Tag Archives: data protection

ICO enforcement actions in Q1 2022

By Asélle Ibraimova and Angelika Bialowas on Posted in Privacy & Data Protection, Regulatory
In Q1 2022, the UK’s Information Commissioner’s Office (ICO) issued 26 enforcement actions. There were 15 monetary penalties issued, ranging between £2k – £200k, and 11 enforcement notices. The majority of the fines and enforcement notices related to unsolicited marketing activities, two related to data subject rights infringements, and one related to a failure to … Continue Reading

The fourth anniversary of the GDPR: How the GDPR has had a domino effect

By Asélle Ibraimova and Sarah O'Brien on Posted in Data & Cyber Security, Privacy & Data Protection
Four years ago, the General Data Protection Regulation (“GDPR”) came into force in the EU. Since then, the GDPR has had a domino effect, as many countries in the world have used it as a model to shape their own rules on the handling of personal data. Given the rapid changes in data protection legislation … Continue Reading

Department for Digital, Culture, Media and Sport launches consultation on app security

By Cynthia O’Donoghue, Yunzhe Zhang and Sarah O'Brien on Posted in Data & Cyber Security, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
On 4 May 2022, the Department for Digital, Culture, Media and Sport (DCMS) launched a consultation (available here) to request views from the tech industry on potential interventions to enhance security and privacy requirements for firms running app stores and developers making apps.… Continue Reading

Maryland and California Propose Biometric Privacy Legislation that Would Include Illinois-Like Private Rights of Action

By Gerard Stegmaier, Sarah Bruno, Mark Quist, Hubert Zanczak and Stuart Cobb on Posted in Privacy & Data Protection
Maryland and California look to join the list of states that not only regulate biometric data but provide consumers with the opportunity to seek hefty statutory damages and attorney’s fees from offending businesses. Similar to Illinois’ oft-litigated Biometric Information Privacy Act (“BIPA”), both bills would also (i) require written consent prior to the collection of … Continue Reading

Cookie fines in France in January 2022: is it the beginning of a “Cookie Gate”?

By Daniel Kadar, Laetitia Gaillard and Sarah O'Brien on Posted in Privacy & Data Protection
In January 2022, several decisions by the French data protection regulator (“CNIL”) were published regarding the implementation of French cookie requirements, sending out a strong signal to website operators targeting French users. On 6 January 2022, the CNIL issued fines totalling 150 million euros and 60 million euros, to Google and Facebook respectively, for violations … Continue Reading

U.S. Data Privacy Compliance Roadmap for 2022

By Sarah Bruno, Idara Udofia and Hubert Zanczak on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection
There’s no doubt 2022 will be a big year for data privacy compliance with three new laws going into effect in 2023. On January 1, 2023, the California Privacy Rights Act (CPRA) will replace and amend California’s most recent, comprehensive data privacy law, the California Consumer Privacy Act (CCPA), and Virginia’s first extensive privacy law, … Continue Reading

Lloyd v. Google: Supreme Court rejects compensation claim

By Cynthia O’Donoghue and Sarah O'Brien on Posted in In the Courts, Privacy & Data Protection
In one of the most highly anticipated judgments in recent years, the UK Supreme Court has unanimously rejected a class-action style compensation claim under the Data Protection Act 1998. The Supreme Court decision was handed down as a result of a claim raised against Google LLC (Google) by Richard Lloyd on behalf of four million … Continue Reading

The ICO approves the first UK GDPR certification schemes

By Cynthia O’Donoghue and Asélle Ibraimova on Posted in Privacy & Data Protection
Controllers and processors can demonstrate their compliance with the GDPR by adhering to approved data protection certification mechanisms established by data protection authorities. The ICO has approved such certification mechanism  for three UK GDPR certification schemes, in the following areas: IT asset disposal – the Asset Disposal and Information Security Alliance (ADISA) have developed a … Continue Reading

The UK’s ICO launches public consultation on employment practices

By Philip Thomas and Carl De Cicco on Posted in Privacy & Data Protection
The ICO has announced plans to replace its existing employment practices guidance with a more user-friendly online resource. The new resource will be divided into specific topics such as recruitment and selection, employment records, monitoring of workers, and information about workers’ health. In particular, the new guidance aims to: Address the changes in data protection … Continue Reading

Is an Article 27 GDPR representative liable for a controller’s breach? Not according to the English High Court

By Cynthia O’Donoghue on Posted in Privacy & Data Protection
The English High Court delivered an important judgement earlier this year in Sanso Rondon v LexisNexis Risk Solutions UK Ltd [2021] EWHC 1427 (QB). You can read the judgment here. Where an organisation based outside the EU is subject to the EU General Data Protection Regulation (GDPR) either because they sell goods or services to, … Continue Reading

City A.M. interviews Howard Womersley Smith on London’s start up Fintech scene

By Howard Womersley Smith on Posted in Privacy & Data Protection
City A.M. has interviewed Howard Womersley Smith, an expert Fintech and Data lawyer and partner in Reed Smith’s Technology & Data London team, on London’s current startup FinTech scene. Sitting down with Womersley Smith, City AM reflected on a range of London Fintechs urging the Financial Conduct Authority (FCA) to break banks’ dominance over the … Continue Reading

GDPR vs. U.S. discovery: The conflict continues

By Katalina Bateman and Karen Lee Lust on Posted in In the Courts
Recent cases have highlighted the continued tensions between the GDPR and U.S. demands for discovery in the context of U.S. litigation and investigations. This issue can present a real concern for companies operating on both sides of the pond seeking to comply with obligations on either side. Whilst the GDPR provides EU citizens with valuable … Continue Reading

Singapore’s data transfer rules amended to recognise APEC CBPR and PRP certifications

By Charmian Aw and Carolyn Chia, Resource Law LLC on Posted in Global Data Transfers
On 4 June 2020, Singapore’s Personal Data Protection Regulations 2014 (Regulations) were amended to specify that recipients of personal data located outside Singapore which are certified under the Asia‑Pacific Economic Cooperation Cross-Border Privacy Rules (APEC CBPR) System, would satisfy the cross-border data transfer requirements under Singapore’s data protection law. The same outcome would be achieved … Continue Reading

Dutch court holds that a grandmother is in breach of the GDPR for failing to remove photos of her grandchildren from social media platforms

By Cynthia O’Donoghue and Nadia Avraham on Posted in Privacy & Data Protection
A Dutch court has held that a grandmother was in breach of the General Data Protection Regulation (GDPR) for posting pictures of her grandchildren on social media platforms without their parents’ consent and refusing to delete them after multiple requests. The GDPR does not apply to the processing of personal data by an individual “in … Continue Reading

The Commission’s eHealth Network looks to develop the interoperability framework for contact tracing apps

By Cynthia O’Donoghue and Katalina Bateman on Posted in Privacy & Data Protection
On 13th May, the European Commission’s eHealth Network published its interoperability guidelines for approved contact tracing mobile applications in the EU, guiding developers when designing and implementing applications and backend solutions to ensure efficient tracing of cross-border infection chains. These guidelines serve as a follow-up action to their previously published ‘Common EU Toolbox for Member … Continue Reading

No, we haven’t forgotten about Brexit: UKTF publishes a draft agreement for the future EU-UK partnership

By Cynthia O’Donoghue and Sarah O'Brien on Posted in Privacy & Data Protection
On 18 March, the Task Force for Relations with the United Kingdom (UKTF) of the European Commission published its Draft Text of the Agreement on the New Partnership with the United Kingdom (Draft Agreement). It translates the negotiating directives, approved by Member States, into a legal text, in line with the Political Declaration agreed between … Continue Reading

The 7-Step Ad Tech Guide – New guidance issued by industry bodies on programmatic advertising

By Cynthia O’Donoghue and Nadia Avraham on Posted in Cookies, Tracking & Online Behavioral Advertising
The Data & Marketing Association and the Incorporated Society of British Advertisers have published a “Seven-Step Ad Tech Guide” (the Guide) to help address the privacy challenges of Real Time Bidding (RTB) in programmatic advertising. RTB is an automated auction process that allows advertising space to be bought and sold on a per-impression basis. When … Continue Reading

Singapore proposes significant changes to its data protection law

By Charmian Aw and Carolyn Chia, Resource Law LLC on Posted in Privacy & Data Protection, Regulatory
The Personal Data Protection (Amendment) Bill 2020 (the Bill) was published today for public consultation. Key amendments proposed in the Bill include: Increased financial penalties for breaches of the Personal Data Protection Act (the Act) of up to 10 per cent of annual gross turnover in Singapore or S$1 million, whichever is higher. Mandatory data … Continue Reading

Digital contact tracing and coronavirus: The Council of Europe’s take

By Cynthia O’Donoghue and Nadia Avraham on Posted in Privacy & Data Protection
The chair of the Council of Europe’s data protection ‘Convention 108’ committee, Alessandra Pierucci, and the Council of Europe Data Protection Commissioner, Jean-Philippe Walter, have recently released a joint statement on digital contact tracing in the fight against coronavirus. Digital contact tracing is being used in many countries to help control the spread of coronavirus … Continue Reading

The EDPB on ‘Data Protection by Design and by Default’

By Cynthia O’Donoghue and Karen Lee Lust on Posted in Privacy & Data Protection
On 13 November 2019, the European Data Protection Board (EDPB) adopted the guidelines on Data Protection by Design and Default (DPbDD) for public consultation (link here) until 16 January 2020, providing an in-depth analysis of the components that make up DPbDD under GDPR article 25. We highlight below some of the key definitions. Background DPbDD … Continue Reading

EDPS, data protection and scientific research

By Cynthia O’Donoghue and Daniel Millard on Posted in Privacy & Data Protection
This week the EU’s independent data protection authority (DPA), the European Data Protection Supervisor (EDPS), published a preliminary opinion on data protection and scientific research subject to the General Data Protection Regulation 679/2016 (GDPR) and Regulation 1725/2018 governing data protection in EU institutions (Preliminary Opinion). Regulation 1725/2018 is very similar to the GDPR’s provisions in … Continue Reading

Updated draft of ePrivacy Regulation – Finnish presidency of the Council of the EU aims for final text by the end of the year

By Sven Schonhofen, Dr. Thomas Fischl and Arne Senger on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
The Finnish presidency of the Council of the EU (Finnish Presidency) released an updated draft of the Regulation on Privacy and Electronic Communications (ePrivacy Regulation) on October 30, 2019 (available here). The Working Party on Telecommunications and Information Society (WP TELE) will discuss the new draft at its meeting on November 7, 2019. Amendments put … Continue Reading
LexBlog