IT Governance

DECEMBER 27, 2019

A royal baby, a fire at Notre-Dame, the highest grossing film of all time and more than 12 billion breached data records: 2019 has been quite a year. IT Governance is closing out the year by rounding up 2019’s biggest information security stories. Mumsnet disclosed a data breach affecting 4,000 people. million (£4.2

Data breaches 69

Data breaches GDPR Passwords Personal data 69

Hunton Privacy

JUNE 11, 2019

On June 6, 2019, the French Data Protection Authority (the “CNIL”) announced that it levied a fine of €400,000 on SERGIC, a French real estate service provider, for failure to (1) implement appropriate security measures and (2) define data retention periods for the personal data of unsuccessful rental candidates.

Personal data 104

Personal data Security GDPR Archiving 104

Data Protection Report

JULY 8, 2019

Following the now famous €50m fine imposed on Google LLC in January 2019, [1] the French Data Protection Authority (the CNIL ) published a decision taken on 28 May 2019 [2] imposing a fine of €400,000 on SERGIC, a company specialised in real estate development, purchase, sale, rental and property management.

GDPR 40

GDPR Personal data Compliance Security 40

Hunton Privacy

FEBRUARY 1, 2019

On January 25, 2019, the European Commission (the “Commission”) issued an infographic on compliance with and enforcement and awareness of the EU General Data Protection Regulation (“GDPR”) since the GDPR took force on May 25, 2018. Three fines have been issued under the GDPR so far.

GDPR 66

GDPR Data breaches Personal data Compliance 66

DLA Piper Privacy Matters

OCTOBER 17, 2022

A recent decision by the Irish Data Protection Commission (“ DPC “) imposing a record €405 million fine provides clarification on the lawfulness of processing children’s personal data in accordance with the legal bases of ‘performance of contract’ and ‘legitimate interest’. Background. Analysis of Article 6(1).

GDPR 97

GDPR Personal data Risk Compliance 97

Hunton Privacy

DECEMBER 1, 2020

Between June 8, 2018 and April 6, 2019, the CNIL received 15 complaints from individuals relating to the exercise of their data protection rights with affiliates of the Carrefour Group. Loyalty program members’ data had been retained for a period of four years from their last activity. and carrefour-banque.fr

GDPR 91

GDPR Personal data Data collection Marketing 91

Hunton Privacy

NOVEMBER 22, 2019

On November 13, 2019, the European Data Protection Board (“EDPB”) published its draft guidelines 4/2019 (the “Guidelines”) on the obligation of Data Protection by Design and by Default (“DPbDD”) set out under Article 25 of the EU General Data Protection Regulation (“GDPR”). on how to handle personal data.

Personal data 50

Personal data GDPR Compliance Risk 50

Hunton Privacy

AUGUST 13, 2019

On August 12, 2019, the Dutch Data Protection Authority ( Autoriteit Persoonsgegevens , the “Dutch DPA”) announced its intent to approve Nederland ICT’s Data Pro Code (the “Code”), a code of conduct for the ICT sector. Nederland ICT represents data processors from the IT sector.

GDPR 40

GDPR Personal data Data breaches Compliance 40

Data Protection Report

FEBRUARY 8, 2022

million individuals was exposed, including approximately 98,632 New Yorkers.The AG began an investigation based on New York’s Executive Law § 63(12) [deception] and General Business Law §§ 349 [deception] and 899-bb. The latter is the 2019 data security law known as the Stop Hacks and Improve Electronic Data Security (SHIELD) Act.

Passwords 98

Passwords Financial Services Authentication Insurance 98

DLA Piper Privacy Matters

JULY 29, 2020

The case against Google Belgium SA was initiated by a complaint filed with the Belgian DPA by a Belgian resident on 12 august 2019. The complainant, an executive at an unnamed large company, had requested the removal of 12 URLs which he considered to be harmful to his reputation. The case against Google Belgium.

GDPR 75

GDPR Compliance IT Privacy 75

Hunton Privacy

JANUARY 22, 2020

It applies to providers of information services likely to be accessed by children in the UK, including applications, programs, websites, social media platforms, messaging services, games, community environments and connected toys and devices, where these offerings involve the processing of personal data.

IT 54

IT Personal data Compliance Privacy 54

Hunton Privacy

JULY 1, 2019

On June 28, 2019, the French data protection authority (the “CNIL”) published its action plan for 2019-2020 to specify the rules applicable to online targeted advertising and to support businesses in their compliance efforts. Background. Action Plan. These draft recommendations will be open for public consultation.

GDPR 49

GDPR Marketing Personal data Privacy 49

HL Chronicle of Data Protection

APRIL 5, 2019

With the deadline for a no-deal Brexit looming—the UK’s exit date from the European Union is now slated for April 12—companies certified to the EU-U.S. Privacy Shield should update their Privacy Shield privacy policies if they have not done so already to ensure that they are able to lawfully receive personal data from the UK post-Brexit.

Privacy 40

Privacy Compliance Personal data Government 40

Hunton Privacy

DECEMBER 20, 2018

On July 12, 2016, the Commission adopted an adequacy decision on the basis that the EU-U.S. Privacy Shield ensured an adequate level of protection to personal data transferred from the European Economic Area (“EEA”) to the participating companies in the U.S. government will fill the position by February 28, 2019.

Privacy 52

Privacy Compliance Personal data GDPR 52

IT Governance

MAY 30, 2019

Just when you thought you were getting the hang of the GDPR (General Data Protection Regulation) , you learn that things are even more complicated. That’s been the reaction of many law enforcement bodies that have recently learned about their compliance requirements under the DPA (Data Protection Act) 2018.

GDPR 49

GDPR Personal data Government Compliance 49

HL Chronicle of Data Protection

NOVEMBER 15, 2018

On June 12, 2018, the Vietnamese National Assembly passed the Law on Cybersecurity (the “ Cybersecurity Law “), which will take effect on January 1, 2019. Localized storage and retention of personal data. Data created by a user (e.g. Data retention periods depend on the type of data being stored.

Cybersecurity 40

Cybersecurity Personal data Compliance Government 40

Hunton Privacy

MARCH 26, 2019

On March 14, 2019, the Dutch Data Protection Authority ( Autoriteit Persoonsgegevens , the “Dutch DPA”) published a press release announcing its policy (in Dutch ) for calculating administrative fines (the “Policy”). In certain cases, the Dutch DPA may also consider the financial situation of the data controller or processor.

GDPR 55

GDPR Personal data Authentication Compliance 55

Data Matters

NOVEMBER 12, 2019

As submitted for the comment period on Initiatives – Active Measures for Initiative 19-0021 on November 8, 2019. Dear Mr. Mactaggart, As privacy practitioners, we share your passion and dedication to the development of information privacy and data protection law in the United States. Household information.

Privacy 68

Privacy Data breaches Compliance Personal data 68

DLA Piper Privacy Matters

JANUARY 24, 2019

On 21 January 2019, the restricted committee of the French Data Protection Supervisory Authority (CNIL) fined Google LLC 50 million euros for breaching GDPR for lack of transparency, inadequate information and lack of valid consent regarding personalized advertising. . Lack of transparency and breach of information requirements.

Privacy 71

Privacy GDPR Personal data Compliance 71

DLA Piper Privacy Matters

NOVEMBER 24, 2020

How to properly calculate administrative fines for non-compliance with the EU General Data Protection Regulation (‘ GDPR ’) is one of the most important questions when applying the GDPR on practical level, e.g. : What is actually meant by the reference to “undertaking” in Article 83 (4) to (6) GDPR? million Euro as was too high.

GDPR 75

GDPR Authentication Compliance Personal data 75

HL Chronicle of Data Protection

MAY 29, 2019

Following the one-year anniversary of the coming into effect of the GDPR, Hogan Lovells’ Privacy and Cybersecurity practice has prepared summaries of key GDPR-related developments of the past 12 months. This personal data was still being held by late May 2018 and had been subject to unauthorised use by a third party.

GDPR 40

GDPR Personal data Privacy Information architecture 40

HL Chronicle of Data Protection

JULY 9, 2019

The ICO intends to use its own Sandbox to support organisations that are looking to use personal data in innovative ways through the use of new technologies and approaches. These organisations will participate in the beta phase which is due to run from July 2019 until September 2020.

GDPR 40

GDPR Personal data Privacy Financial Services 40

Data Matters

DECEMBER 9, 2019

The European Data Protection Board (“EDPB”) reported a total of 281,088 national enforcement actions being initiated as of May 22, 2019 (approximately one year after the GDPR’s entry into application). Since then, data protection authorities across the EU have been initiating enforcement and fines on a daily basis.

GDPR 60

GDPR Personal data Privacy Manufacturing 60

Data Matters

DECEMBER 9, 2019

The European Data Protection Board (“EDPB”) reported a total of 281,088 national enforcement actions being initiated as of May 22, 2019 (approximately one year after the GDPR’s entry into application). Since then, data protection authorities across the EU have been initiating enforcement and fines on a daily basis.

GDPR 60

GDPR Personal data Privacy Manufacturing 60

Hunton Privacy

APRIL 16, 2019

On April 12, 2019, Senator Edward J. Under the Act, the FTC regulations also would have to require covered entities to “establish and maintain reasonable data security practices to protect the confidentiality, integrity, and availability of personal information.”.

Privacy 57

Privacy Sales Compliance Access 57

IT Governance

JANUARY 9, 2024

The FTC will accept submissions until 12 January. NIST identifies “adversarial machine learning” threats New guidance from NIST offers approaches to mitigate AI malfunctions caused by exposure to untrustworthy data. KSV’s website urges people to buy an ‘InfoPass’ instead of letting individuals get a free copy of their data.

Data Privacy 75

Data Privacy Privacy Manufacturing Data breaches 75

Data Protection Report

JUNE 9, 2022

On 12 May 2022 EDPB adopted Guidelines on the calculation of administrative fines (the Guidelines ). Categories of personal data affected (e.g. A fine is considered effective where it re-establishes compliance with the rules, punishes unlawful behaviour or both. German Data Protection Conference.

GDPR 52

GDPR Compliance Personal data IT 52

IT Governance

DECEMBER 13, 2018

This week, in our last podcast of the year, we revisit some of the biggest information security stories from the past 12 months. Dixons Carphone admitted suffering a major data breach in July 2017, involving 5.9 million personal data records, and a second breach, in which customers’ names, addresses and email addresses were accessed.

Data breaches 71

Data breaches Personal data Access GDPR 71

DLA Piper Privacy Matters

OCTOBER 24, 2019

On 16 October 2019 – after weeks of rumors and speculations – the German data protection authorities (‘DPAs’) published their guidelines (‘ Guidelines’ ) for calculating administrative fines under Article 83 General Data Protection Regulation (‘ GDPR’ ). 12 to 14.4 (= 4 %). Minor violation. Medium violation.

GDPR 40

GDPR Compliance Personal data IT 40

HL Chronicle of Data Protection

OCTOBER 26, 2018

As part of our ongoing series on the CCPA, this post lays out why the issue of CCPA applicability to employees is controversial and nevertheless offers potential strategies to address CCPA compliance requirements as they may relate to personnel records. Opt-Out for Sale of Personal Information. Why the Uncertainty?

Privacy 40

Privacy Sales Compliance Personal data 40

Data Protection Report

JUNE 6, 2019

On May 29, 2019, Nevada enacted an amendment to its online privacy law, requiring businesses to offer consumers a right to opt-out of the sale of their personal information. The law also does not limit the number of times a consumer can make the request in a year, while CCPA limits requests to two (2) within 12 months.

Sales 40

Sales Privacy Insurance Manufacturing 40

Data Protection Report

MAY 16, 2019

On 15 April 2019, the ICO opened a public consultation on a draft code of practice titled Age Appropriate Design (the “Code” ). The Code will remain open for public consultation until 31 May 2019. 10-12: transition years. 0 – 5: pre-literate and early literacy. 6 – 9: core primary school years. 13-15: early teens.

Personal data 40

Personal data Privacy GDPR Access 40

Hunton Privacy

MAY 8, 2019

On May 3, 2019, the International Association of Privacy Professionals (“IAPP”) honored Centre for Information Policy Leadership (“CIPL”) President Bojana Bellamy with the 2019 IAPP Privacy Vanguard Award during its Global Privacy Summit in Washington, D.C. I am delighted that Bojana received the Vanguard award this year.

Privacy 61

Privacy Data Privacy Compliance Personal data 61

Data Protection Report

SEPTEMBER 17, 2019

The California legislative session for 2019 ended on September 13 and the following five amendments to the California Consumer Privacy Act (CCPA) were passed: AB 25, 874, 1146, 1355, and 1564. In subsections (a)(2) and (b)(12), businesses can offer different prices, rates, quality, etc. – § 1798.125.

B2B 40

B2B Privacy Communications Encryption 40

Thales Cloud Protection & Licensing

MAY 24, 2019

It’s been one year since the European Union (EU) enforced the General Data Protection Regulation (GDPR) 1 , a legislation designed to protect the personal data of EU citizens and lay specific rules and guidelines on how their data is collected, stored, processed and deleted by various entities.

Data breaches 93

Data breaches GDPR Personal data Compliance 93

Data Protection Report

AUGUST 13, 2019

On 4 July 2019, the CNIL published new guidelines on cookies and other similar technologies , repealing its 2013 cookie guidance in order to align its position with the GDPR’s new requirements on consent. iii) the personal data collected must not overlap with other processing operations (e.g. Measures on how to obtain consent.

Computer and Electronics 40

Computer and Electronics GDPR Personal data Data collection 40

OpenText Information Management

JANUARY 31, 2024

Now supports 2016 and 2019 Outlook versions. In litigation, investigations and regulatory compliance matters, legal teams are under intense pressure to deliver superior results on time and within budget. To mitigate risk to the organization, swift and accurate identification of personal data is critical. Axcelerate CE 21.4

Analytics 52

Analytics Cloud Data Privacy Compliance 52