707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

The European Commission confirms that Argentina has adequate legislation for the international transfer of personal data

Argentina, along with 10 other countries, receives ratification from the European Union on its adequacy note for the international transfer of personal data from Europe to these countries. After a process that lasted a few years, and which was temporarily interrupted by some pending decisions of the European courts, Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Ma, Israel, Jersey, New Zealand, Switzerland and Uruguay received confirmation of their adequacy note.

16 April 2024

AI & automation

The Brazilian Data Protection Authority´s Regulatory Sandbox Pilot Program on Artificial Intelligence and Data Protection: A Brief Overview.

The current debates on artificial intelligence create a timely opportunity for the development of mechanisms that balance the promotion of innovation and the protection of fundamental rights, such as privacy and data protection. This article presents a brief overview of The Brazilian Data Protection Authority´s Regulatory Sandbox Pilot Program on Artificial Intelligence and Data Protection as a potencial regulatory tool for artificial intelligence.

11 April 2024

Employment data

Further processing videosurveillance recordings for assessing performance of employees is inadmissible.

Bulgarian Personal Data Protection Commission has issued an opinion on the admissibility of processing video surveillance records with sound for the purposes of assessing the personal performance of the employees and for determining their bonuses. The opinion of the commission is that such further processing of the personal data does not comply with the requirements of Art. 6, para. 4 of GDPR and therefore is inadmissible.

20 March 2024

Litigation

CJEU increases the requirements for claiming non-material damage within the meaning of the GDPR

Whether or not (nearly) any and all violation of the General Data Protection Regulation (GDPR) entitles data subjects to non-material damages has been the subject of substantial debate. On 14 December 2023 the Court of Justice of the European Union (CJEU) issued a first decision on this topic holding, that such damages may in principle be claimed for all violations, as the GDPR not only does not require a ‘de minimis threshold’, but even pre-cludes national legislation or a national practice which sets such threshold. This caused the data protection community to predict a wave of incoming data-protection related litigation. 1 month and 11 days later, this has changed yet again.

14 March 2024

INPLP internal

INPLP Activity Report 2023 published

The past year was a success for the INPLP, marked by robust collaboration and network growth. The annual conference in Dublin, hosted by Rob Corbet (Arthur Cox), was a key milestone. Our priorities included strengthening collaboration, facilitating knowledge transfer, and expanding the network.

13 March 2024

Legislation

Extraterritorial Implications of Turkish Data Protection Legislation

This article explores the regulatory landscape for data controllers located outside Turkey and their obligations under the Turkish Data Protection Law.

16 February 2024

Violation of personal data protection by the City of Trnava as the Controller of personal data

In a recent decision by the Office for Personal Data Protection, we witnessed a case of violation of the Personal Data Protection Act and GDPR. The breach of personal data protection concerned the Controller, who unlawfully disclosed personal data of 47 affected individuals, including the applicant, in a resolution of the City Council of Trnava (“Resolution”).

13 February 2024

Breach notification

A thin line between a typo and a data breach: A case study in enhancing data security practices

In a recent case, the Serbian Commissioner for Information of Public Importance and Personal Data Protection issued a cautionary notice to a bank, shedding light on its procedures for collecting and managing clients' email addresses for communication purposes.

9 February 2024

AI & automationLegislation

Europe’s AI Act: a new role for the Dutch Data Protection Authority?

"The genie is out of the bottle. We need to move forward on artificial intelligence development but we also need to be mindful of its very real dangers. I fear that AI may replace humans altogether." This quote from Stephen Hawking in 2017 is more relevant today than ever.

7 February 2024

Enforcement & finesData subject rights

Financial companies for fast loans fined for processing personal data without consent from personal data subject

The North Macedonian Personal Data Protection Agency has issued several fines for financial companies for fast loans due to processing personal data contrary to the law i.e. without previous consent from the data subject.

5 February 2024

Activity of the personal data supervisory authority of Monaco (CCIN): Increase in the number of complaints and recommendations

This article outlines the complaints addressed to the CCIN by data subjects, the number of which, in proportion to Monaco, is rising sharply (1), and its recommendations (2).

2 February 2024

Children

Processing Children’s Data Correctly: Takeaways from the Recent TikTok Decision

In September 2023, the Irish Data Protection Commission (“DPC”) adopted its final decision in an own-volition inquiry into the processing by TikTok Technology Limited (“TikTok”) of personal data relating to child users of the TikTok platform. The sanctions imposed on the social media platform include an administrative fine totalling €345 million, a reprimand and an order to bring processing into compliance within a period of three months.

31 January 2024

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership