Tag Archives: GDPR

The fourth anniversary of the GDPR: How the GDPR has had a domino effect

By Asélle Ibraimova and Sarah O'Brien on Posted in Data & Cyber Security, Privacy & Data Protection
Four years ago, the General Data Protection Regulation (“GDPR”) came into force in the EU. Since then, the GDPR has had a domino effect, as many countries in the world have used it as a model to shape their own rules on the handling of personal data. Given the rapid changes in data protection legislation … Continue Reading

So you have got BCRs? You may still need to use the new EU SCCs

By Christian Leuthner and Asélle Ibraimova on Posted in Global Data Transfers
The arrival of the new EU Standard Contractual Clauses (“EU SCCs”) for international transfers in June 2021 was widely awaited to better understand the new requirements to assess the third-country laws for government access to data prior to using the SCCs following the Court of Justice of the European Union’s (“CJEU”) decision on Schrems II. … Continue Reading

UK’s Court of Appeal assesses territorial scope of GDPR

By Cynthia O’Donoghue and Sarah O'Brien on Posted in In the Courts, Privacy & Data Protection
In a judgment handed down by the UK Court of Appeal on 21 December 2021 ([2021] EWCA Civ 1952, available here), Walter Soriano, the claimant, was granted his cross-appeal, giving him permission to serve Forensic News LLC and four other defendants in the United States with proceedings under the General Data Protection Regulation (GDPR). The … Continue Reading

German court prohibits U.S. data transfers in “Cookiebot” decision: Why this decision is special and should alert, but not upset your organization

By Dr. Andreas Splittgerber and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Privacy & Data Protection, Regulatory
On December 1, 2021, in a much-noted decision, the Administrative Court of Wiesbaden (AC Wiesbaden) handed down a preliminary injunction dealing with international data transfers (case 6 L 738/21.WI, available in German here). In the specific case, there was no data transfer mechanism in place and thus the court ordered the defendant to stop using … Continue Reading

GDPR: Is it a transfer? Is it not a transfer? It’s EDPB guidance on Chapter V

By Cynthia O’Donoghue on Posted in Global Data Transfers
The European Data Protection Board (EDPB) recently adopted Guidelines 05/2021 (the Guidelines) on the interplay between what it means to be outside the European Economic Area (EEA) but directly applicable to the General Data Protection Regulation (GDPR) and what constitutes an international transfer under Chapter V of the GDPR. The Guidelines set out a ‘cumulative’ … Continue Reading

Lloyd v. Google: Supreme Court rejects compensation claim

By Cynthia O’Donoghue and Sarah O'Brien on Posted in In the Courts, Privacy & Data Protection
In one of the most highly anticipated judgments in recent years, the UK Supreme Court has unanimously rejected a class-action style compensation claim under the Data Protection Act 1998. The Supreme Court decision was handed down as a result of a claim raised against Google LLC (Google) by Richard Lloyd on behalf of four million … Continue Reading

Restrictions on data subject rights: EDPB provides guidance on article 23 GDPR

By Cynthia O’Donoghue and Angelika Bialowas on Posted in Privacy & Data Protection
On 13 October 2021, the European Data Protection Board (EDPB) adopted the final version of its Guidelines (10/20) on restrictions of data subject rights under article 23 of the General Data Protection Regulation ((EU) 2016/679) (GDPR) (the Guidelines) during its forty-third plenary session. The adoption comes after a public consultation on the EDPB’s draft guidelines, which … Continue Reading

South Korea – EDPB adopts an opinion on the Commission’s draft adequacy decision

By Cynthia O’Donoghue and Asélle Ibraimova on Posted in Global Data Transfers
On 24 September 2021, the European Data Protection Board (EDPB) issued its opinion on the European Commission’s (EC) draft adequacy decision in respect of South Korea. On 16 June 2021, the EC launched the procedure for the adoption of an adequacy decision for South Korea under the General Data Protection Regulation (GDPR), which would allow free transfers of … Continue Reading

DCMS launches public consultation on reforms to the UK’s data protection regime

By Cynthia O’Donoghue and Howard Womersley Smith on Posted in Privacy & Data Protection
On 10 September 2021, the Department for Digital, Culture, Media & Sport (DCMS) launched a public consultation on its proposed reforms to the UK’s data protection regime, with a view to assessing the case for legislative change. The consultation comes as the first step in the government’s plans to deliver on ‘Mission 2’ of its … Continue Reading

The ICO approves the first UK GDPR certification schemes

By Cynthia O’Donoghue and Asélle Ibraimova on Posted in Privacy & Data Protection
Controllers and processors can demonstrate their compliance with the GDPR by adhering to approved data protection certification mechanisms established by data protection authorities. The ICO has approved such certification mechanism  for three UK GDPR certification schemes, in the following areas: IT asset disposal – the Asset Disposal and Information Security Alliance (ADISA) have developed a … Continue Reading

Is an Article 27 GDPR representative liable for a controller’s breach? Not according to the English High Court

By Cynthia O’Donoghue on Posted in Privacy & Data Protection
The English High Court delivered an important judgement earlier this year in Sanso Rondon v LexisNexis Risk Solutions UK Ltd [2021] EWHC 1427 (QB). You can read the judgment here. Where an organisation based outside the EU is subject to the EU General Data Protection Regulation (GDPR) either because they sell goods or services to, … Continue Reading

Get your Update on IT & Data Protection Law in our Newsletter (Summer 2021 Edition)

By Dr. Andreas Splittgerber and Sven Schonhofen on Posted in Cookies, Tracking & Online Behavioral Advertising, In the Courts, Intellectual Property, Privacy & Data Protection, Regulatory
The Summer 2021 Edition of the quarterly IT & Data Protection Newsletter by Reed Smith Germany has just been released: English version German version In this edition we cover the following topics: Update on international data transfers State Labour Court of Baden-Württemberg: No claim for damages for transferring personal data to the United States on … Continue Reading

When are Reach Measurement Cookies exempt from the consent requirement?

By Dr. Andreas Splittgerber, Daniel Kadar, Laetitia Gaillard, Sven Schonhofen and Stéphanie Abdesselam on Posted in Cookies, Tracking & Online Behavioral Advertising, Privacy & Data Protection, Regulatory
After Germany became the last EU member state to transpose Article 5(3) of the Directive 2002/58/EC, amended by Directive 2009/136/EC (ePrivacy Directive) into national law, the use of cookies in the EU must meet one of the following requirements: The user’s consent, or The cookie must be strictly necessary in order to provide the service … Continue Reading

UK adequacy decision for European data transfers

By Cynthia O’Donoghue and Sarah O'Brien on Posted in Privacy & Data Protection
On the 28th June 2021, the European Commission (Commission) adopted two adequacy decisions for the UK; one covering the GDPR and the other the Law Enforcement Directive (LED). Such decisions demonstrate that the Commission believes the UK ensures an ‘essentially equivalent’ level of protection to that within the EU. The implication of these decisions is … Continue Reading

Get your Update on IT & Data Protection Law in our Newsletter (Spring 2021 Edition)

By Dr. Andreas Splittgerber and Sven Schonhofen on Posted in In the Courts, Intellectual Property, Privacy & Data Protection, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)
The Spring 2021 Edition of the quarterly IT & Data Protection Newsletter by Reed Smith Germany has just been released: English version German version In this edition we cover the following topics: New cookie rules in Germany will apply as of December 1, 2021 German data protection authorities conduct coordinated audits on international data transfers … Continue Reading

Storing credit card details for future purchases – EDPB recommends online retailers do so only with consent

By Cynthia O’Donoghue and Asélle Ibraimova on Posted in Privacy & Data Protection
On 19 May 2021, the European Data Protection Board (EDPB) adopted Recommendations on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions, available here. Scope of the recommendations The recommendations specifically address online providers of goods and services who store credit card data to facilitate … Continue Reading

Three years on from the implementation of the EU GDPR – Reed Smith tools and solutions to help with compliance

By Cynthia O’Donoghue, Elle Todd, Dr. Andreas Splittgerber and Asélle Ibraimova on Posted in Privacy & Data Protection
The EU General Data Protection Regulation (GDPR) came into effect on 25 May 2018. It became one of the leading pieces of legislation in the world to offer the highest levels of protection to the personal data of individuals. Many countries followed suit to raise the bar in how organisations handle personal data. The trend … Continue Reading

Get the latest updates on our Tech Law Talks podcast

By Sarah Bruno, Anthony Diana, LiLing Poh, Dr. Andreas Splittgerber, Catherine Castaldo, Ramona Kimmich, Christian Leuthner and Trevor Satnick on Posted in Cookies, Tracking & Online Behavioral Advertising, Data & Cyber Security, Privacy & Data Protection, Regulatory
Catch up on our Tech Law Talks podcast series for practical observations on technology and data legal trends. We cover product and technology development to operational and compliance issues that technology practitioners encounter every day. On this channel, we host regular discussions about the legal and business issues around data protection, privacy and security; data risk … Continue Reading

A summary of the obligations, scope and effect of the proposed European regulation on artificial intelligence

By Cynthia O’Donoghue, Dr. Andreas Splittgerber and Sarah O'Brien on Posted in Privacy & Data Protection, Regulatory
On April 21, 2021, a draft proposed European regulation on artificial intelligence (AI) (Regulation) was released following the European Commission’s white paper “On Artificial Intelligence – A European approach to excellence and trust”, published in February 2020. The regulation shows that the European Union is seeking to establish a legal framework for AI by laying … Continue Reading

Swiss authority’s summary of its GDPR-like revised federal law

By Cynthia O’Donoghue on Posted in Privacy & Data Protection
In its 2020 session, the Swiss Parliament passed the revised Federal Data Protection Act (FADP), which should come into force in the second half of 2022. The Swiss supervisory authority, the Federal Data Protection and Information Commissioner (FDPIC), has published a document outlining the important amendments, which is available here. The revised FADP (revFADP) covers … Continue Reading

Aftermath of Schrems II decision in France: The French Council of State provides significant clarification on the U.S. based data host to provide services in the French health care sector

By Daniel Kadar, Stéphanie Abdesselam and Laetitia Gaillard on Posted in Global Data Transfers, Privacy & Data Protection, Regulatory
On March 12, 2021, the French Council of State (Conseil d’Etat), the highest French administrative court, handed down a ruling (ordonnance des référés) allowing Doctolib, a company in charge of booking COVID-19 vaccination appointments, to rely on a U.S.-based health data host. In the present case, the servers of Doctolib – whose platform had been … Continue Reading
LexBlog