On November 19, 2021, the European Data Protection Board (“EDPB”) published its draft Guidelines 05/2021 (the “Guidelines”) on the interplay between the application of Article 3 of the EU General Data Protection Regulation (“GDPR”), which sets forth the GDPR’s territorial scope, and the GDPR’s provisions on international data transfers. The Guidelines aim to assist organizations subject to the GDPR in identifying whether a data processing activity constitutes an international data transfer under the GDPR, as the GDPR does not define the term.
EDPB Releases Statement on the Digital Services Package and Data Strategy; Calls for Ban on Targeted Ads
Posted on
On November 18, 2021, the European Data Protection Board (“EDPB”) released a statement on the Digital Services Package and Data Strategy (the “Statement”). The Digital Services Package and Data Strategy is a package composed of several legislative proposals, including the Digital Services Act (“DSA”), the Digital Markets Act (“DMA”), the Data Governance Act (“DGA”), the Regulation on a European approach for Artificial Intelligence (“AIR”) and the upcoming Data Act (expected to be presented shortly). The proposals aim to facilitate the further use and sharing of personal data between more public and private parties; support the use of specific technologies, such as Big Data and artificial intelligence (“AI”); and regulate online platforms and gatekeepers.
Indian Joint Parliamentary Committee Adopts Report on Personal Data Protection Bill
Posted on
Posted in International
On November 22, 2021, according to India Today, the Indian Joint Parliamentary Committee (the “JPC”) responsible for reviewing the Personal Information Protection Bill 2019 (“PDPB”) issued its report on the proposed law. The report comes nearly two years after the bill was first referred to the JPC. The JPC’s report will likely be presented with the PDPB 2019 in the Winter Session of Parliament, which begins on November 29, 2021. If passed, the PDPB would constitute the first comprehensive data protection law in India.
Federal Regulators Issue New Cyber Incident Reporting Rule for Banks
Posted on
On November 18, 2021, the Federal Reserve, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency issued a new rule regarding cyber incident reporting obligations for U.S. banks and service providers.
Continue Reading Federal Regulators Issue New Cyber Incident Reporting Rule for Banks
FTC Commissioner Nominee Bedoya Advocates for Privacy Protections During Confirmation Hearing
Posted on
On November 17, 2021, the Senate Committee on Commerce, Science, and Transportation held its confirmation hearing on FTC Commissioner nominee, Alvaro Bedoya.
U.S. Department of the Treasury Announces Partnership with Israel to Combat Ransomware
Posted on
On November 14, 2021, the U.S. Department of the Treasury announced a bilateral cybersecurity partnership with the Israeli Ministry of Finance “to protect critical financial infrastructure and emerging technologies” and combat the use of ransomware. The initiative includes the launch of a U.S.-Israeli Task Force on Fintech Innovation and Cybersecurity (the “Task Force”), which seeks to advance the twin goals of encouraging fintech innovation while protecting against cyber threats from nation-state and criminal actors.
New York State Requires Private Employers to Notify Employees of Electronic Monitoring
Posted on
On November 8, 2021, New York Governor Kathy Hochul signed into law A.430/S.2628 (the “Act”), which requires private employers with a place of business in New York State to provide their employees prior written notice, upon hiring, of any electronic monitoring, as defined in the Act, to which the employees will be subjected by the employer.
FTC Recommends Steps to Protect Against Ransomware
Posted on
Posted in Cybersecurity
On November 5, 2021, the Federal Trade Commission suggested two preventative steps small businesses can take to protect against ransomware risks:
Continue Reading FTC Recommends Steps to Protect Against Ransomware
Belgian DPA Expected to Rule that IAB Europe’s Cookie Consent Framework Violates the GDPR
Posted on
On November 5, 2021, IAB Europe (“IAB EU”) announced that, in the coming weeks, the Belgian Data Protection Authority plans to share with other data protection authorities a draft ruling on the IAB EU Transparency & Consent Framework (“TCF”). The TCF is a GDPR consent solution built by IAB EU that has become a widely used approach to collecting consent to cookies under the GDPR. The draft ruling is expected to find that the TCF does not comply with the GDPR, in part because IAB EU acts as a controller, and the digital signals the TCF creates to capture individuals’ consent to cookies are personal data under the GDPR. Because IAB EU does not consider itself a controller with respect to the TCF, it does not currently comply with the GDPR’s controller obligations.
Lloyd Court Says No to Class Action-Style Lawsuits in the UK
Posted on
Posted in Enforcement, International
On November 10, 2021, the UK Supreme Court issued its long-awaited judgment in the Lloyd v Google case. The decision is expected to make it difficult in practice for a future class action lawsuit that is brought on behalf of a class of individuals who have not actively opted in to being represented by the lead claimant to proceed under UK law.
Continue Reading Lloyd Court Says No to Class Action-Style Lawsuits in the UK