707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

One year of GDPR in Estonia

Each Spring, the Estonian Data Protection Inspectorate (DPI) publishes its Annual, summarising its main activities of the previous year. The Annual of 2018 obviously mainly concentrated on the effect of the GDPR on the Estonian data protection landscape.

1 July 2019

Breach notification

GDPR IN NUMBERS – The Irish Perspective

To mark the occasion of GDPR's first anniversary, findings and statistics tracked from May 2018 to May 2019 concerning awareness, compliance and enforcement of the new rules throughout the EU have been emerging from the European Commission and the Irish data protection supervisory authority ("DPA"). The Irish Data Protection Commission ("DPC") has had a significant role to play in EU privacy oversight and enforcement for several reasons, most notably because some of the world's largest digital and cloud companies have located their European headquarters in Ireland. The DPC's 2018 Annual Report alongside its updated 2019 statistics make for an interesting comparison between Ireland's reaction to the GDPR and that of our EU counterparts.

28 June 2019

Legislation

Portuguese Law implementing GDPR finally approved

On the 14th of June 2019 (one year later than expected) Portugal has finally approved Draft Law no. 120/XIII/3.ª (GOV), implementing the (EU) Regulation 2016/679 (General Data Protection Regulation or GDPR) in Portugal.

26 June 2019

Cloud & vendors

GDPR: A Game Changer for Cloud Contracts

Until recently, most IT contracts, even the large-scale ones, were generally based on a simple purchase order and sometimes a statement of work. The General Data Protection Regulation (GDPR) has changed the game.

24 June 2019

Legislation

Guidance on the Regulation on a framework for the free flow of non-personal data in the European Union

Last week the European Commission published guidance on the free flow of non-personal data, focussing on the interaction of the FFD regulation (free flow of non-personal data, applicable as of 28th May) and the GDPR (General Data Protection regulation).

5 June 2019

Cloud & vendors

The 4th version of the StarAudit Catalogue has been released

We've introduced a new Area focused on GDPR and several enhancements to existing controls as part of this major update.

5 June 2019

Legislative and practical adjustments in Bulgaria implementing GDPR

Earlier in 2019 Bulgaria has become another European Union member to adopt the EU’s privacy regime. The Bulgarian Personal Data Protection Act named the Bulgarian Commission for Personal Data Protection Commission (“CPDP”) to act as a Supervisory Authority in the meaning of art 51 of GDPR.

4 June 2019

The Danish Data Protection Agency has reported a large Danish taxi company to the police for violation of GDPR rules

The Danish Data Protection Agency has reported the taxi company, Taxi 4x35, to the police and recommended the company for a fine of DKK 1.2 million (approximately EUR 160.000) for violating the rules of the Data Protection Regulation (GDPR).

23 May 2019

Legislation

Serbia: New Law on Personal Data Protection

At the end of November 2018, the new Law on Personal Data Protection (Law) came into force but its application was postponed for nine months, until August 21, 2019. Brief overview of the Law is given in the text below, including new elements, as well as principal provisions which refer to personal data protection.

21 May 2019

Marketing & cookies

The Belgian data protection authority bans the use of private sector logins as an access condition to public sector websites

The Belgian tax authorities maintain an online repository called FisconetPlus, on which tax payers can find key information and guidance on taxation questions. However, the information was only available after loggin on to the portal with a Microsoft user account. Unacceptable and in violation of the GDPR, says the Belgian data protection authority.

9 May 2019

Slovak list of processing operations which are subject to the requirement for a data protection impact assessment

Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (hereinafter “DPIA”).

6 May 2019

Challenges for Companies with an Israel Nexus

In May 2018, the Israeli Protection Of Privacy Regulations (Data Security 2017) (the “Regulations”) came into effect. The Regulations promulgated under the Israeli Protection of Privacy Law, 1981 (the “Law”), include specific and exacting requirements with respect to data security, which may exceed formal requirements under EU law. In addition has Israel has regulations regarding the transfer of data abroad, which is not entirely consistent with the GDPR, and has a mandatory database registration requirement, for databases which meet certain conditions.

15 April 2019

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership