707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

Norwegian DPA publishes list of processing activities with mandatory DPIA

Under Article 35 of the GDPR, the national Data Processing Authority (DPA) shall establish and make public a list of processing operations which are subject to the requirement for a DPIA. The Norwegian DPA recently published a list of processing activities that the Norwegian DPA considers likely to result in a high risk to the rights and freedoms of data subjects, and which will therefore always require the controller to carry out a DPIA. The Norwegian DPA's list is based on the Working Party 29's analysis in the Guidelines on DPIA (WP 248).

10 April 2019

Health data

Three Legal Opinions of the Italian DPA clarify some GDPR Implementation Aspects

The aim of this article is to focus on three important legal opinions published by the Italian Data Protection Authority on the application of GDPR to personal data of deceased persons, the existence of a possible duty to communicate employees’ personal data to their professional associations and the role of the labour consultant after the full implementation of GDPR.

4 April 2019

Enforcement & fines

On 19 February 2019, the Dutch Data Protection Authority has come up with its own policy for determining the levels of administrative fines

On the basis of the guidelines of the article 29 working party of what now is the EDPB (European Data Protection Board) and the stipulations on imposing and setting administrative fines as laid down in the GDPR, the Dutch DPA has now formulated its own policy. This to achieve a consistent approach when administrative fines are imposed. The policy adequately reflects all of the principles listed in the EDPB guidelines, which are intended to come to a common understanding of the assessment criteria laid down in article 83 (2) of the GDPR.

2 April 2019

Litigation

The Spanish DPA published a report on the processing of personal data related to political opinions by political parties

The Spanish DPA published a recent report on the processing by political parties of personal data related to political opinions.

26 March 2019

Legislation

Implications on Data Protection law in the event of a no-deal Brexit

Since the 2016 referendum whereby voters expressed their wish for the United Kingdom (the “UK”) to leave the European Union (the “EU”), and the subsequent notification made by the UK on the 29th of March 2017 to the European Council of its intention to withdraw from the Union pursuant to Article 50 of the Treaty on European Union (also known as “Brexit”), rigorous negotiations between the UK and other EU countries have been taking place with one of the main topics of discussion being the “divorce deal”; in other words, the way in which the UK will leave the EU by the 29th of March 2019.

21 March 2019

Employment dataLegislation

Data Protection Officers under Slovenia’s Draft Personal Data Protection Act (ZVOP-2)

In the light of the GDPR, on March 6, 2019, Slovenia’s Ministry of Justice published a draft Personal Data Protection Act (Zakon o varstvu osebnih podatkov, ZVOP-2). In this Article we look at those proposed provisions on the data protection officers (DPOs) which differ from or contravene the provisions of the GDPR.

19 March 2019

Litigation

The role of Romanian courts in the protection of personal data in the post GDPR era

Where does the role of the data protection authority (DPA) end and where the court takes priority? The relevant legal provisions are spread around the national laws and regulations, most of them being included in the laws regulating the organization of the Romanian DPA.

12 March 2019

Legislation

Three interesting decisions on Austrian data protection law

This article presents three interesting decisions on Austrian data protection law, in particular dealing with an unlawful video surveillance and its imposed fine, voluntary consent to the setting of cookies and the breach of duty to provide information where personal data has not been obtained from the data subject.

28 February 2019

LitigationLegislation

Liability of Joint Controllers in the Light of the CJEU Case Law

General Data Protection Regulation (GDPR) brought (for the Czech legal environment completely new) legal construct of joint controllership. Article 26 of the GDPR, which applies to it, states that joint controllers are the controllers who jointly determine the purposes and means of processing. Although this legal construct exists in European law for many years, Czech law did not use it.

26 February 2019

Cloud & vendors

The Looming Clouds: How and why cloud services are reshaping the future of financial services in Europe

EuroCloud Europe publishes a new whitepaper in partnership with RedHat and Accenture, tracing the drivers of change across the financial services industry in order to illustrate the trend towards cloud computing,

26 February 2019

Cloud & vendors

To be or not to be (a processor). That is the question.

In the case of a service provider that is not contracted by a controller to process personal data on its behalf but may gain custody of the controller’s personal data incidentally to the core services provided, should a contract with the controller-processor clauses required under GDPR Article 28 be drawn up?

21 February 2019

International transfers

EU–U.S. Privacy Shield adequacy decision (“Privacy Shield”) adopted on 12 July 2016, assessed by EDPB in report January 22, 2019

The EDPB (European Data Protection Board) assessed in its January 22, 2019 report once again whether the safeguards provided under the EU-U.S. Privacy Shield are workable and effective and the EDPB assessed the robustness of its adequacy decision and its practical implementation.

4 February 2019

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership