711 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

711 articles

Romanian DPA fines the lack of cooperation with the supervisory authority

The Romanian Data Protection Authority ("Romanian DPA") has recently sanctioned three entities (two private companies and a homeowners association) for lack of cooperation with the supervisory authority, imposing on these entities administrative fines of EUR 2,000 (twice), respectively EUR 3,000. All three sanctions were announced during October 2020 on the website of the Romanian DPA.

5 November 2020

Health data

Slovak country-wide COVID-19 testing from the perspective of personal data protection

Slovakia has recently witnessed a significant increase in the number of confirmed COVID-19 cases. The country exceeded the threshold of one thousand cases per day on Oct. 7. Only about a week later, tests revealed over 2.000 infected people per day.

2 November 2020

The Danish Data Protection Agency is investigating the research area

The Danish Data Protection Agency has decided to supervise a number of activities in the research area. The Authority also initiates a collaboration with the Ministry of Health with a view to more concrete and targeted guidance for the area.

29 October 2020

Facial recognition technologies from a Swedish data protection perspective

Technologies for facial recognition - capable of identifying and/or verifying a physical person automatically from a digital image or video - are developing at a fast pace and continue to emerge in the markets. Facial recognition technologies are normally based on the identification of certain facial features from an image and comparing it with images of faces collected in a database. The technologies available for facial recognition are many and the ways in which the technology can be used are countless.

26 October 2020

Judicial remedy against decisions issued by Turkish data protection board

Under the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board (“Board”) has the authority to impose administrative fines on data controllers due to failure to comply with their various obligations regulated under the DPL, i.e. failure to comply with the obligation to inform data subjects, obligations related to data security, the decisions issued by the Board and registration and notification obligations to the Data Controllers’ Registry. However, there is no explicit provision under the DPL about the competent courts for judicial review of decisions of the Board imposing administrative fines which creates confusion and dissatisfaction in practice with regard to the judicial remedies to be followed.

19 October 2020

The norwegian data protection authority threatens to impose legal measures against the international baccalaureate organization

The DPA considered IBO’s processing to be in violation of the fairness requirement, transparency requirement and the accuracy requirement set out in the GPDR.

16 October 2020

The handbook on the protection of privacy by transport entities in a digital environment in Israel

The Israeli Privacy Protection Authority published a handbook for transport entities on the protection of privacy by in a digital environment (the “Guidance”).

13 October 2020

Cloud & vendors

Microsoft cloud contracts under a cloud amid GDPR concerns (continuation — and conclusion?)

In April 2019, the “EDPS” or European Data Protection Supervisor, launched an investigation into the use of Microsoft products and services by European institutions, bodies, offices and agencies (“EU institutions”).

5 October 2020

GDPR versus ISO 27701

Although some jurisdiction such as EU's GDPR provide a mechanism for an organization to demonstrate its compliance to GDPR (Article 42 and 43), assessment programs representing this mechanism is not yet available. On the other hand, businesses would like to have confidence that their service providers are managing their privacy issues. Implementation of a Privacy Information Management System (PIMS) or certification to ISO/IEC 27701 is currently a good solution for a data controller to demonstrate to its directors and customers, and for a data processor to demonstrate to its customers that they are managing the issues.

1 October 2020

Marketing & cookies

Spanish Data Protection Authority (AEPD) releases new Guidelines on the use of Cookies

The Spanish Data Protection Authority (AEPD) has just updated the Guide on the use of “cookies” to adapt it to the Guidelines 05/2020 on consent under Regulation 2016/679, as modified in May 2020 by the European Data Protection Board (EDPB).

24 September 2020

Legislation

Overview on the Amendment of the Act on the Protection of Personal Information

The Act on the Protection of Personal Information (“APPI”) of Japan was established in 2003, and had only been amended once, in 2015. The second amendment of the Act since its establishment was approved by the Diet and has been promulgated this June. The amendment act of APPI (“Amendment Act”) is to come into force by June 2022.

21 September 2020

Enforcement & fines

The British Data Protection Authority ICO considers operating systems that are no longer supported inadequate security.

If systems such as Windows 7 and Windows Server 2008 R2 SP1 are no longer supported by Microsoft, this may result in inadequate security, which could then be seen as an infringement of article 32 GDPR. Huge GDPR fines may be imposed because of this infringement.

17 September 2020

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership