audio recording of court hearings. The data recorded (which in itself constitute personal...
Welcome to Croatian version of GDPR - Introduction First, I would like to thank the members and the entire EuroCloud organization for letting me join their ranks. I sincerely thank...
One year of GDPR in Estonia Each Spring, the Estonian Data Protection Inspectorate (DPI) publishes its Annual, summarising its main activities of the previous...
GDPR IN NUMBERS – The Irish Perspective To mark the occasion of GDPR's first anniversary, findings and statistics tracked from May 2018 to May 2019 concerning awareness,...
Portuguese Law implementing GDPR finally approved On the 14th of June 2019 (one year later than expected) Portugal has finally approved Draft Law no. 120/XIII/3.ª (GOV), implementing...
GDPR: A Game Changer for Cloud Contracts Until recently, most IT contracts, even the large-scale ones, were generally based on a simple purchase order and sometimes a...
The 4th version of the StarAudit Catalogue has been released We've introduced a new Area focused on GDPR and several enhancements to existing controls as part of this major update. ...
Guidance on the Regulation on a framework for the free flow of non-personal data in the European Union Last week the European Commission published guidance on the free flow of non-personal data, focussing on the interaction of the FFD...
Legislative and practical adjustments in Bulgaria implementing GDPR Earlier in 2019 Bulgaria has become another European Union member to adopt the EU’s privacy regime. The Bulgarian Personal Data...
The Danish Data Protection Agency has reported a large Danish taxi company to the police for violation of GDPR rules The Danish Data Protection Agency has reported the taxi company, Taxi 4x35, to the police and recommended the company for a fine of...
Serbia: New Law on Personal Data Protection At the end of November 2018, the new Law on Personal Data Protection (Law) came into force but its application was postponed for nine...
The Belgian data protection authority bans the use of private sector logins as an access condition to public sector websites The Belgian tax authorities maintain an online repository called FisconetPlus, on which tax payers can find key information and...
Slovak list of processing operations which are subject to the requirement for a data protection impact assessment Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of...
Challenges for Companies with an Israel Nexus In May 2018, the Israeli Protection Of Privacy Regulations (Data Security 2017) (the “Regulations”) came into effect. The...
Norwegian DPA publishes list of processing activities with mandatory DPIA Under Article 35 of the GDPR, the national Data Processing Authority (DPA) shall establish and make public a list of processing...
Three Legal Opinions of the Italian DPA clarify some GDPR Implementation Aspects The aim of this article is to focus on three important legal opinions published by the Italian Data Protection Authority on the...
On 19 February 2019, the Dutch Data Protection Authority has come up with its own policy for determining the levels of administrative fines On the basis of the guidelines of the article 29 working party of what now is the EDPB (European Data Protection Board) and the...
The Spanish DPA published a report on the processing of personal data related to political opinions by political parties The Spanish DPA published a recent report on the processing by political parties of personal data related to political opinions. ...
Implications on Data Protection law in the event of a no-deal Brexit Since the 2016 referendum whereby voters expressed their wish for the United Kingdom (the “UK”) to leave the European Union (the...
Data Protection Officers under Slovenia’s Draft Personal Data Protection Act (ZVOP-2) In the light of the GDPR, on March 6, 2019, Slovenia’s Ministry of Justice published <a...
The role of Romanian courts in the protection of personal data in the post GDPR era Where does the role of the data protection authority (DPA) end and where the court takes priority? The relevant legal provisions are...
Three interesting decisions on Austrian data protection law This article presents three interesting decisions on Austrian data protection law, in particular dealing with an unlawful video...
Liability of Joint Controllers in the Light of the CJEU Case Law General Data Protection Regulation (GDPR) brought (for the Czech legal environment completely new) legal construct of joint...
The Looming Clouds: How and why cloud services are reshaping the future of financial services in Europe EuroCloud Europe publishes a new whitepaper in partnership with RedHat and Accenture, tracing the drivers of change across the...
To be or not to be (a processor). That is the question. In the case of a service provider that is not contracted by a controller to process personal data on its behalf but may gain custody...
EU–U.S. Privacy Shield adequacy decision (“Privacy Shield”) adopted on 12 July 2016, assessed by EDPB in report January 22, 2019 The EDPB (European Data Protection Board) assessed in its January 22, 2019 report once again whether the safeguards provided under...
Google fined $57m by French regulator for breaching GDPR French data protection authority CNIL has slapped a €50 million ($57 million) on Google for failing to meet requirements under the...
Joint Controllership Report EuroCloud Europe will establish a European database of case-studies describing sector specific joint-controllership relations, as...
Data Breach Report EuroCloud Europe will undertake to create a European database of data-breach-related DPA decisions and court judgments. ...
Is a violation of a GDPR rule at the same time a violation of competition law? According to the Oberlandesgericht Hamburg (Higher Regional Court Hamburg) violations of data protection rules can also mean a...
Properly identifying roles in processing personal data: the latest from the EU Court of Justice In the last six months, the EU Court of Justice has provided its views on the roles of different parties processing personal data on...
2018 Highlights of data protection in Monaco The year 2018 was for Monaco a preparatory year for the forthcoming adaptation of Act No. 1.165 on the protection of personal data,...
The Dutch Data Protection Authority (Dutch DPA) clarifies the concept “large scale” for the Data Protection Officer (DPO) Government agencies and public organisations have the obligation to appoint a DPA, regardless the type of data they process. ...
Joint Controllership Sub-group News During 2018, the Not-for-Profit International Network CPC set up some study groups with the aim to analyze and compare the Member...
Compete for the best cloud solution worldwide – the EuroCloud Awards 2019 start now The EuroCloud Awards recognize the best digital services from Europe and around the world based on their underlying cloud computing...
Supreme Court Finds the Publisher and the State Liable for Personal Data Breach In August 2018, the Supreme Court of the Republic of Slovenia upheld the judgements of the lower courts finding the publisher and the...
New cybersecurity law imposes security and reporting obligations to Operators of Essential Services and Digital Service Providers The Greek Parliament recently enacted Law 4577/2018, the purpose of which is to transpose Directive (EU) 2016/1148 on security of...
Uber fined £385,000 in the UK and €600,000 in the Netherlands Uber US and Uber Netherlands were considered to be joint controllers which made them both separately liable for claims of customers...
3rd CPC Conference of the members of the EuroCloud CPC Network Vienna, 24 Nov 2018: This year, lawyers from 13 countries attended the event in Vienna and approved a comprehensive list of...
Slovenia’s ICO defines DPO’s additional tasks that could result in a conflict of interests Paragraph 6, Article 38 of the General Data Protection Regulation (GDPR) allows the Data Protection Officer (DPO) to fulfil other...
The Spanish DPA (AEPD) issues guidelines regarding the management and notification of security breaches according to GDPR The Agencia Española de Protección de Datos ( AEPD) presented guidelines regarding the management and notification of security...
Turkey: Data Protection Matters in M&A Transactions Privacy issues in mergers and acquisitions take the attention of transaction parties among other things in these days. ...
With Legislative Decree 101/2018, Italy harmonized the national privacy legislation to the GDPR With Legislative Decree n. 101/2018 the Italian legislator has finally taken the last necessary step in order to coordinate the local...
Doping control in sport – how about personal data? As the legal representatives of the Slovak Anti-doping Agency (hereinafter referred to as “SADA”), we have taken part in several...
List of personal data processing activities that must be subject to a Data Protection Impact Assessment (“DPIA”) The CNPD (Portuguese Data Protection National Commission), as the Portuguese supervisory authority, has approved Regulation nr....
In-vehicle emergency call systems (e-call) in Turkey In-vehicle emergency call (eCall) systems, which have been in use for a long time, are defined as systems within vehicles being...
Privacy Shield: Brace Yourself, Changes are Coming Since the application of the GDPR, the days of the EU-U.S. Privacy Shield may be numbered and parties to an IT contract must be on...
Controller-Processor relationship in public sector (Bulgaria) With the entry into force of Regulation (EU) 2016/679 (the “General Data Protection Regulation”) on 25th May 2018, the matter of...
Mandatory e-mail encryption from January 1st 2019 in Denmark The new practice of the Danish Data Protection Agency requires all work related e-mails containing personal data is to be encoded...
The days after the GDPR – The Cyprus Law on the Protection of Natural Persons against the Processing of Personal Data and the Free Movement of this Data This year, on the 25th of May 2018, the highly anticipated and monumental EU General Data Protection Regulation (henceforth “the...
GDPR With an Irish Flavour – The Irish Data Protection Act 2018 Ireland's Data Protection Act 2018 (the "DPA"), which implements elements of the European Union's General Data Protection Regulation...
Oliver – Helping the Masses Navigate GDPR through Artificial Intelligence Privacy is key to a healthy information society and the recently-enacted GDPR offers EU citizens significant control over how their...
Portuguese Data Protection Authority activities - Data Protection Impact Assessment List and notifications for DPO and Data Breaches The Portuguese Data Protection Authority (“DPA”) recently announced a public consultation on the list of processing activities that...
The Estonian data protection authority issued guidance on the definition of “large scale” processing The Estonian data protection authority (Data Protection Inspectorate, DPI) issued guidance on the definition of “large scale”...
Latvia has adopted the Law on Personal Data Processing The national Law on Personal Data Processing (the National Law) has entered into force on July 5th, 2018, which made Latvia the first...
GDPR: Your rights after death Dr. Gege Gatt, Partner of the EuroCloud CPC Network, shares his thoughts following the recent landmark judgement by the German Court...
“White list” – (Austrian) Exceptions to the Privacy Impact Assessment The General Data Protection Regulation (GDPR) stipulates that (data) controllers must carry out what is known as a "data protection...
A European Sovereign Cloud: the Silver Lining to the U.S. CLOUD Act The adoption of the U.S. Cloud Act weakens the integrity and security model of leading public cloud providers. ...
The Spanish Data Protection Authority (AEPD) issues a check-list on regulatory compliance The Spanish DPA issued a check-list regarding regulatory compliance to facilitate the implementation of GDPR. ...
Employee monitoring under the Romanian law implementing GDPR On 27 June 2018, the Romanian Parliament finally approved the Romanian law intending to cover the open clauses under the General Data...
GDPR in a Post-Brexit Era: Some New Challenges? The General Data Protection Regulation (GDPR) came into full operation on 25 May 2018 and was described by the Information...
CPC Presentation Brochure 2018 Halfway through 2018, we have published a presentation brochure detailing the status and results the Cloud Privacy Check (CPC)...
The Impact of the GDPR in Monaco until the Revision of the Monegasque Data Protection Legislation The Monegasque Data Protection Authority has published on its website on May 2, 2018 a list of the key questions on the GDPR...
A brief history of data protection: How did it all start? With the GDPR being enforced on 25th of May, we decided to take a glimpse back into the history of data privacy and traced it's first...
The discussions around the national law on personal data processing The Latvian legislator is facing delays with the adaptation of the national Law on Personal Data Processing (the Draft Law). On April...
A guide to the insurability of GDPR fines across Europe: the price of data security Zepos & Yannopoulos, partners of the EuroCloud CPC network, participated in a multi jurisdictional exercise organised by the...
The Danish Parliament has adopted the Danish Data Protection Act The act will to some extent replace the Danish Act on Processing of Personal Data and it will enter into force simultaneously with...
GDPR and its influence outside EU - Why, What, Who, When, How (Macedonia’s case study) GDPR is knocking on the door. Being a Europe’s country, and not being a European Union member country yet, does not release the...
Cloud Contracts, GDPR and Liability Caps Liability caps in contracts under the GDPR is a hot-button issue for data controllers and data processors. A few days before the...
Consent in imbalance of power Consent of a data subject is often used by data controllers in order to ensure lawful data processing. Still, processing on the...
The right to be forgotten… for convicted criminals? Earlier in March 2018, the Maltese press reported and revealed that private individuals have successfully requested that court cases...
Portuguese GDPR implementation legislation Even though the GDPR is directly applicable in the Member States, it has left open the possibility for Member States to enact...
Every Irish Cloud Has A GDPR Lining Ireland's Data Protection Bill 2018 (the "Bill"), which will implement elements of the European Union's General Data Protection...
Data Processing Agreement and its new challenges The long-expected General Data Protection Regulation (GDPR) comes with new, specific requirements for data processing agreements, as...
The recent provisions of the Italian legislator on data protection The Italian Legislator recently adopted two new laws on data protection matter, Law. n. 167/2017 and Law n. 205/2017, with the aim of...
The GDPR and the Fall of Biometrics In a world where smart technology has become the norm, where people access their phones and TVs with fingerprints and voice commands,...
Recent decisions of the Austrian Data Protection Office (DSB) and the Austrian Administrative Supreme Court (VwGH) The article presents three interesting decisions on Austrian data protection law, in particular dealing with control measures at the...
The New Belgian Data Protection Authority under the GDPR The Belgian Act of 3 December 2017, which was published in the Belgian Official Journal on 10 January 2018, partially implements the...
Österreich übernimmt Vorsitz der Artikel-29-Gruppe der europäischen Datenschutzbehörden Die österreichische Datenschutzbeauftragte Andrea Jelinek wurde zur Leiterin der Artikel-29-Datenschutzgruppe gewählt. Diese wird ab...
Public hospitals in Norway threatened with fines of NOK 7.2 million (EUR 720,000) following outsourcing project Public hospitals in Norway are organized in a structure where they are owned by four different regional legal entities. The regional...
How to choose a DPO? Practical insights The data protection officer (DPO) is a key function/office/position under the GDPR responsible for compliance with data protection...
GDPR in the Czech environment General Data Protection Regulation (GDPR) is going to govern the personal data protection matters across Europe since May 2018. Even...
20Q&A – The latest CPC project The 20Q&A project is intended to give the reader a quick overview and short summary of the most urgent questions regarding the...
The Data Protection Bill, Brexit and Data Transfers The Data Protection Bill (Bill) will replace the Data Protection Act 1998 and will implement the General Data Protection Regulation...
Monegasque DPA vs GDPR: Can you spot the difference? It would be wrong to infer from the fact that the Principality of Monaco is a non-EU State, that the General Data Protection...
Ireland: DP Bill to Implement GDPR and Overhaul Data Protection Commission A new Data Protection Bill will soon issue which will implement elements of the GDPR into Irish law and overhaul the Office of the...
Proposed Regulation on the Free Flow of Non-Personal Data in the EU Data is a resource for digital business and we can expect more and more rules regulating this vital resource. In addition to the GDPR...
How will national DPAs impose fines for GDPR violations? The GDPR introduced an antitrust-type sanction regime with fines which, for severe infringements, may amount up to 20 million euros...
New Latvian Personal Data Processing law is being developed Latvian Ministry of Justice has drafted text of new Personal Data Processing Law, which fulfils the assignment of Regulation (EU)...
Testimonials after the 2nd CPC Conference The CPC Conference participants present in Vienna between 24-26 November 2017 offer their feedback of the event. ...
Belgium’s New Data Protection Authority In implementation of the General Data Protection Regulation (2016/679), the Belgian Privacy Commission is being replaced by a new...
2nd Cloud Privacy Check (CPC) Event The 2nd Cloud Privacy Check (CPC) event took place between 24-26 November 2017 in Vienna, Austria.
Data Protection Law Enters the Social Media Era This last decade has undoubtedly marked a vast and worldwide sociological evolution which has defined and created a new generation...
The Spanish DPA (AEPD) presents “Facilita RGPD” The Spanish DPA (AEPD) presents “Facilita RGPD”, a tool created to help companies comply with the European Data Protection Regulation...
The Standard Contract Clauses under fire? In the recent case between the Data Protection Commissioner vs Facebook Ireland ltd and Maximillian Schrems of October 3rd 2017,...
Final straight for Luxembourg in implementing the European package on Data Protection A rapid overview of Luxembourg’s latest legislative measures in its preparation for European package on Data Protection with a...
GDPR: It is not just the fines! Even if a person does not know anything else about the GDPR, it usually knows about the massive potential fines the GDPR will bring...
Germany's GDPR implementation law, it's just the beginning The EU data protection reform package consisting of the General Data Protection Regulation (EU) 2016/679 (in German:...
Bărbulescu ruling: Workplace privacy is alive and kicking On Sept. 5, the European Court of Human Rights handed down a landmark judgement about privacy and monitoring at the workplace. The...
Cloud And Data Protection – A Challenge to Users Is your cloud compliant? Cloud experts Dr. Tobias Höllwarth, Dr. Jens Eckhardt, Christian Laux, and Dr. Clemens Thiele explore the...
GDPR: Rights and Obligations of Sub-Processors The GDPR clearly sets out the rights and obligations of sub-processors and requires them to meet strong contractual requirements. ...
Data Protection Officer / Bulgarian Overview With the upcoming entrance into force of the new General Data Protection Regulation in May 2018, the Bulgarian Commission for...
Notification of Personal Data Breaches: Promoting joint pro-activity in data security A brief discussion regarding the obligation of Controllers to notify the data subject and supervisory authority in the event of a...
New white paper on the general data protection regulation from the danish ministry of justice On May 24, 2017, the Danish Ministry of Justice published their long-awaited report on the Personal Data Regulation, which will...
The Greek Data Protection Authority issues an announcement on the need of certification of DPOs As we get closer to May 2018 when the GDPR will enter into force, the discussions on whether organisations should appoint a DPO and...
A Call for a European “Civil Code” of Digital Data Amid the rush to be GDPR-ready, the former European Commissioner for Digital Economy and Society was campaigning for a comprehensive...
Cloud Service Provider – processor, controller or both? Cloud service providers (hereinafter referred to as the „CSP“) offer nowadays a wide spectrum of cloud computing services. Benefits...
Certification and GDPR: Italy’s DPA Clarifications The GDPR encourages (through the Member States, the supervisory authorities, the Board and the Commission) the adoption of data...
Cloud Contracts: Impacts of GDPR on Joint Controllers The GDPR clarifies the concept of “joint controllers”, which is of particular interest for the cloud computing community. Already...
GDPR implementation in Portugal While studies show that there is a medium / high degree of awareness of the obligations and impacts of implementing the GDPR, the...
Recent decisions of the Austrian Data Protection Office (DSB) The article presents three interesting decisions on Austrian data protection law, in particular dealing with the scope of the right...
Cloud Contracts: Impacts of GDPR on Processors The GDPR clarifies the clauses to be contained in a data processing agreement. The new European Regulation does not change the...
Data protection and Luxembourg At a time where the General Data Protection Regulation (“GDPR”) has been spoken and written about extensively in all European...
GDPR-Complementing Regulations Just a Hair’s Breadth Away Introducing high administrative fines (a maximum of EUR 20 million or 4% of global annual turnover, depending on which is higher) and...
Five Key Takeaways from the Recent Report on National Implementation of the GDPR in Finland Right before the midsummer holidays, the TATTI working group appointed by the Finnish Ministry of Justice published its report on the...
Slovenia Strengthening its Position on Personal Data Protection The Supreme Court rules in favour of suspects' privacy while the Parliament declares "revenge porn" a criminal act. ...
Records of processing activities according to the General Data Protection Regulation (Art. 30) The General Data Protection Regulation (GDPR) will apply from 25 May 2018. Until then, all regulations of the GDPR have to be...
Dutch DPA published 10 steps to prepare for GDPR Recently the Dutch Data Protection Authority (Autoriteit Persoonsgegevens: "AP") published a 10-step-plan for Dutch organizations to...
Norway: New standard document on connected cars and privacy Modern cars generate, collect and process a large quantity of data. Some of the data can be linked to the owner, the driver and/or...
Emergence of a European cloud combining growth and security A safer and people-friendlier cloud must be built at the European level.
New Whitepaper "Cloud and Annual Accounts" June 2017 EuroCloud Europe has published in June 2017 a new whitepaper "Cloud & Annual Accounts".
New Whitepaper "Cloud & Data Protection" June 2017 EuroCloud Europe has published in June 2017 a new whitepaper "Cloud & Data Protection - The Cloud Privacy Check (CPC)". ...
The Swedish Data Protection Act Today the processing of personal data in Sweden is regulated in the Personal Data Act (Sw. Personuppgiftslag (1998:204)). On 25 May...
GDPR: The Italian Data Protection Authority Issues its First Guidelines By a press release dated April 28th, 2017, the Italian Data Protection Authority (“DPA”) issued its first guidelines (“Guidelines”)...
GDPR: Read from a CPC perspective I write this text assuming that the reader already knows well about the four-step test implemented by the CPC...
The impact of Brexit on EEA-UK data flows The free movement of personal data within the EEA is a cornerstone of the Single Market – crucial to businesses and consumers...
Draft Regulation on Data Controllers’ Registry On May 5th, 2017 the Turkish Data Protection Authority published the Draft Regulation on Data Controllers’ Registry (“Draft...
While preparing for the GDPR – Romania's perspective Data protection becomes hotter and hotter. Years ago a rather low tier area of law and practice, data protection is now being...
Characteristics of the General Data Protection Regulation A look at the new European Regulation which is bringing Data Protection law into the new century.
Personal Data Protection vis-à-vis Freedom of Expression and Information Respect for basic human rights and freedoms is a conditio sina qua non for continuous and proper development of individuals and...
The Spanish DPA (AEPD) presented new materials to help SMEs comply with the European Data Protection Regulation The Spanish DPA intends to make it easier for SMEs to be aware -during the transitional period until May 25, 2018- of the impact that...
Irish DPC Issues Guidance Note on the GDPR The Irish Data Protection Commissioner ("DPC") published a guidance note on the General Data Protection Regulation ("GDPR") in...
Data State Inspectorate examines the obtaining and saving personal data by third persons While the Ministry of Justice of the Republic of Latvia is working on the changes of national legislation for the application of the...
The Right to be forgotten - Practical perspective The right to be forgotten under article 17 of GDPR brought up conflict between the right of an individual to object to processing his...
Data Protection Compliance in Monaco: new online preregistration and new modalities for the declaration forms The Monegasque Data Protection Authority (CCIN) announced on the European Data Protection Day (28 January 2017) the possibility for...
Data Protection Compliance in Turkey On April 7th 2016, the long awaited Law on the Protection of Personal Data was enacted (the “Law”) in Turkey to regulate process and...
The Greek Supreme Court opens the way for employers to review electronic communications of employees The access to and review of corporate emails, other electronic communications and electronic files stored on the business computers...
The Belgian data protection authority provides its perspective on Data Protection Impact Assessments The upcoming General Data Protection Regulation contains an obligation to conduct a data protection impact assessment (DPIA) for...
Cloud Conference 2017 discussed the best practices, recent developments and risks of the cloud On 8 March 2017, the annual Cloud Conference organised by IT News (in Estonian: ITuudised) took place in Tallinn, Estonia. The...
Hearings in preparation of the GDPR The Danish Ministry of Justice has begun its work with the Danish adoption of the General Data Protection Regulation (the GDPR) in...
GDPR: a new hope for the use of BCRs for cloud providers in Portugal The GDPR brings a new hope for the application of BCRs, especially for cloud providers (as processors), as they are given specific...
The new law on personal data protection: legislative process in Slovakia has been launched In January 2017, the Office for Personal Data Protection of the Slovak Republic initiated the legislative process leading to the new...
Polish Data Protection Authority recommends encrypting email Polish DPA recent opinion on encryption as preferred response to confidentiality risks associated with email. ...
Two selected decisions on Austrian data protection law A case of the DSB (Austrian Data Protection Office) and one of the VwGH (Austrian Administrative Supreme Court) are presented below....
Meeting at the offices of Alain Bensoussan Avocats Lexing Paris, 6th of February 2017: meeting at the offices of Alain Bensoussan Avocats Lexing with Alain Bensoussan, Eric Le Quellenec,...
Malta IT Law Association (MITLA) workshop on Cloud Computing The Malta IT Law Association (MITLA) organised a workshop on Cloud Computing on the 12th of December 2016.
Data Protection Law Made Easy Lawyers from 32 countries have created the Cloud Privacy Check (CPC), the largest European information platform explaining data...
CPC conference Vienna, 28th-30th of October Contributors of the CPC projects from 20 countries met in Vienna for two days to prepare for the publications of the international...
Meeting with CPC partner Dr. Laux in Switzerland to prepare Phase2 of the project 25th February, Zürich: Meeting with CPC (cloudprivacycheck.eu) partner Dr. Laux in Switzerland to prepare Phase2 of the project....
EU GDPR, BCR, CPC and other stuff Tobias Höllwarth draws some lines between the new EU General Data Protection Regulation, Binding Corporate Rules, strategies of...
