On May 27, 2021, the European Data Protection Supervisor announced that it has opened two investigations regarding (1) the use of cloud services by European Union institutions, bodies and agencies; and (2) the use of Microsoft Office 365 by the European Commission.
Continue Reading EDPS Opens Investigations Following Schrems II Judgment
European Union
UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions
Posted on
Posted in European Union, Information Security
On May 26, 2021, the Court of Appeal handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the UK 2018 Data Protection Act’s “immigration exemption” is unlawful.…
Continue Reading UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions
Belgian DPA Approves First EU Data Protection Code of Conduct for Cloud Service Providers
Posted on
On May 20, 2021, the Belgian Data Protection Authority announced that it had approved the EU Data Protection Code of Conduct for Cloud Service Providers, the first transnational EU code of conduct since the entry into force of the EU General Data Protection Regulation.…
Continue Reading Belgian DPA Approves First EU Data Protection Code of Conduct for Cloud Service Providers
Dutch DPA Fines Company 525,000 EUR for Failure to Designate EU Representative
Posted on
Posted in Enforcement, European Union
The Dutch Data Protection Authority has imposed a 525,000 EUR fine on Locatefamily.com for failure to comply with the obligation imposed under Article 27 of the EU General Data Protection Regulation to appoint a representative in the EU.…
Continue Reading Dutch DPA Fines Company 525,000 EUR for Failure to Designate EU Representative
Irish High Court Permits DPC Inquiry into Facebook Transfers to Proceed
Posted on
Posted in European Union, Information Security
On May 14, 2021, the Irish High Court dismissed Facebook Ireland’s challenge to the Irish Data Protection Commissioner’s investigation into the company’s international transfers of personal data.…
Continue Reading Irish High Court Permits DPC Inquiry into Facebook Transfers to Proceed
MEPs Urge European Commission to Amend Draft UK Adequacy Decision
Posted on
Posted in European Union, Information Security
On May 11, 2021, the European Parliament issued a press release requesting that the European Commission amend its draft decisions on UK adequacy to more closely align with EU court rulings and the opinion of the European Data Protection Board. The request came after the Parliament’s Civil Liberties Committee passed a resolution evaluating the Commission’s approach regarding the adequacy of the UK’s data protection regime.…
Continue Reading MEPs Urge European Commission to Amend Draft UK Adequacy Decision
Norwegian DPA Issues 2.5M EUR Preliminary Fine for U.S. Company Utilizing Web-Tracking IDs
Posted on
On May 2, 2021, the Norwegian data protection authority, Datatilsynet, notified a U.S. company of its intention to issue a fine of 25 million Norwegian Krone (approximately 2.5 million Euros). The preliminary fine was issued for failure to comply with the General Data Protection Regulation’s accountability, lawfulness and transparency requirements, primarily due to the company’s tracking of website visitors.…
Continue Reading Norwegian DPA Issues 2.5M EUR Preliminary Fine for U.S. Company Utilizing Web-Tracking IDs
Portuguese DPA Orders Suspension of U.S. Data Transfers by Agency That Relied on SCCs
Posted on
On April 27, 2021, the Portuguese Data Protection Authority ordered the National Institute of Statistics to suspend, within 12 hours, any international transfers of personal data to the U.S. or other third countries that have not been recognized as providing an adequate level of data protection.…
Continue Reading Portuguese DPA Orders Suspension of U.S. Data Transfers by Agency That Relied on SCCs
CIPL Submits Response to the EDPB Guidelines on Virtual Voice Assistants
Posted on
The Centre for Information Policy Leadership at Hunton Andrews Kurth has submitted its response to the European Data Protection Board consultation on draft guidelines on virtual voice assistants. The Guidelines were adopted on March 12, 2021 for public consultation.…
Continue Reading CIPL Submits Response to the EDPB Guidelines on Virtual Voice Assistants
Belgian Constitutional Court Annuls Data Retention Framework for Electronic Communications Data
Posted on
On April 22, 2021, the Belgian Constitutional Court annulled the framework set forth by the Law of 29 May 2016 requiring telecommunications providers to retain electronic communications data in bulk. …
Continue Reading Belgian Constitutional Court Annuls Data Retention Framework for Electronic Communications Data