Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

709 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

709 articles
International transfersLitigation

Use of Google analytics violates the GDPR - Recent decision of the austrian data protection authority

The Austrian Data Protection Authority (DPA) decided in a recent groundbreaking decision (22nd of December 2021, D155.027 2021-0.586.257) that the use of Google Analytics is currently violating the GDPR. The DPA held that the transfer of personal data to the US in light of the Schrems II decision is particularly problematic. This is the first decision on the 101 model complaints filed by noyb. Soon similar decisions are to be expected in other EU member states.

19 January 2022

Enforcement & fines

The Norwegian Data Processing Authority issues USD 7.2 million fine to U.S. company Grindr LLC

Following an investigation carried out by the Norwegian Consumer Council, the Norwegian Data Processing Authority on 13 December 2021 issued a fine of NOK 65 million (approximately USD 7.2 million) to Grindr, a U.S. based social networking app for gay, bi, trans and queer people. The legal basis for the fine was that Grindr had disclosed personal data to advertising partners without a valid consent or other legal basis under the GDPR Article 6, and further that special categories of personal data had been disclosed without a valid exemption from the prohibition set out in Article 9.

17 January 2022

Data subject rightsCloud & vendors

Are you a controller or a processor? Assess carefully.

It often happens that we get confused by the difference between a controller and a processor. The problem may arise when a controller refuses to grant certain rights to the data subject due to its assuredness that it is just a processor. This has recently happened in Serbia where Serbian Data Protection Authority issued decision with respect to this question, which is actually one of its first decisions since Serbia adopted new Law on Personal Data Protection.

13 December 2021

International transfersLitigation

SCCs and CoCs and BCR – Untangling the Web and Spotting the Difference

Under GDPR, data export to third countries is only permitted if the conditions under Chapter 5 are met. The adequacy decision by the commission according to art. 45 GDPR is the Chapters silver bullet. If, for lack of an adequate level of data protection, the EU Commission has not issued such an adequacy decision, the GDPR provides, among others, three alternative legal data protection tools in art. 46 and 47 GDPR: Standard Contractual Clauses (SCCs), Code of Conducts (CoCs) and Binding Corporate Rules (BCRs).

26 November 2021

Data subject rightsLegislation

New draft law on the "right to be forgotten" for those who have overcome serious illness

Last October, the Portuguese parliament approved in a final vote a draft law that establishes the "right to be forgotten", preventing people who have overcome serious illnesses from being discriminated against when accessing credit or insurance. This draft law is an important step not only in the field of data protection but also in the protection of human rights and the battle against discrimination.

22 November 2021

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership