article thumbnail

$10,000,000 civil penalty for disclosing personal data without consent

Data Protection Report

The claims related to the company’s sharing personal data without consumer consent and making it very difficult for consumers to cancel their subscriptions to this telehealth service. The order also, in Section IX, set forth data destruction requirements and a data retention policy.

article thumbnail

Over-Retention of Personal Data

Data Protection Report

The declining cost of electronic data storage may have caused some company executives to conclude that retaining personal data forever is “cheap.” The matter involved one of France’s largest insurers, SGAM AG2R LA MONDIALE, which was subject to an inspection by the French data protection authority (the CNIL), in 2019.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

The Impact of Data Protection Laws on Your Records Retention Schedule

ARMA International

The purpose of this article is to remove the fear and intimidation of domestic and global data protection laws and show how these laws and requirements are consistent with the existing objectives of your records retention schedule and information governance policy. Introduction to Data Protection Laws.

article thumbnail

GDPR Compliance Obligations: The relationship between Data Controllers and Third-Party Processors

AIIM

Third party processor agreements need to be reviewed in the context of GDPR compliance obligations, particularly, compliance accountability, data transfer provisions and data security requirements.

GDPR 83
article thumbnail

UK: Supreme Court judgment in Morrisons – employer not vicariously liable for data breach

DLA Piper Privacy Matters

A few months later, he uploaded the data onto a file-sharing website and later sent it to newspapers. this applies whether the data controller is the employer or the employee (in this case it was the employee). this applies whether the data controller is the employer or the employee (in this case it was the employee).

article thumbnail

California Governor Signs into Law Bills Updating the CPRA and Bills Addressing the Privacy and Security of Genetic and Medical Data, Among Others

Hunton Privacy

During the week of October 4, 2021, California Governor Gavin Newsom signed into law bills amending the California Privacy Rights Act of 2020 (“CPRA”), California’s data breach notification law and California’s data security law. 9) deidentified data (that meets the requirements for deidentification under the law).

Privacy 98
article thumbnail

Guest Post - Data Privacy and Open Data: Secondary Uses under GDPR

AIIM

In particular, one recent study found that it is possible to re-identify 87% of the US population by simply combining three data points – zip code, gender and date of birth. What are the best practices and technological measures that should be considered that will meet the GDPR standard?

GDPR 92