711 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

711 articles

Can an employer ask the candidate to provide him with a court certificate that criminal proceedings are not being conducted against him

When establishing an employment relationship, employers often ask the candidates for a court confirmation that no criminal proceedings are being conducted against them. The adoption of the new Data Protection Law in Serbia has raised the question whether such a request is justified or it can be consedered as an excessive processing of personal data.

9 August 2022

INPLP internal

A new member has joined the INPLP: Fabian Solis (Costa Rica)

Aguilar Castillo Love’s vision for their role as a law firm is borne of their heritage. Their ethos is drawn from many models, realities, and lessons. The competitive advantage for their clients is co…

4 August 2022

Litigation

Finding a balance between fighting crime and privacy – the use of metadata

Last April, the Portuguese Constitutional Court declared unconstitutional the provisions of articles 4, 6, and 9 of Law 32/2008 of July 17, which transposed into Portuguese law Directive 2006/24/EC of March 15, on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (also known as the "Metadata Law"), thereby raising the metadata subject to the top of the most discussed topics of the moment.

29 July 2022

Can a controller rely on legitimate interest in Nigeria?

Legitimate interest is one of the lawful bases for processing personal information. However, the Nigeria Data Protection Regulation (NDPR) omitted legitimate interest as a lawful basis.

28 July 2022

Legislation

Monaco: New legislation on the protection of personal data eagerly awaited

The government's bill for a major reform of Monaco's personal data protection legislation is currently being examined by the Monegasque Parliament. At the same time, a bill has been tabled for the ratification of the Protocol (CETS No. 223) amending the Convention No. 108 of the Council of Europe. The following is a summary of the main changes brought about by the bill before its passage through the Parliamentary Committee and subsequent amendments.

26 July 2022

Enforcement & fines

The use of CCTV in light of the Luxembourg National Commission for Data Protection’s sanctions.

In 2021, the Luxembourg National Commission for Data Protection (the “CNPD”) issued 48 decisions following assessments. 18 of these 48 decisions related to non-compliance of CCTV systems deployed by the controlled entities. Recently, the CNPD issued again new decisisions to sanction entities using CCTV systems that were not compliant with the GDPR.

14 July 2022

Data subject rightsHealth data

Access Granted: DSAR changes for data controllers granting access to health data

Updated regulations in Ireland regarding data subjects' access to their health data emerged in March 2022. The new regulations have changed the obligations on data controllers getting health practioners to sign off on data subject access requests.

13 July 2022

Enforcement & fines

AP applies incremental penalty authority to the fullest

It is the first time in history that the Dutch Data Protection Authority (DPA) has identified six violations of the GDPR in only one decision. All violations relate to the use and security by the Tax Authorities of its application Fraud Signaling Facility (FSV). An application that included signals about established fraud and signals that could indicate an increased risk of fraud with taxes and benefits.

12 July 2022

INPLP internal

A new member has joined the INPLP: Lia Hernández Pérez (Panama)

Legal IT Abogados is the first legal boutique specialized in Digital Law in Panama. They offer legal solutions in the world of technology, data protection, privacy, intellectual and industrial propert…

8 July 2022

International transfers

Cross Border Transfers: Recent Developments

Generally, data transfers to third countries are prohibited unless the receiving country has received an adequacy decision from the European Commission. In the absence of this, outward transfers may only be conducted if the receiving jurisdiction proves that they have implemented appropriate safeguards that guarantee data subject’s rights and effective legal remedies.

8 July 2022

Shaping the limits of the Right to be Notified in 2022 Israel.

The Israeli Privacy Protection Authority recently published a new memo aimed to clarify the scope of interpretation of the obligation "to Notify" in the context of collecting and using personal information. Broader duties of notification will apply on sensitive data and will be subject to recent court rulings that defined more precisely what to consider when examning the Duty to Notify.

6 July 2022

Enforcement & finesAI & automation

Facial recognition systems: 20 million fine against the American company Clearview.

"Not everything that is technically possible is legally and ethically lawful." These are the words of Guido Scorza, member of the Italian Data Protection Authority, to describe the €20 million fine imposed last February by the Italian DPA on the US company Clearview AI Inc. for its facial recognition service.

4 July 2022

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership