Data Protection Report

NOVEMBER 13, 2020

On 12 November, the European Commission published revised Standard Contractual Clauses (SCCs) and a draft implementing decision. On 11 November, the European Data Protection Board ( EDPB ) published its much anticipated guidance on the Schrems II judgment. A feedback period on the draft documents will run until 10 December.

Personal data 98

Personal data GDPR Encryption Government 98

Data Protection Report

JANUARY 20, 2020

In addition, 2019 saw regulators publishing findings in respect of some of the largest data incidents of 2018. We have set out below the key highlights of the year and what to look out for in 2020. This decision enables personal data to flow freely between the two jurisdictions without the need for additional safeguards.

Personal data 128

Personal data Security Data Privacy GDPR 128

DLA Piper Privacy Matters

SEPTEMBER 6, 2021

On 2 September 2021, the Data Protection Commission (DPC) announced it has imposed a €225 million administrative fine against WhatsApp Ireland Limited , as well as a reprimand and an order to bring its processing into compliance. Non-User Data. This is the second major Article 60 draft decision which the DPC has finalised.

GDPR 105

GDPR Personal data e-Delivery Communications 105

Hunton Privacy

FEBRUARY 23, 2023

On February 20, 2023, in the case of Experian Limited v The Information Commissioner , the First-Tier Tribunal in the UK (the “ Tribunal ”) ruled on the ICO’s action to require Experian to make changes to how it processes personal data for direct marketing purposes.

Marketing 64

Marketing Personal data GDPR Privacy 64

Hunton Privacy

JULY 10, 2020

On June 16, 2020, the Litigation Chamber of the Belgian Data Protection Authority (the “Belgian DPA”) imposed a fine on a company (the “defendant”) for unlawful and incorrect processing of personal data and non-compliance with the EU General Data Protection Regulation’s (the “GDPR”) data subject rights provisions.

Compliance 49

Compliance GDPR Marketing Personal data 49

Hunton Privacy

JUNE 17, 2020

On June 12, 2020, the Brazilian President Jair Bolsonaro approved Law #14,010/2020 (the “Law”). Among other topics, it delays until August 1, 2021 the applicability of the provisions relating to sanctions for non-compliance with the new Brazilian data protection law ( Lei Geral de Proteção de Dados Pessoais , “LGPD”).

Compliance 79

Compliance IT Personal data 79

Data Matters

JULY 22, 2020

Indeed, the comprehensive law has been viewed as a necessary measure for the country to join a select but growing group of nations in the systematic protection of individuals’ personal data. Compliance Costs and the 2020 Crisis. Currently, Brazil faces a growing economic crisis precipitated by the COVID-19 pandemic.

Marketing 68

Marketing Compliance Personal data GDPR 68

Hunton Privacy

NOVEMBER 16, 2020

On November 12, 2020, somewhat in the shadow of the new standard contractual clauses for data transfers to recipients outside the European Economic Area (“EEA”), the European Commission also adopted draft standard contractual clauses to be used between controllers and processors in the EEA (“EEA Controller-Processor SCCs”).

GDPR 88

GDPR Personal data Data breaches Information Security 88

Data Matters

NOVEMBER 12, 2019

Similar to what is already required with respect to data security incidents under federal financial and health privacy law, and more broadly under all 50 U.S. While your language explicitly recognizes this, to raise the specter of limitless backward searching may expand compliance burdens beyond the commensurate benefits.

Privacy 68

Privacy Data breaches Compliance Personal data 68

Thales Cloud Protection & Licensing

DECEMBER 22, 2020

Cross-Border Data Privacy and Security Concerns in the Dawn of Quantum Computing. Tue, 12/22/2020 - 10:08. New EU restrictions could force companies to change data transfer practices and adopt more advanced data encryption methods. Data privacy is not a check-the-box compliance or security item.

Data Privacy 118

Data Privacy Privacy Security Encryption 118

ARMA International

APRIL 18, 2022

Introduction to Data Protection Laws. Data protection laws, regulations, and rules control the collection, use, transfer, and storage of personal and sensitive information. Personal data protection requirements may be issued by federal, state (provincial), or local governments.

Personal data 100

Personal data GDPR Privacy Records Management 100

Hunton Privacy

OCTOBER 29, 2020

On October 27, 2020, the UK Information Commissioner’s Office (“ICO”) published its enforcement notice against credit reference agency Experian Limited (“Experian”) under Section 149 of the Data Protection Act 2018 (“DPA”) (the “notice”).

Personal data 81

Personal data Marketing GDPR Compliance 81

Hunton Privacy

DECEMBER 1, 2020

On November 26, 2020, the French Data Protection Authority (the “CNIL”) announced that it imposed a fine of €2.25 These inspections aimed to verify whether Carrefour France and Carrefour Banque were in compliance with all provisions of the GDPR and the French Data Protection Act. Background. GDPR and Cookie Violations.

GDPR 91

GDPR Personal data Data collection Marketing 91

Data Protection Report

FEBRUARY 27, 2024

Key takeaways With the addition of the Implementation Guide to further clarify the process of operationalising data transfer clauses, the Joint MCC – SCC Guide is a useful tool for organisations seeking to implement cross-border transfers of personal data within ASEAN and between ASEAN and the EU.

Government 59

Government Personal data Compliance Risk 59

Data Matters

NOVEMBER 13, 2020

The European Commission (EC), on 12 November 2020, published a draft adequacy decision implementing revised Standard Contractual Clauses (draft SCCs) – (the EC’s Draft). In relation to special categories of personal data (e.g.,

Personal data 68

Personal data GDPR Privacy Compliance 68

Data Protection Report

FEBRUARY 8, 2022

million individuals was exposed, including approximately 98,632 New Yorkers.The AG began an investigation based on New York’s Executive Law § 63(12) [deception] and General Business Law §§ 349 [deception] and 899-bb. The latter is the 2019 data security law known as the Stop Hacks and Improve Electronic Data Security (SHIELD) Act.

Passwords 98

Passwords Financial Services Authentication Insurance 98

Data Matters

JULY 24, 2020

The CJEU invalidated the EU-US Privacy Shield but upheld the use of Standard Contractual Clauses (“SCCs”) to transfer personal data to the U.S.: to ensure compliance with a level of protection “essentially equivalent” to that guaranteed within the EU by the GDPR). .: domestic law, in particular the ability for U.S.

Personal data 97

Personal data GDPR Privacy Access 97

Data Protection Report

JULY 12, 2022

In brief, on April 5, 2021, a security researcher contacted Wegmans about a serious flaw the left some of Wegmans’ customers’ personal data available to the public. Wegmans updated the container configurations to prohibit public access on May 12, 2021 and notified consumers. Wegmans does not confirm or deny the NYAG’s findings.

Passwords 105

Passwords Data collection Personal data Cloud 105

Hunton Privacy

NOVEMBER 22, 2019

appropriate technical and organizational measures for ensuring that, by default, only personal data, which is necessary for each specific purpose of the data processing, is processed (“Data protection by default”). on how to handle personal data.

Personal data 50

Personal data GDPR Compliance Risk 50

HL Chronicle of Data Protection

MARCH 5, 2020

On January 17, The Belgian Data Protection Authority (DPA) published Recommendation no 01/2020 providing Guidance on direct marketing. The Recommendation provides a methodology on how to comply with the General Data Protection Regulation (GDPR) when conducting direct marketing. Necessity for Data Minimisation.

Marketing 59

Marketing GDPR Personal data Healthcare 59

DLA Piper Privacy Matters

SEPTEMBER 7, 2023

The scrutiny by national courts over the lawfulness of certain processing, and commentary on the factors that will aggravate or mitigate an infringement, should be considered by these organisations and inform their approach to data protection compliance.

GDPR 111

GDPR Data breaches Risk Personal data 111

DLA Piper Privacy Matters

JULY 29, 2020

Until recently, most decisions of the Belgian Data Protection Authority (Belgian DPA) concerned national companies or individuals. However, on 14 July 2020, the Belgian DPA imposed a fine of EUR600,000 on Google Belgium SA/NV (Google Belgium) for not respecting a Belgian resident’s right to be forgotten.

GDPR 75

GDPR Compliance IT Privacy 75

Privacy and Cybersecurity Law

FEBRUARY 14, 2020

On 21 January 2020, the ICO published the Age Appropriate Design Code of Practice. Detrimental Use of Data: You should not use children’s personal data in ways that have been shown to be detrimental to their wellbeing , or that go against industry codes of practice, other regulatory provisions, or Government advice.

Access 59

Access IoT Personal data Privacy 59

Hunton Privacy

JANUARY 22, 2020

On January 21, 2020, the UK Information Commissioner’s Office (“ICO”) published the final version of its Age Appropriate Design Code (“the code”), which sets out the standards that online services need to meet in order to protect children’s privacy. The code will now be laid before Parliament for approval.

IT 54

IT Personal data Compliance Privacy 54

Privacy and Cybersecurity Law

FEBRUARY 14, 2020

On 21 January 2020, the ICO published the Age Appropriate Design Code of Practice. Detrimental Use of Data: You should not use children’s personal data in ways that have been shown to be detrimental to their wellbeing , or that go against industry codes of practice, other regulatory provisions, or Government advice.

Access 59

Access Personal data IoT Privacy 59

Data Protection Report

JULY 12, 2019

Often questioned about online advertising targeting by both the public and professionals, the CNIL released its action plan for 2019-2020 with a view to providing further details about the applicable advertising rules and to support stakeholders in their compliance with them.

GDPR 40

GDPR Compliance Marketing Personal data 40

DLA Piper Privacy Matters

NOVEMBER 13, 2020

On 12 November, the European Commission published its long awaited updated draft Implementing Decision on standard contractual clauses (“ SCCs ”) for the transfer of personal data to third countries. The draft SCCs are now subject to an initial public consultation running until 10 December 2020.

GDPR 64

GDPR Personal data Government Privacy 64

Hunton Privacy

JULY 1, 2019

On June 28, 2019, the French data protection authority (the “CNIL”) published its action plan for 2019-2020 to specify the rules applicable to online targeted advertising and to support businesses in their compliance efforts. The CNIL will allow for a transition period of 12 months to comply with the new cookie guidelines.

GDPR 49

GDPR Marketing Personal data Privacy 49

DLA Piper Privacy Matters

SEPTEMBER 2, 2021

The Children’s Code is not new law, but a statutory Code of Practice under the Data Protection Act 2018. The Code was laid before Parliament on 11 June 2020, under s. Therefore, whilst its recommendations are not themselves legally binding, compliance with the Code is strongly recommended. 125(1)(b) of the DPA.

Privacy 103

Privacy Education Personal data Compliance 103

HL Chronicle of Data Protection

APRIL 5, 2019

With the deadline for a no-deal Brexit looming—the UK’s exit date from the European Union is now slated for April 12—companies certified to the EU-U.S. Privacy Shield should update their Privacy Shield privacy policies if they have not done so already to ensure that they are able to lawfully receive personal data from the UK post-Brexit.

Privacy 40

Privacy Compliance Personal data Government 40

DLA Piper Privacy Matters

NOVEMBER 24, 2020

How to properly calculate administrative fines for non-compliance with the EU General Data Protection Regulation (‘ GDPR ’) is one of the most important questions when applying the GDPR on practical level, e.g. : What is actually meant by the reference to “undertaking” in Article 83 (4) to (6) GDPR? million Euro as was too high.

GDPR 75

GDPR Authentication Compliance Personal data 75

HL Chronicle of Data Protection

JULY 9, 2019

The ICO intends to use its own Sandbox to support organisations that are looking to use personal data in innovative ways through the use of new technologies and approaches. These organisations will participate in the beta phase which is due to run from July 2019 until September 2020.

GDPR 40

GDPR Personal data Privacy Financial Services 40

DLA Piper Privacy Matters

APRIL 1, 2020

A few months later, he uploaded the data onto a file-sharing website and later sent it to newspapers. this applies whether the data controller is the employer or the employee (in this case it was the employee). this applies whether the data controller is the employer or the employee (in this case it was the employee).

Data breaches 59

Data breaches GDPR Personal data Information governance 59

Data Protection Report

JUNE 29, 2018

On June 28, 2018, California lawmakers enacted the California Consumer Privacy Act of 2018 (the “CCPA”) a sweeping, GDPR-like privacy law which is intended to give California consumers more control over how businesses collect and use their data. Consumer access and data portability rights.

Privacy 40

Privacy GDPR Personal data Risk 40

Data Protection Report

JUNE 29, 2018

On June 28, 2018, California lawmakers enacted the California Consumer Privacy Act of 2018 (the “CCPA”) a sweeping, GDPR-like privacy law which is intended to give California consumers more control over how businesses collect and use their data. Consumer Access and Data Portability Rights.

Privacy 40

Privacy GDPR Personal data Risk 40

HL Chronicle of Data Protection

OCTOBER 26, 2018

As part of our ongoing series on the CCPA, this post lays out why the issue of CCPA applicability to employees is controversial and nevertheless offers potential strategies to address CCPA compliance requirements as they may relate to personnel records. Opt-Out for Sale of Personal Information. Why the Uncertainty?

Privacy 40

Privacy Sales Compliance Personal data 40

Data Protection Report

FEBRUARY 6, 2024

The Court of Justice of the European Union ( CJEU )’s Schrems II decision [1] clarified strict rules for personal data transfers outside of the European Union. It is currently in a consultation phase, with the consultation due to close on 12 February 2024 and the final guidance expected later in the year. When is a TIA required?

GDPR 75

GDPR Personal data Compliance IT 75