On August 26, 2021, the UK Department of Culture, Media and Sport made news by publishing a document indicating its intent to begin making adequacy decisions for UK data transfers to foreign jurisdictions and by announcing its preferred candidate for the position of new UK Information Commissioner.
Continue Reading UK DCMS Identifies Priority Jurisdictions for UK Adequacy Recognition and Proposes New UK Information Commissioner

On August 9, 2021, the UK First-Tier Tribunal (General Regulatory Chamber) (“FTT”) reduced a fine imposed by the UK Information Commissioner’s Office (“ICO”) against Doorstep Dispensaree Ltd (“DDL”) from £275,000 to £92,000, a reduction of approximately two thirds. DDL, which supplies medicines to customers and care homes, was fined in December 2019 for failure to comply with the EU General Data Protection Regulation (“GDPR”). The ICO also issued an Enforcement Notice, requiring DDL to take certain actions to bring its processing into compliance.

Continue Reading UK First-Tier Tribunal Cuts ICO’s Doorstep Dispensaree Fine by Two Thirds

On August 11, 2021, the UK Information Commissioner’s Office launched a consultation on its draft international data transfer agreement and guidance for organizations on international transfers. Once finalized, the agreement will replace the existing EU Standard Contractual Clauses in the UK.
Continue Reading ICO Consultation on International Data Transfer Agreement to Replace SCCs

On August 2, 2021, the Italian Data Protection Authority announced that it had levied a €2,500,000 fine on Deliveroo Italy s.r.l. for the unlawful processing of personal data of approximately 8,000 Deliveroo riders and various infringements of the GDPR.
Continue Reading Italian Garante Fines Deliveroo 2.5M Euros for Unlawful Processing of Personal Data

On July 16, 2021, the Luxembourg data protection authority (Commission nationale pour la protection des donées, “CNPD”) imposed a record-breaking €746 million fine on Amazon Europe Core S.à.r.l. for alleged violations of the EU General Data Protection Regulation (“GDPR”). The CNPD also ordered Amazon to revise certain of its practices.
Continue Reading Luxembourg DPA Fines Amazon 746 Million Euros for GDPR Violations

On June 29, 2021, the UK Department for Digital, Culture, Media and Sport (“DCMS”) published guidance for businesses on child online safety, which includes guidance on data protection and privacy, age-appropriate content, positive user interactions, and protecting children from online sexual exploitation and abuse.

Continue Reading DCMS and ICO Publish Guidance on Protecting Children Online

In an article originally published on Practical Law, Hunton Andrews Kurth partner Bridget Treacy discusses the European Commission’s long-awaited SCCs, including considerations for personal data transfers from the UK. This blog entry provides a link to download the article.
Continue Reading European Commission’s New Standard Contractual Clauses: What They Mean for UK Businesses