HL Chronicle of Data Protection

MAY 29, 2019

Following the one-year anniversary of the coming into effect of the GDPR, Hogan Lovells’ Privacy and Cybersecurity practice has prepared summaries of key GDPR-related developments of the past 12 months. The summaries cover regulatory guidance, enforcement actions, court proceedings, and various reports and materials.

GDPR 40

GDPR Personal data Privacy Information architecture 40

Privacy and Cybersecurity Law

AUGUST 23, 2017

In our monthly GDPR Updates we discuss various key issues of the General Data Protection Regulation, (EU) 2016/679 (the GDPR ), which applies from 25 May 2018. With the introduction of the GDPR, the existing Directive 95/46/EC and its implementation in the local laws of the various EU Member States will be repealed.

GDPR 40

GDPR Personal data Compliance Privacy 40

eSecurity Planet

FEBRUARY 14, 2023

The vision was to automate security and compliance across 14 frameworks, including SOC 2, ISO 27001, HIPAA and GDPR. First of all, cybersecurity is becoming a “must have” for businesses and governments. billion valuation in less than seven years and earning a top 10 ranking in our list of the top cybersecurity companies.

Compliance 120

Compliance Security Cybersecurity Marketing 120

Privacy and Cybersecurity Law

JUNE 23, 2021

105, which established the Italian National Cybersecurity Perimeter (“ NCSP ”) and imposed specific obligations on essential operators [1] (“ Operators included in the NCSP ”) to safeguard networks, information systems and IT services that are pivotal to the life and functioning of the nation. National and EU agenda for cybersecurity.

Cybersecurity 52

Cybersecurity Communications Data breaches Security 52

DLA Piper Privacy Matters

JANUARY 11, 2021

On 16 December 2020, the European Commission adopted a proposal for a Directive on measures for a high common level of cybersecurity across the Union (“NIS II Directive”) that revises the current Directive on Security of Network and Information Systems (“NIS Directive”). Cybersecurity risk management and reporting obligations.

Cybersecurity 91

Cybersecurity Computer and Electronics Manufacturing Cloud 91

Data Matters

OCTOBER 6, 2022

PETs are not defined in data protection law, but the European Union Agency for Cybersecurity (“ ENISA ”) defines them as “systems encompassing technical processes, methods or knowledge to achieve specific privacy or data protection functionality or to protect against risks of privacy of an individual or a group of natural persons.”

GDPR 88

GDPR Privacy Encryption Compliance 88

Hunton Privacy

NOVEMBER 19, 2020

CIPL’s key recommendations include: Legitimate Interest : Adding a legitimate interest processing ground within the PIPL; Compatible Processing : Clarifying that organizations can process personal information for compatible purposes in reliance on the original ground for processing; Children’s Data : Enabling a risk-based approach for organizations (..)

GDPR 126

GDPR Privacy Risk Government 126

Data Protection Report

JANUARY 21, 2019

It follows two complaints filed as soon as the GDPR came into force by two consumer rights associations, None of Your Business and La Quadrature du Net. Retention periods were not included for some categories of data. The legal bases for ad personalisation were confusing and unclear. Reason for the size of the fine.

GDPR 40

GDPR Personal data Privacy Access 40

Hunton Privacy

JANUARY 26, 2022

The definition of “data handler” under the Draft Regulations is similar to that of “data controller” in other privacy laws, such as the EU General Data Protection Regulation (“GDPR”). Cybersecurity Review. The Draft Regulations clarify the conditions that trigger a cybersecurity review required by the CSL.

Security 116

Security Data breaches Personal data Cybersecurity 116

IT Governance

OCTOBER 21, 2021

The need for experienced and qualified cyber security professionals is a highlight of Cybersecurity Career Awareness Week , led by NICE (National Initiative for Cybersecurity Education). Information security is a broader category that protects all information assets, whether in hard copy or digital form.

Security 111

Security Information Security GDPR Data Privacy 111

Hunton Privacy

OCTOBER 25, 2022

million fine to Interserve Group Limited for failing to keep employee personal data secure, which violates Article 5(1)(f) and Article 32 of the EU General Data Protection Regulation (“GDPR”), during the period of March 2019 to December 2020. On October 24, 2022, the UK Information Commissioner’s Office (“ICO”) issued a £4.4

Security 97

Security Personal data GDPR Insurance 97

Data Protection Report

MAY 23, 2018

The wait is finally over—this Friday the European Union General Data Protection Regulation (GDPR) will come into force. However, the challenges of GDPR certainly don’t end on the date this law goes into implementation. Many of our clients ask us when and how they may be called upon to demonstrate compliance with the GDPR.

GDPR 40

GDPR Personal data Compliance Data breaches 40

The Last Watchdog

JANUARY 30, 2019

New York state’s Cybersecurity Requirements for Financial Services Companies, which took effect last March, includes provisions that require financial services companies to ensure the security of the systems used by their third-party suppliers. That included five of eight categories improving in average maturity on a year-over-year basis.

Risk 147

Risk Financial Services Insurance Cybersecurity 147

Data Protection Report

JANUARY 6, 2020

There was guidance from data protection regulators in the UK, France and Germany which made clear that implied cookie consent mechanisms are not viable under the EU General Data Protection Regulation (GDPR). It’s time to take the “data and records retention project” out of the “too hard / I’ll do it after GDPR” tray. Conquer the world!

Privacy 85

Privacy GDPR Data breaches Risk 85

Privacy and Cybersecurity Law

JULY 26, 2021

The Company was found guilty of infringing the following provisions of Regulation EU 2016/679 (“ GDPR ”): Information provided to the riders pursuant to Article 13 of the GDPR. The Company was also charged with the violation of Articles 5(1)(c) and 25 of the GDPR. What infringements did the Garante identify?

Personal data 52

Personal data GDPR e-Delivery Communications 52

Security Affairs

MAY 12, 2021

After the introduction of CCPA and GDPR, much more attention is given to third-party risks, and the privacy terms and conditions users agree to. Global privacy regulations, such as the CCPA and GDPR, were enacted to ensure stricter standards when handling the personal data of consumers.

GDPR 97

GDPR Privacy Personal data Data breaches 97

Data Matters

NOVEMBER 4, 2020

Third, it creates a new category of businesses: those that voluntarily agree to be subject to the CCPA. Businesses familiar with GDPR will recognize the reference to automated decision-making, as Article 22 gives data subjects similar opt-out rights. The CPRA creates a new category of information called “sensitive personal information.”

Privacy 122

Privacy B2B Sales Data breaches 122

eSecurity Planet

JANUARY 5, 2023

After a year that saw massive ransomware attacks and open cyber warfare, the biggest question in cybersecurity for 2023 will likely be how much of those attack techniques get commoditized and weaponized. Also read: Hyperautomation and the Future of Cybersecurity. We already have the EU’s GDPR, which set a global precedent.

Security 145

Security Ransomware Cybersecurity Privacy 145

Data Matters

MARCH 12, 2020

If, after taking these measures, an organisation still needs to collect specific health data, the ICO confirms that ongoing data minimisation and information security to protect this sensitive category of data will be paramount.

GDPR 83

GDPR Communications Privacy Government 83

Data Protection Report

JANUARY 6, 2020

There was guidance from data protection regulators in the UK, France and Germany which made clear that implied cookie consent mechanisms are not viable under the EU General Data Protection Regulation (GDPR). It’s time to take the “data and records retention project” out of the “too hard / I’ll do it after GDPR” tray. Conquer the world!

Privacy 52

Privacy GDPR Data breaches Risk 52

Data Protection Report

JULY 9, 2018

states have recently introduced and passed legislation to expand data breach notification rules and to mirror some of the protections provided by Europe’s newly enacted General Data Protection Regulation (“GDPR”). See our previous blog posts on GDPR here and here. Several U.S. Under the law, “covered entities,” defined as “a person [.]

GDPR 40

GDPR Data breaches Personal data Insurance 40

Thales Cloud Protection & Licensing

NOVEMBER 28, 2022

With the NIS Directive, the EU aimed to direct its members to develop national and cross-border cybersecurity norms and regulations. In 2020, the European Commission revised the Directive, to “further strengthen overall cybersecurity in the Union” to address emerging cyber threats. Business continuity and crisis management.

IT 71

IT Encryption Compliance Cybersecurity 71

Privacy and Cybersecurity Law

APRIL 1, 2021

6 (1) (a) GDPR); and legitimate interests (Art. 6 (1) (f) GDPR). Valid consent involves meeting the high standard of the GDPR. The EDPB takes the view that the legal bases that would be likely to apply in the targeting context are: consent (Art.

GDPR 52

GDPR Personal data Risk Access 52

DLA Piper Privacy Matters

MAY 5, 2020

Quality of the user’s consent: The fact that a user is not aware of the data processing carried out in his vehicle constitutes a significant barrier to demonstrate valid consent under the GDPR, as the consent must be informed. 23(1) GDPR. 23(1) GDPR. 10 GDPR and any applicable national legislation.

Privacy 69

Privacy Personal data GDPR Insurance 69

Data Protection Report

NOVEMBER 25, 2021

In comparison, the monetary cap is still much less than the cap under the EU General Data Protection Regulation (GDPR), including the UK version post-Brexit, where the maximum penalty for serious infringements is the greater of €20 million (about A$31 million) or 4% of annual global turnover. New online privacy code and framework.

Privacy 111

Privacy Paper Compliance Government 111

Security Affairs

JULY 3, 2023

Semi-Structured Data: Semi-structured data lies between the structured and unstructured categories. Organizations may face penalties, fines, or legal actions if they fail to comply with data privacy regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).

Unstructured data 98

Unstructured data Metadata Encryption Data structuring 98

HL Chronicle of Data Protection

JULY 8, 2019

million) for infringements of the General Data Protection Regulation (GDPR). This marks the first fine issued by the ICO resulting from a data security breach under the GDPR and will be the largest fine ever issued by the ICO. million (approx. ” ICO Enforcement Implications. What happens next?

GDPR 40

GDPR Security Personal data Data breaches 40

DLA Piper Privacy Matters

APRIL 27, 2020

In order to tackle the crisis, it might well be that the second category will be preferred as it enables public health authorities to have access to anonymised and aggregated information on social distancing, effectiveness of the Apps or the potential diffusion of Covid-19. Supporting actions). Supporting actions.

Personal data 72

Personal data Privacy Cybersecurity Access 72

Thales Cloud Protection & Licensing

OCTOBER 28, 2021

Multifactor authentication requires users to take an extra step to verify who they are by providing two or more distinct categories of evidence. This incident came to light just as the GDPR regulation was rolling out, which undoubtedly created a compliance nightmare for Timehop in having to notify affected EU users on time.

Authentication 71

Authentication Passwords Cloud Data breaches 71

DLA Piper Privacy Matters

AUGUST 23, 2021

To be clear, this is not China’s own GDPR. Security and Confidentiality Personal information must be kept confidential, and security measures must be deployed, as prescribed by the Cybersecurity Law and the Data Security Law and their underlying measures, guidelines and technical standards.

Data Privacy 111

Data Privacy Privacy Compliance Analytics 111

Hunton Privacy

DECEMBER 2, 2020

The Data Governance Act outlines (1) the conditions for re-use of certain categories of data held by public sector bodies in the EU; (2) a notification and supervisory framework for the provision of data sharing services; and (3) a framework for voluntary registration of entities that collect and process data made available for altruistic purposes.

Government 70

Government Personal data Compliance GDPR 70

Privacy and Cybersecurity Law

NOVEMBER 8, 2018

In the aftermath of the Cambridge Analytica scandal, and in the footsteps of Europe’s General Data Protection Regulation (“GDPR”), California privacy advocates introduced a ballot initiative on October 12, 2017 called “The Consumer Right to Privacy Act of 2018” (No. CCPA Background. Right of Disclosure. Right of Deletion.

Privacy 58

Privacy Sales Compliance Cybersecurity 58

ARMA International

FEBRUARY 21, 2020

Even autos and work vehicles are moving into the wearables category as they capture more and more data that identifies each individual driver’s personal habits, location, and speed-limit adherence both while on the job and away from it. FDA issues new draft cybersecurity guidance for medical devices.” Devices we eat (“ingestibles”).

Computer and Electronics 105

Computer and Electronics Privacy Artificial Intelligence IoT 105

eSecurity Planet

DECEMBER 9, 2021

For cybersecurity personnel, our scope of responsibility may be limited to cyberattacks on IT systems, such as ransomware attacks, phishing attacks, and DDoS attacks. For example, assign the cloud team to initially respond to incidents involving cloud assets with the cybersecurity team providing backup resources.

Insurance 124

Insurance Ransomware Data breaches Cloud 124

eSecurity Planet

JANUARY 28, 2021

Cybersecurity products, services and professionals have never been in higher demand. A contributing factor to the cybersecurity skills gap is the large number of security startups that have been founded in recent years. According to a joint study by CBInsights and PwC, Cybersecurity startups received over $10.7 Compliance.

Cybersecurity 112

Cybersecurity Compliance Cloud Artificial Intelligence 112

Data Protection Report

JULY 3, 2019

If you have any questions or would like additional information regarding CCPA or other US legislative proposals, please contact a member of our Data Protection, Privacy and Cybersecurity team. Article 8: GDPR, CCPA and beyond: Changes in data privacy laws and enforcement risks to monitor in 2019. Article 2: CCPA covered entities.

Access 40

Access Privacy Data Privacy Government 40

Privacy and Cybersecurity Law

NOVEMBER 9, 2018

In the aftermath of the Cambridge Analytica scandal, and in the footsteps of Europe’s General Data Protection Regulation (“GDPR”), California privacy advocates introduced a ballot initiative on October 12, 2017 called “The Consumer Right to Privacy Act of 2018” (No. CCPA Background. Right of Disclosure. Right of Deletion.

Privacy 58

Privacy Sales Education Compliance 58