709 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

709 articles

Portuguese Data Protection Authority activity report 2019/2020

As part of the fulfilment of the duties assigned to it by the General Data Protection Regulation (hereinafter “GDPR”), the National Commission for Data Protection (hereinafter “CNPD”) has published its most recent activity report, which concerns the work carried out in the years 2019 and 2020. We have summarized the main highlights characterizing the work of the CNPD in the last two years.

19 May 2021

Enforcement & finesBreach notification

Data breach reported to late? That’s a €475,000 fine!

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a €475,000 fine on Booking.com because the company took too long to report a data breach to the DPA.

16 May 2021

Data subject rights

Enforcement of the GPDR in Luxembourg: an issue at stake?

Max Schrems and his organisation NOYB (None Of Your Business) have recently begun a new battle, taking place in Luxembourg! Legal proceedings have been issued against two decisions of the Luxemburg Data Protection Authority (the “CNPD”). These decisions dismissed two complaints lodged against two different US-based data controllers, Apollo and RocketReach. These claims are currently pending before the Luxembourg Administrative Court.

14 May 2021

Legislation

Amendment on Enforcement Rules of the Japanese Privacy Law

The amendment on Enforcement Rules for the Act on the Protection of Personal Information was promulgated on March 26 of this year. The amended enforcement rules will be enforced on April 1st, 2022 together with the amended Act on the Protection of Personal Information. This article introduces the main points of the amended Enforcement Rules.

12 May 2021

Monaco: Overview Of The Prior Control Activity Of The Personal Data Protection Authority (“Ccin”) Since 2020

According to the current Monegasque legislation, the automated processing of personal data is subject to the control of the CCIN prior to its implementation. Here is an overview of the authorisations and prior notices of the CCIN concerning automated processing implemented in Monaco in the private and public sectors since 2020.

12 May 2021

INPLP internal

A new member has joined the INPLP: Peter Hense (Germany)

Spirit Legal is based in Leipzig, although they advise domestic and foreign businesses with an international focus, regardless of their location. They advise established business owners on capital inc…

11 May 2021

German Federal Cartel Office vs. Facebook – The one who wins the battle might not win the war

The dispute between the German Federal Cartel Office and Facebook continues before the ECJ. This may mean that business models of the digital economy will change in Europe.

10 May 2021

International transfersLegislation

The challenges related to the transfer of personal data from the perspective of the new Law on Personal Data Protection

The purpose of this Article is to provide an overview of the legal mechanisms by which personal data can be transferred from the Republic of North Macedonia.

7 May 2021

Data subject rightsBreach notification

Personal data breach resulting from data subjects' mistakes have to be notified!

The Polish Data Protection Authority has imposed on WARTA. S.A, a Polish insurance and reinsurance company, a new administrative sanction in the amount of c.a. EUR 20.000,00 for failure to notify a personal data breach that resulted from data subject’s mistake.

4 May 2021

Health data

Scientific research using health data: Is the GDPR in contradiction with FAIR principles?

Medical research is becoming increasingly reliant on the analysis of large amounts of biologically derived data. Greater scientific and societal value are achievable if these research data are processed in accordance with the FAIR – Findable, Accessible, Interoperable and Reusable – principles. Contemporary scientific research within the EU is guided by these principles; for example, the European Cloud Initiative. They ensure verifiability, transparency and trustworthiness of research, as well as the availability of the raw data for further scientific research. The implementation of FAIR data goes hand-in-hand with the principle that research data must be “as Open as possible and as closed as necessary”.

30 April 2021

Cloud & vendors

EDPB’s Guidelines on the concepts of controller and processor in the GDPR

The European Data Protection Board issued the Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 1.0, adopted on 02 September 2020. We made a selection of a number of paragraphs which offer relevant insight for groups of companies:

27 April 2021

Enforcement & fines

GDPR Fines: Ramping up and DPAs Setting standards

European Supervisory Authorities imposed more than €158m in fines under the GDPR during 2020; close to a 40% increase on the previous 20-month period. This brings the total amount of fines to more than €272m in the period from May 2018 to end 2020. Businesses now have greater insight into, and detail about, the amount of potential financial penalties for failing to comply with the GDPR.

23 April 2021

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership