707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

Online identifiers are not always personal data

The Voivodeship Administrative Court in Warsaw recognizes online identifiers, including cookies, should not be automatically categorized as personal data. Thus the Polish Court is at variance with the Polish DPA’s stricter position on that subject.

11 April 2023

Cyber insurance: the French legal framework is changing

France makes the payment by insurers in case of cyber attacks conditional upon the prior filing of a criminal complaint within 72 hours.

6 April 2023

Marketing & cookies

The Guidelines on Use of Cookies in Turkey

The Guidelines on Use of Cookies (the “Guidelines”) was published by the Personal Data Protection Authority (the “Authority”) on June 20, 2022 which outlines good practice examples to guide data controllers. The Guidelines explain principles on use of cookies for data controllers to process data on legal grounds, use appropriate privacy notices and obtain explicit consent from data subject legally if and when required.

5 April 2023

Data subject rightsLitigation

Non-material Damage for Data Protection Breaches before the Irish and EU Courts – Clarity Ahead?

Data protection claims are in the dock. The Irish Circuit Court has temporarily halted proceedings for non-material damage claims pending clarity from decisions by the Court of Justice of the European Union on compensation for non-material damage in relation to 'mere upset' as a result of data privacy infringement.

4 April 2023

Legislation

The Digital Operational Resilience Act (DORA)

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) solves an important problem in the EU financial regulation, as it “aims to consolidate and upgrade ICT risk requirements as part of the operational risk requirements that have, up to this point, been addressed separately in various Union legal acts. While those acts covered the main categories of financial risk (e.g. credit risk, market risk, counterparty credit risk and liquidity risk, market conduct risk), they did not comprehensively tackle, at the time of their adoption, all components of operational resilience.”

4 April 2023

INPLP internal

A new member has joined the INPLP: Bartlett D. Morgan (Barbardos)

Chancery Advocates is an innovative and progressive dispute resolution set, focused on corporate and commercial matters. Chancery Advocates is solutions-oriented in outlook, and responsive to the need…

23 March 2023

INPLP internal

A new member has joined the INPLP: Laura Fannin (Ireland)

Hayes solicitors provides a comprehensive range of legal services to corporate, public and private clients in Ireland and internationally, especially in the UK. Their data protection and privacy team…

21 March 2023

The interplay between contractual relations and the GDPR’s security principle: A lesson from France

Security breaches and data loss are a core concern of any controller or processor. What possible avenues of redress can a Controller have when data losses are caused due to failings by its Processor? A recent case from the Lille Commercial Court in the context of the OVH data center fires tells us that the interplay between contractual commitments and the security obligations under Articles 82 and 32 of the GDPR can be a strategic one, both offering redress to controllers.

16 March 2023

Cloud & vendors

First European Report on the Use of Cloud Computing in the Public Sector From the Privacy Perspective

The Spanish DPA (AEPD) just published the conclusions of this first European report, coordinated by the European Data Protection Board, on the use of cloud in the public sector. This article summarizes its privacy and data protection implications.

15 March 2023

Enforcement & fines

The largest bank in Denmark - Danske Bank - is set to be fined DKK 10 million (approximately € 1.35 million)

The Danish Data Protection Authority has found that the largest bank in Denmark - Danske Bank - has failed to demonstrate that it has deleted personal data in accordance with GDPR and has therefore reported Danske Bank to the police and imposed a fine of DKK 10 million (approximately € 1.35 million) on the bank.

14 March 2023

Enforcement & fines

Data Controller Registry Requirement in Turkey

In accordance with Personal Data Protection Law No. 6698 (the “DPL”) and the Regulation on Data Controllers’ Registry (“Regulation”), data controllers must be registered with the Data Controllers’ Registry (“VERBIS”) in Turkey. There are certain thresholds in terms of employee number and financial figures for local data controllers to be subject to registration requirement but there is no threshold or other conditions applicable for foreign data controllers and they are subject to registration requirement in case they process personal data in Turkey and act as data controller.

10 March 2023

Do you think that a black van serves only transportation purposes? Well, maybe you want to reconsider your opinion!

How Cyprus found itself in the epicenter of the spy scandal in Greece

8 March 2023

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership