709 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

709 articles

International transfersCloud & vendorsLitigation

Schrems II: An opportunity for the Sovereign Cloud

As personal data crossborder flows cannot benefit from the “EU-US privacy shield” anymore, as a consequence of the Schrems II judgment, that creates an opportunity for the European sovereign cloud. This article provides the overview of the general situation, focusing on French case law encouraging the overall trend.

16 March 2021

Breach notification

When privacy became an investment risk. Shall companies report its security incidents to the market?

Potential investors are being warned of the negative impact that the GDPR sanctions may have on the expected profitability of the business. Cyberattacks on listed companies should be reported to the market as a warning to the investors. Privacy is a business risk, and their management bodies must adopt effective measures to prevent it.

12 March 2021

Litigation

No surprise here – the EU Court confirms again that public authorities’ access to telecom data is strictly limited

Public authorities’ access to electronic communications data has always been and continues to be a hot topic, even (or especially) after the EU Court of Justice declared the so-called Data Retention Directive invalid in 2014. After that, the Court has ruled on several occasions on the retention of and access to electronic communications data, the latest just a few days ago at the beginning of March where the Court answered to an Estonian court’s question whether access to traffic and location data relating to a short period could justify access for fighting crimes that are not “serious” with a hard NO.

9 March 2021

Dramatic Changes are Coming to the Privacy Landscape in Canada

This article discusses how the proposed legislation seeks to strike a balance between protecting consumer’s personal information, and allowing industry and innovation.

5 March 2021

Legislation

Brazil’s Data Protection Law: A Brief Overview

Despite being no stranger to data privacy regulation, only recently has Brazil enacted a comprehensive set of rules to regulate the processing of personal data, in great part inspired by the EU GDPR. This article presents a brief overview of Brazil’s Data Protection Law, the LGPD, and the creation process and major responsibilities of Brazil’s National Data Protection Authority, the ANPD.

2 March 2021

Enforcement & fines

Cyprus Data Protection Watchdog imposes fine on major banking institution for integrity and confidentiality violations.

On 19 October 2020, The Office of the Commissioner for Personal Data Protection ('the Commissioner') announced its decision to fine Bank of Cyprus Public Company Ltd ('the Bank'), the amount of €15,000 for violation of Articles 5 (1)(f), 5 (2), 15, 32, and 33 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

27 February 2021

Enforcement & fines

No GDPR fines for public sector bodies at all? No discrimination, and no problem!

The GDPR explicitly allows Member States to determine whether and to what extent administrative fines can be imposed on public authorities and public sector bodies. In Belgium, the public sector has been exempted from fines entirely. The Constitutional Court has now explicitly affirmed that this is not an unlawful discrimination.

22 February 2021

INPLP internal

A new member has joined the INPLP: Wendy Wagner (Canada)

Gowling WLG provides its clients with in-depth expertise in key global sectors and a suite of legal services at home and abroad through 1,400 legal professionals in 19 cities worldwide. We see the wor…

20 February 2021

Legislation

A Privacy Law for 25% of the World’s Population: China’s Personal Information Protection Law

China published the Personal Information Protection Law (Draft) ("PIPL") for public consultation on 21 October 2020. This is the first legal framework to address personal information protection in China. One can find many similarities between the Draft and the EU GDPR. However, there are still significant differences between the two. This article highlights the similarities and differences between the Draft and the EU GDPR from both the macroscopic and microscopic viewpoints.

19 February 2021

INPLP internal

A new member has joined the INPLP: Paul Haswell (Hong Kong)

Pinsent Masons is a full-service international law firm. We respond to the pressures and opportunities facing businesses globally with legal excellence and innovation. With office locations on four co…

17 February 2021

Can data protection rules affect the assignment of receivables in Bulgaria?

For many years, a common practice in Bulgaria is debtors to submit complains to the Bulgarian DPA for unlawful processing of their personal data due to performed assignement of their debts to a new creditor (cession). As a result a non-consistent practice has been formed of the DPA through the years where quite often the consent of the deptor for the processing of his/her personal data is sought as a condition for the assignement of the debt/ the receivables to a new creditor. However, after GDPR Bulgarian DPA undertaken certain changes in their interpetation on whether consent is required for the processing of personal data of a debtor when a creditor assign/ transfer a debt to a new creditor (e.g. in case of cession).

15 February 2021

Enforcement & finesBreach notificationLegislation

Are fines imposed by the Luxembourg Data Protection Authority for breach of data protection regulations insurable?

There is no shortage of recent examples of cyber-attacks and the current COVID-19 pandemic is undoubtedly contributing to an intensification of this phenomenon1. While such attacks can be devastating…

12 February 2021

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership