711 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

711 articles

Responsible use of AI based tools in medical diagnosis and treatment – the AI sandbox

In 2021, the Norwegian Data Processing Authority (DPA) established a regulatory test environment (“sandbox”) for Artificial Intelligence (AI). The purpose of the sandbox is that companies and government agencies can collaborate with the DPA when developing and testing AI based technology which is likely to have privacy implications. The DPA will provide guidance during the development and testing phases, to ensure that the resulting AI tools will be responsible and in compliance with personal data processing rules.

31 January 2023

Legislation

The Panamanian Data Protection Law

The Data Protection Law entered into force in March 2021, two years after its publication on March 29, 2019. This law -although imperfect- was a pending issue that had the Panamanian State in terms of privacy of the information of its citizens.

26 January 2023

Bulgarian DPA on the Admissibility of Ongoing Access to Municipality’s Video Surveillance

Bulgarian DPA issued an opinion on the questions from a Bulgarian City Municipality regarding requested ongoing access from the police department to the video recordings of the Municipality video surveillance system.

24 January 2023

AI & automationLegislation

Canada’s Proposed Artificial Intelligence and Data Act (AIDA)

This article summarizes the substantive highlights and legislative progress of the proposed Artificial Intelligence and Data Act (AIDA), a part of Bill C-27, which the Canadian Parliament is presently debating.

24 January 2023

Data Protection and Press Freedom in the panamanian framework

In 2022, the Panamanian Data Protection Authority sanctioned the digital media for publishing a public document without the consent.

24 January 2023

International transfers

Transfers of personal data in early stages of technology transactions or M&As.

As part of negotiations, due diligence, preliminary reviews and analysis, a party may request or need certain information containing personal data of employees, customers, suppliers and/or business partners of other parties involved in the transaction. Below are some legal suggestions for controllers in accordance with Costa Rican legislation on privacy and protection of personal data.

24 January 2023

Breach notification

UK ICO's new approach to publishing details of complaints, breach reports and reprimands

The UK Information Commissioner's Office (ICO) has started routinely publishing information about complaints made against organisations by members of the public, self-reported data breaches and reprimands issued by the ICO. Those subject to UK GDPR should be aware of the detailed information that this new approach will make available to counterparties, competitors and the public.

24 January 2023

Legislation

Argentina - Changes in the Classification and Ranking for Infringements to the Personal Data Protection Law

Trough Resolutions No. 240/2022 and 244/2022 the Agency for Access to Public Information through Resolutions No. 240/2022 and 244/2022 amended the classification and amounts provided by Provision No. 7/2005 and E 71/2016 of the Argentine Direction for the Protection of Personal Data.

20 January 2023

INPLP internal

A new member has joined the INPLP: Boris Kozlevcar (Slovenia)

JK GROUP is a legal and tax consulting company located in Slovenia, focused on south-east European countries. They are specializing in digital law that covers industries of internet, IT, ICT, ecommerc…

18 January 2023

What information needs to provided when personal information will be processed by Artifical Intelligence?

If an entity collecting data is not fully transparent about the information that is being collected and how it will be processed and I particular when it is collected by bots or processed by Artificial Intelligence then a data subject is unable to provide the required informed consent

17 January 2023

International transfers

Nothing about #SchremsX: What should companies do while EU bodies discuss the draft US adequacy decision?

New US adequacy draft opinion is out. Everyone is talking about #SchremsIII (and IV and X), so I will not. Instead - let's discuss what should US companies involved in EU-US transfers actually be doing now?

12 January 2023

Cloud & vendors

Slovenia’s DPA Finds Cloud Computing Provider a (Joint) Controller of Personal Data

Slovenia’s Information Commissioner (IC) ordered a cloud computing provider (a public administration body) to enter into written arrangements with its clients, in accordance with the provisions of Article 26 of GDPR. In its view, the fact that the clients (controllers) had little or no influence on the technical measures for processing personal data means that the cloud provider should be considered a joint controller.

23 December 2022

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership