On September 5, 2022, the Irish Data Protection Commissioner imposed a €405,000,000 fine on Instagram for violations of the EU General Data Protection Regulation’s rules on the processing of children’s personal data.
Continue Reading Irish Data Protection Commissioner Fines Instagram for Children’s Privacy Violations

On July 7, 2022, the Cyberspace Administration of China (the “CAC”) issued the Measures on Security Assessment on Cross-border Transfer (the “Measures”), which became effective on September 1, 2022, and provide a six-month grace period to the relevant data handlers. On August 31, 2022, the CAC issued the Guidelines on Application for Security Assessment on Cross-border Transfer (the “Guidelines”), which further clarify certain issues and provide specific application documents for security assessments (including templates of application forms for security assessment on cross-border transfer and self-assessments report for risks of cross-border transfer).

Continue Reading Government Security Assessment on Cross-Border Transfer in China

On August 5, 2022, French AdTech company Criteo announced that it had received a report from the French Data Protection Authority on August 3, 2022, claiming various infringements of the EU General Data Protection Regulation and proposing to impose 60 million euros fine against Criteo.
Continue Reading CNIL Proposes 60 Million Euros Fine Against French AdTech Company For Non-Compliance with GDPR

In July 2022, Maria Ostashenko from ALRUD Law Firm reports that the Russian Parliament passed, and the President of the Russian Federation signed into law, major reforms in data protection and information governance. The reforms include:

  • Significant changes to Federal Law No. 152-FZ on Personal Data, including the scope of its application, new rules for

On July 24, 2022, the Financial Express published an article on Rajeev Chandrasekhar, the Indian Minister of State for Electronics and Information Technology, noting that the introduction of the Indian Data Protection Bill before Parliament will be delayed by a few months.
Continue Reading India Delays Introduction of Data Protection Bill Before Parliament

On June 30, 2022, the Cyberspace Administration of China (the “CAC”) issued a draft Provision on the Standard Contract for Cross-border Transfer of Personal Information (“Draft Provisions”) and a draft of the Standard Contract for Cross-border Transfer of Personal Information (“Standard Contract”) for public comments. Per Article 38 of the Personal Information Protection Law (“PIPL”), if the data handler is not required to conduct a government security assessment, it may choose either to conduct certification by a qualified third institution or to execute the Standard Contract for cross-border transfer of personal information. Certification might be more commonly used for cross-border transfer within a group, whereas the Standard Contract may be more popular under other scenarios of cross-border transfers.

Continue Reading China Issues Draft Provisions on Standard Contract for Cross-Border Transfer of Personal Information