Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

AN INSIGHT INTO THE NEW NIGERIAN CODE OF CONDUCT FOR DATA PROTECTION COMPLIANCE ORGANIZATIONS (DPCOs) 2023

The Nigeria Data Protection Commission (the Commissi-on or NDPC), in exercise of its regulatory mandate and after a painstaking validation process involving stakehol-ders such as Data Subjects, Data Controllers, Data Proces-sors and Data Protection Compliance Organizations (“DPCOs”), issued a Code of Conduct Directive for DPCOs in 2023 (“the Code”). Based on the provisions of Article 4.1(4) of the Nigeria Data Protection Regulation (NDPR) 2019, and Section 33 of the Nigeria Data Protection Act (NDPA) 2023, DPCOs are organisations that are duly licensed by the Nigeria Data Protection Commission for the purpose of training, auditing, consulting and rendering services aimed at ensur-ing compliance with the Nigeria Data Protection Act and all applicable legislations and regulations.

22 October 2024

Enforcement & finesMarketing & cookies

Tracking trouble: AS Watson's €600,000 fine and Google’s Privacy Sandbox under scrutiny

Recently, two notable cases have emerged demonstrating that the consent requirement for cookies is not always adhered to. The Dutch Data Protection Authority (AP) fined AS Watson B.V., the parent company of the Dutch drugstore chain Kruidvat, €600,000 for placing tracking cookies on Kruidvat.nl without the required consent. At the same time, concerns are being raised about Google’s Privacy Sandbox, which critics claim is also not fully compliant with the consent requirement. In this article, we will discuss these two recent cases. Additionally, we will delve into future regulations regarding cookies and the subsequent consent requirements. We will conclude with some practical tips.

3 October 2024

Controversial Swedish Freedom of Press Exemption challenged by the GDPR

The GDPR, designed to safeguard personal data, sometimes conflicts with rights like freedom of expression. In Sweden, online publishers can get a certificate of publication, exempting them from GDPR. This exemption, rooted in principles dated back to the second world war of free speech and transparency, is now exploited by websites to share personal data that GDPR would typically protect, such as addresses, incomes, and even criminal records, by offering them to any paying user. Traditional media criticize these practices, and despite lawsuits, such as for defamation, the sites have largely prevailed. However, recent court rulings have started to prioritize GDPR over these exemptions, creating legal uncertainty for any online publishers dependent on the exempti on. This article will clarify what these certificates are, their function in Sweden, and the impact of new court rulings that threaten this constitutional safeguard as well as the repercussions for online publishers.

26 September 2024

Breach notification

The Mischief of Mismanagement: Tale of a Breach of the GDPR

In early 2022, the Portuguese National Data Protection Supervisory Authority (“CNPD”) accused Lisbon’s Municipality of retaining demonstrators’ and protestors’ personal information for longer than necessary and sharing it with national and foreign public entities without proper legal basis, in breach of the principle of data minimization, without having previously conducted a data protection impact assessment and in breach of their obligations to inform data subjects about data processing operations. This Article provides an overview of the Administrative Court Decision that, almost two and a half years later, confirms the impressions of the CNPD and fines the Municipality in over one million euros for its mischief in the management of personal data.

17 September 2024

Transparency, personal data and the proposed reform in Mexico.

Mexico's approach to personal data protection operates through distinct frameworks for the public and private sectors. The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP ), established in 2010, governs private entities without reform to date. The public sector is regulated by the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO1), in effect since 2017. The National Institute of Transparency, Access to Information, and Personal Data Protection (INAI1) ensures compliance in the private sector, while state-level bodies, constitutionally autonomous, guarantee enforcement in the public sector. However, ongoing discussions emphasize the need to reform and possibly unify these frameworks to create a more streamlined and coherent regulatory environment for personal data protection. The potential dissolution of the INAI, as proposed in a constitutional reform, raises concerns. Such a move could disrupt efforts to modernize and harmonize data protection laws, creating uncertainty about the future of transparency and data protection in Mexico.

29 August 2024

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership