Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

Ecuadorian Digital Transformation Policy: Data Protection implications

The current Ecuadorian government is about to issue a new digital transformation policy. Once the working tables have closed, the draft version of the policy brings some important issues that have relevant personal data protection implications as even the large-scale processing of sensitive data is being considered. This article addresses these challenges for the protection of personal data from a cross-cutting perspective to the policy and with emphasis on certain (vertical) points of the policy.

28 October 2022

Marketing & cookies

The CNIL reminds us of the rules on e-marketing and the rights of individuals

Companies have long used e-marketing to facilitate their development and attract new customers, and in our digital world, reliance on such strategies is ever-increasing. As e-marketing strategies involve the processing of personal data, unsurprisingly, e-marketing is subject to strict regulations, which can lead to non-negligible sanctions if breaches occur. On August 17th 2022 the French Data Protection Supervisory Authority, the Commission Nationale de l'Informatique et des Libertés ("CNIL"), issued a 600,000 Euro fine against French hotel group, ACCOR for carrying out e-marketing without data subject consent, thus violating customer and prospect rights. The case is interesting in that it covers both GDPR and e-privacy regulation breaches and shows the interesting cross-over between the two pieces of legislation.

26 October 2022

The Baltic DPAs to carry out joint supervision in the field of short-term rental of vehicles

This summer, the data protection authorities (DPAs) of the three Baltic States – Estonia, Latvia and Lithuania – announced that they will carry out preventive joint supervision in the field of short-term rental of vehicles (e.g., electric scooters). The purpose of the joint supervision is to develop recommendations to improve the processing and protection of personal data in the specified field.

24 October 2022

AI & automation

The Metaverse and privacy: guidance by the spanish data protection authority

The Metaverse uses a variety of technologies such as AR and VR, DLTs (Blockchain), AI, IoT, IoRT, 5G, that enable the creation of immersive virtual environments and generate a multisensory experience for the user within the framework of web 3.0. Brands, firms and companies are entering the Metaverse with impetus. As the Spanish DPA (AEPD) in a recent article put it: “The current social and technical situation has created the ideal context for the Metaverse’s development and expansion, translating human experiences into digital data processing through simulations. However, the processing of this personal data is completely real”. This article analyzes its privacy and data protection implications.

17 October 2022

Legislation

Data Protection Law and the culture change in the laboral routines of companies: the use of the data protection theme as a strategic tool

Despite being clear that Brazil’s Data Protection Law (”LGPD”) applies to employment relationships, it is not usual to discuss the practical conduct that should already have been adopted by Brazilian companies in order to be compliant with the legislation from a labor standpoint. The lack of attention to such internal compliance can be harmful, not only from a data protection point of view, but also from a strategic business development point of view.

4 October 2022

Enforcement & finesBreach notification

FOUR YEARS OF GDPR: The Danish approach to data protection, or absence thereof?

25th May 2022 marked the 4th anniversary of the entry into force of the General Data Protection Regulation (GDPR) and the announcement of sanctions with a deterrent effect. However, the obligation to issue fines that are effective, proportionate and dissuasive has not been met at all by the Danish Data Protection Authority and the Danish courts. The lack of enforcement of the rules will ultimately lead to a lax treatment of personal data and may in the long term have serious consequences for the protection of the fundamental rights of individuals.

15 September 2022

Children

Bulgarian PDPC adopted a list of processing operations requiring prior consultation

Bulgarian PDPC has adopted a list of processing operations that require prior consultation which is addressed to the authorities subject to Directive (EU) 2016/680. This list does not directly applies to the accitvities of the controllers and processors subject to GDPR, but provides an indication for operations which rise high risks and require DPIA and eventual prior consultation under GDPR as well.

13 September 2022

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership