Archives: Privacy & Data Protection

Subscribe to Privacy & Data Protection RSS Feed

Pre-Christmas Update on the ePrivacy Regulation

The General Data Protection Regulation (“GDPR”) will enter into force 25 May 2018, and will provide new general data protection standards. In its draft ePrivacy Regulation of 10 January 2017 (“ePrivacy Regulation”), which includes specific provisions for electronic communications, the European Commission sought to ensure that both sets of rules will enter into force at … Continue Reading

Morrisons found vicariously liable for a data breach committed by one of its employees

Following a recent ruling by the High Court against WM Morrisons Supermarket PLC (“Morrisons”), employers may now find themselves vicariously liable for data breaches perpetrated by their employees (https://www.judiciary.gov.uk/judgments/various-claimants-v-wm-morrisons-supermarket-plc/). Background In 2014, it was discovered that a file containing the pay roll data of 99,998 Morrisons’ employees had been uploaded to a file sharing website. … Continue Reading

ENISA publishes report on recommendations for data protection certification mechanisms under the GDPR

On 27 November 2017, the European Union Agency for Network and Information Security (“ENISA”) published a report on Recommendations on European Data Protection Certification (“Report”). The aim of the Report is to identify and analyse challenges and opportunities of data protection certification mechanisms, as introduced by the General Data Protection Regulation (“GDPR”). The Report provides … Continue Reading

CJEU rules Digital Rights Ireland’s Privacy Shield invalidation action inadmissible

Background On 22 November 2017, the Court of Justice of the European Union (“CJEU”) gave judgment in a case taken by the not-for-profit company, Digital Rights Ireland Limited (“DRIL”). DRIL sought an annulment of the European Commission’s Privacy Shield decision. This decision states that the US ensures an adequate level of protection for personal data … Continue Reading

Sears Petitions to Change Its 8-Year-Old FTC Privacy Settlement Order

On October 30, 2017, Sears Holding Management Corporation (“Sears”) petitioned the Federal Trade Commission (“FTC”) to reopen and modify the settlement to which they agreed in 2009.  At that time, Sears agreed to a consent order to resolve the FTC’s complaint that Sears allegedly did not adequately disclose the scope of its collection of “online … Continue Reading

German FCO launches sector inquiry into online price comparison websites

The German Federal Cartel Office (”FCO“) has launched a sector inquiry into “online price comparison websites.” This sector inquiry is the first specific proceeding in which the FCO applies its new competencies in the area of consumer protection given to it by the 9th amendment to the German Act against Restraints of Competition (“ARC”). Another sector … Continue Reading

Get your update on IT & Privacy Law

The Fall 2017 Edition of the quarterly IT & Privacy Newsletter by Reed Smith Germany has just been released. We cover the regulation on cross-border portability of online content services and new case law on employee monitoring, marketing consent, influencer advertising, choice of law and venue clauses in T&Cs, and platform provider liability. You can … Continue Reading

Coming to America? Cybersecurity and privacy concerns await you at U.S. ports

On October 4th, the U.S. House Homeland Security Committee passed a bill proposed by the House of Representatives entitled the Border Security for America Act (the “Act”).  The Act lays out a plan to establish a biometric exit data system to collect and verify information on the movement of persons entering U.S. ports while attempting … Continue Reading

Businesses Operating in the Garden State Brace For NJ Governor Murphy

Democrat Phil Murphy has been elected as the next Governor of the State of New Jersey. Murphy comes in to the office with a double-digit victory over departing lieutenant governor Kim Guadagno (R), and the backing of a state legislature controlled by Democrats.  Governor-Elect Murphy, who has never served in elected office, promises to take … Continue Reading

Article 29 Working Party publishes guidelines on personal data breach notification

On 3 October 2017, the Article 29 Working Party (“WP29”) published draft guidelines on personal data breach notification (“Guidelines”) under the General Data Protection Regulation 2016/279 (“GDPR”). In this blog, we look at some of the key concepts that are considered in the Guidelines regarding the mandatory breach notification and communication requirements of the GDPR. … Continue Reading

“An Interview with Wisconsin AG Brad Schimel”

Check out this month’s edition of The Privacy Advisor, a publication of the International Association of Privacy Professionals (IAPP), for Divonne Smoyer and Kimberly Chow’s Q&A with Wisconsin Attorney General Brad Schimel. AG Schimel has prioritized cybercrime enforcement and prevention for the state. In the interview, he discusses his data privacy and security agenda as … Continue Reading

Article 29 Working Party publishes guidelines on automated individual decision making and profiling.

On 17 October 2017, the Article 29 Working Party (“Art 29 WP”) published draft guidelines on automated individual decision-making and profiling (“Guidelines”). In the Guidelines, the Art 29 WP states that profiling and automated decision making can be useful for individuals and organisations by delivering increased efficiencies and resource savings, whilst recognising that they may … Continue Reading

Thinking about Bugs

Security bugs may have wildly disparate paths of extermination. Some are quietly patched with code updates, while others make the national news and trigger companies’ incident response plans. Is your company aware of the data security vulnerabilities it should be addressing? Is your company prepared to respond to a researcher who notifies you of a … Continue Reading

Article 29 Data Protection Working Party Publishes Final Guidelines on Data Protection Impact Assessments

Background On 4 October 2017, the Article 29 Working Party (“WP29”) released its final guidelines on Data Protection Impact Assessments (“DPIA”), which were initially proposed in draft form in April 2017. Article 35 of the General Data Protection Regulation (“GDPR”) provides that the controller shall carry out an assessment of the impact of the envisaged … Continue Reading

European Commission publishes first annual report on EU-US Privacy Shield.

Following our previous blog on the upcoming first annual review of the EU-US Privacy Shield, the European Commission (“Commission”) published its report on 18 October 2017 (“Report”). The Commission’s Findings Overall, the Report confirms that the Privacy Shield continues to ensure an adequate level of protection for personal data transferred from the EU to participating … Continue Reading

ICO publishes response to consultation on European Commission’s implementing regulation to the NIS Directive

The Information Commissioner, Ms Elizabeth Denham, has published her comments on the European Commission’s consultation on the draft implementing regulation (“Implementing Regulation”) of the Network and Information Security Directive ((EU) 2016/1148) (“NIS Directive”). The Implementing Regulation sets out the further elements that need to be taken into account by digital service providers (“DSPs”) under the … Continue Reading

The CFPB Releases Data Sharing Principles, Setting Off A New Round of Controversy

On October 18, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) entered into the long simmering debate over consumer-authorized data sharing.  This debate pits mainstream financial institutions, which are typically reticent to share customer data with third parties, against data aggregators and other fintechs.  Those newer companies provide services directly to consumers—or to enhance the … Continue Reading

European Court of Justice provides guidance on “tasks carried out in the public interest.”

On 27 September 2017, the European Court of Justice (“ECJ”) handed down its preliminary ruling to the Supreme Court of the Slovak Republic (“Supreme Court”) regarding the interpretation of “a task carried out in the public interest” as a legitimate basis for processing personal data under Article 7(e) of the Data Protection Directive (95/46/EC) (“Directive”) … Continue Reading

House of Lords publishes briefing on Data Protection Bill

The House of Lords Library, which provides research and information services to Members of the House of Lords, has published a briefing on the Data Protection Bill (“Bill”) which sets out an overview of and reactions to the Bill (“Briefing”). The Briefing was prepared in advance of the Bill’s second reading in the House of … Continue Reading

EDPS releases recommendations on ePrivacy Regulation – Still a long way to go

We are only eight months away from the new EU data protection regime entering into force. In addition to the General Data Protection Regulation (“GDPR”), which includes the general data protection provisions, the ePrivacy Regulation shall provide specific rules for electronic communications. However, the legislative process of the ePrivacy Regulation is still in its early … Continue Reading

Proposal for a Regulation on the free flow of non-personal data in the EU

The European Commission has issued a proposal for a new Regulation on the free flow of non-personal data (“the Proposal”). Background The Commission adopted a Communication in January 2017 on “Building a European Data Economy”, in which its work on free flow of data was announced in the context of actions to enhance the data … Continue Reading

Court Deals Blow to FTC’s Position on Unfair Data Security Practices

Over the last several years, the Federal Trade Commission (FTC) has regularly used its authority under Section 5 of the FTC Act to bring cases against companies due to their allegedly unreasonable data security measures. The FTC has paid particular attention to the safeguards that manufacturers have implemented in electronic devices sold to consumers.  Recently, … Continue Reading

39th International Conference of Data Protection and Privacy Commissioners publishes Resolution on Data Protection in Automated and Connected Vehicles

The 39th International Conference of Data Protection and Privacy Commissioners in Hong Kong published a Resolution on Data Protection in Automated and Connected Vehicles, which sets out fundamental data protection requirements for the mobility of the future (“Resolution”). The Resolution proposes common international standards. The Resolution addresses not only vehicle and equipment manufacturers, but also … Continue Reading
LexBlog