Tag Archives: Data Transfer

French Data Protection Authority Launches Public Consultation on Cloud Computing

On October 17, 2011, the French Data Protection Authority (the “CNIL”) launched a public consultation on cloud computing (the “Consultation”). The Consultation seeks to gather opinions from stakeholders (clients, providers, consultants) regarding cloud computing services for businesses, to identify legal and technical solutions that address data protection concerns while taking into account the economic interests involved.

Continue reading…

Tags: , , , , , ,

Angola Passes Personal Data Protection Law

On June 17, 2011, the National Assembly of the Republic of Angola passed Law 22/11 on Personal Data Protection.  The omnibus privacy legislation applies to the automated and non-automated processing of personal data by controllers based or operating in Angola, or subject to, or using equipment governed by, Angola’s laws.  Some highlights of the law are listed below.
Continue reading…

Tags: , , , , , ,

Outsourcers Exempt from India’s Privacy Regulations

On August 24, 2011, the Government of India’s Ministry of Communications & Information Technology issued a clarification regarding India’s new privacy regulations, known as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “Rules”), under Section 43A of the Information Technology Act 2000.

Continue reading…

Tags: , , ,

Belgium Simplifies the Authorization Procedure for Binding Corporate Rules

On July 13, 2011, the Belgian Privacy Commission (the “Belgian DPA”) signed a Protocol with the Ministry of Justice which significantly simplifies the authorization procedure for binding corporate rules (“BCRs”) under Belgian law.  The Protocol was just made public on the Belgian DPA’s website.  View the Protocol on BCRs (in both Dutch and French).

Continue reading…

Tags: , , , , , , , ,

English Translation of Peru’s Law for Personal Data Protection Released

The Department of Commerce released an English translation of Peru’s Law for Personal Data Protection (Ley de Protección de Datos Personales, Ley No. 29733).  The law passed Peru’s Congress on June 7, 2011, and was signed by the president July 2, 2011.  Peru’s adoption of this new law is in keeping with a recent trend in Latin America, where Uruguay, Mexico and Colombia also have passed privacy legislation.

Continue reading…

Tags: , , , , , , , , ,

Mexico Issues Privacy Regulations for Public Comment – Full Text

On July 6, 2011, Mexico’s Secretary of Economy, in conjunction with the Federal Institute for Access to Information and Data Protection (“IFAI”), released wide-ranging privacy regulations for public comment.  The regulations establish rules and guidelines for the implementation of Mexico’s Federal Law on the Protection of Personal Data in the Possession of Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), which became effective one year ago.  Among the topics covered are jurisdictional issues, details regarding notice and consent, the relationship between data controllers and data processors, data transfers, data security, self regulation, data subjects’ rights, automated processing and enforcement.

Access the text of the new regulations in Spanish.  View IFAI’s video press release

Access the U.S. Department of Commerce’s English translation of the regulations
 

Tags: , , ,

Peru Adopts Personal Data Protection Law

As reported in BNA’s Privacy Law Watch, on July 2, 2011, Peruvian President Alan García signed the Personal Data Protection Law (Ley de Protección de Datos Personales, Ley No. 29733), making Peru the latest Latin American country to adopt EU-style omnibus privacy legislation.  Implementing rules for the new law are to be drafted in the next few months.

Continue reading…

Tags: , , ,

Council of Europe Considers Amendments to Convention 108

On June 28-30, 2011, the Council of Europe’s Bureau of the Consultative Committee of the Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (known as the “T-PD-Bureau”) met in Strasbourg, France, to discuss, among other things, amending the Council of Europe’s Convention 108.  Convention 108, which underlies the European Union’s legal framework for data protection, is the only legally-binding international convention that addresses data protection.  Amendment of the Convention is thus closely linked to the current review of the EU data protection framework, and many of the same actors are involved in both exercises.

Continue reading…

Tags: , , , , , , , , , ,

Polish DPA Hosts First Conference on BCRs in Warsaw

On June 13, 2011, the Polish Data Protection Authority (Generalny Inspektor Ochrony Danych Osbowych or “GIODO”) hosted a conference in Warsaw on the use of binding corporate rules (“BCRs”) for international data transfers.  The conference was notable as the first on this topic in Poland, and was designed to introduce BCRs to a Polish audience and to promote their use.  The audience of approximately 70 people heard presentations by the Polish Inspector General for Data Protection, Wojciech Rafał Wiewiórowski, as well as representatives of the Belgian, French, Polish, Spanish and UK DPAs, and the international and Polish business communities.  Christopher Kuner, partner in the Brussels office of Hunton & Williams, spoke at the conference on a panel entitled “BCRs requirements and practical implementation.”  View the conference program.

In his presentation, Wiewiórowski explained that, although he personally looks favorably on the use of BCRs, Poland has not been able to join the Article 29 Working Party’s mutual recognition procedure due to legal impediments under Polish law.  Several of the DPAs expressed interest in exploring the use of BCRs for data processors, but indicated that a number of obstacles must be overcome before such use could be approved.  Following the workshop, on June 15, 2011, a number of DPAs met in closed session in Warsaw to work on better coordination of the mutual recognition and approval procedure.

Tags: , , , ,

Peruvian Privacy Law Expected by July 28, 2011

On June 7, 2011, the Congress of the Republic of Peru passed the Personal Data Protection Law (Ley de Protección de Datos Personales, Proyecto de Ley 4079/2009-PE).  If signed into law, the bill would make Peru the newest member of the group of Latin American countries with EU-style omnibus privacy legislation.  The broad-ranging legislation would do the following, among other things:

Continue reading…

Tags: , , ,