711 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

711 articles

Denmark´s first GDPR fine to date

On February 12th 2021 the city Court in Aarhus handed down the first verdict in Denmark that has led to a fine based on GDPR. The Court imposed a fine of DKK 100,000 (appr. EUR 13,500) on the Danish furniture chain ILVA, which is part of the Danish multibillion concern Jysk Group. ILVA was found guilty of having stored around 350,000 unnecessary personal data. It was the Danish Data Protection Agency (DDPA) that had forwarded the case to the prosecution with the proposal that ILVA should be fined with DKK 1.5 mio (appr. EUR 201,700). The prosecution agreed with the proposal of the DDPA.

19 March 2021

Legislation

Right to access of origin of the information based on Swiss Federal Act on Data Protection (FADP)

The Swiss Federal Supreme Court has made an interesting decision on the scope of the right to information under Swiss Federal Act on Data Protection (FADP) and also addressed an abusive assertion (decision of 10th December 2020, ref. 4A_125/2020). The judges decided that there is no right to information about the origin of certain data if such origin information has not been recorded. In individual cases, the situation could be different due to special legal regulations. However, only if such data exist at all.

18 March 2021

International transfersCloud & vendorsLitigation

Schrems II: An opportunity for the Sovereign Cloud

As personal data crossborder flows cannot benefit from the “EU-US privacy shield” anymore, as a consequence of the Schrems II judgment, that creates an opportunity for the European sovereign cloud. This article provides the overview of the general situation, focusing on French case law encouraging the overall trend.

16 March 2021

Breach notification

When privacy became an investment risk. Shall companies report its security incidents to the market?

Potential investors are being warned of the negative impact that the GDPR sanctions may have on the expected profitability of the business. Cyberattacks on listed companies should be reported to the market as a warning to the investors. Privacy is a business risk, and their management bodies must adopt effective measures to prevent it.

12 March 2021

Litigation

No surprise here – the EU Court confirms again that public authorities’ access to telecom data is strictly limited

Public authorities’ access to electronic communications data has always been and continues to be a hot topic, even (or especially) after the EU Court of Justice declared the so-called Data Retention Directive invalid in 2014. After that, the Court has ruled on several occasions on the retention of and access to electronic communications data, the latest just a few days ago at the beginning of March where the Court answered to an Estonian court’s question whether access to traffic and location data relating to a short period could justify access for fighting crimes that are not “serious” with a hard NO.

9 March 2021

Dramatic Changes are Coming to the Privacy Landscape in Canada

This article discusses how the proposed legislation seeks to strike a balance between protecting consumer’s personal information, and allowing industry and innovation.

5 March 2021

Legislation

Brazil’s Data Protection Law: A Brief Overview

Despite being no stranger to data privacy regulation, only recently has Brazil enacted a comprehensive set of rules to regulate the processing of personal data, in great part inspired by the EU GDPR. This article presents a brief overview of Brazil’s Data Protection Law, the LGPD, and the creation process and major responsibilities of Brazil’s National Data Protection Authority, the ANPD.

2 March 2021

Enforcement & fines

Cyprus Data Protection Watchdog imposes fine on major banking institution for integrity and confidentiality violations.

On 19 October 2020, The Office of the Commissioner for Personal Data Protection ('the Commissioner') announced its decision to fine Bank of Cyprus Public Company Ltd ('the Bank'), the amount of €15,000 for violation of Articles 5 (1)(f), 5 (2), 15, 32, and 33 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

27 February 2021

Enforcement & fines

No GDPR fines for public sector bodies at all? No discrimination, and no problem!

The GDPR explicitly allows Member States to determine whether and to what extent administrative fines can be imposed on public authorities and public sector bodies. In Belgium, the public sector has been exempted from fines entirely. The Constitutional Court has now explicitly affirmed that this is not an unlawful discrimination.

22 February 2021

INPLP internal

A new member has joined the INPLP: Wendy Wagner (Canada)

Gowling WLG provides its clients with in-depth expertise in key global sectors and a suite of legal services at home and abroad through 1,400 legal professionals in 19 cities worldwide. We see the wor…

20 February 2021

Legislation

A Privacy Law for 25% of the World’s Population: China’s Personal Information Protection Law

China published the Personal Information Protection Law (Draft) ("PIPL") for public consultation on 21 October 2020. This is the first legal framework to address personal information protection in China. One can find many similarities between the Draft and the EU GDPR. However, there are still significant differences between the two. This article highlights the similarities and differences between the Draft and the EU GDPR from both the macroscopic and microscopic viewpoints.

19 February 2021

INPLP internal

A new member has joined the INPLP: Paul Haswell (Hong Kong)

Pinsent Masons is a full-service international law firm. We respond to the pressures and opportunities facing businesses globally with legal excellence and innovation. With office locations on four co…

17 February 2021

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership