Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

711 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

711 articles
Legislation

Romanian Whistleblowing Law. About Protecting Data while Fostering Transparency

Romania transposed the EU Whistleblowing Directive on 22 December 2022, via Law No. 361/2022 on the protection of whistleblowers in the public interest ("Romanian Whistleblowing Law"). This article explores key aspects of the law, providing an overview of how Romanian legislation navigates the intersection of the public interest (of having wrongdoings revealed), whistleblower rights and GDPR compliance.

29 September 2023

Litigation

The Polish Supreme Administrative Court concluded “Morele.net saga”

In its judgement from February 2023, the Supreme Administrative Court of Poland announced a significant decision from 2019 of the Polish DPA that imposed a substantial fine of PLN 2.8 million (ca. 645,000 euros) against the online retailer, Morele.net. The decision concerned Morele.net’s alleged failure to introduce adequate data security safeguards that could have enabled a phishing attack leading to the unauthorized acquisition of a customer database, violating the obligations under GDPR regarding ensuring data security and integrity.

25 September 2023

Breach notification

“Another breach in the wall” – the Polish DPA’s views regarding data security and notifying data breaches under the GDPR

In the ever-evolving landscape of data protection and privacy regulations, organizations must remain vigilant in upholding the security of the personal data they handle. A recent decision issued by the Polish DPA underscores this critical aspect, as the Polish DPA imposed an administrative fine exceeding PLN 47,000 (approx. € 10,000) due to implementing inadequate technical and organizational measures for safeguarding personal data and not notifying the authority about the data breach.

20 September 2023

Data Privacy in Peru: Considerations for foreign personal data controllers with no physical presence in the Peruvian territory.

As in the case of other Latin American and European jurisdictions, the scope of data protection rules in Peru has been designed to be circumscribed to a territorial scope based on a local establishment criterion, which creates obligations for data controllers before personal data subjects and the Peruvian National Authority for the Protection of Personal Data (hereinafter, the “ANPDP”). Notwithstanding this, reality is constantly testing the limits of the law’s scope and extending the applicability of this territorial principle to a broader span of particular scenarios. That occurs for instance, in the case of non-domiciled entities conducting digital businesses that target Peruvian users, which, under some circumstances, might end up being subject to Peruvian data privacy laws and regulations without having a physical presence in our country.

20 September 2023

Marketing & cookies

Serious Criticism and Injunction Issued for using Facebook Business Tools

The Danish Data Protection Authority, Datatilsynet, has issued severe criticism of Boligportal, Denmark's largest online marketplace for rental properties, for failing to demonstrate compliance with the General Data Protection Regulation (GDPR) in their handling of personal information about individuals visiting their website. Additionally, Datatilsynet has issued an injunction to Boligportal, instructing them to align their data processing practices with GDPR regulations.

14 September 2023

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership