707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

Data retention overturned? Aftermath to the private sector?

The European Court of Justice has not just brought its settled case-law on data retention in line. Furthermore the ECJ also provides a blueprint on how data retention can legally: “Quick freeze”.

3 June 2022

Enforcement & fines

Argentina's Data Protection Authority publishes its 2021 Annual Report

Argentina’s data protection authority, the Agency of Access to Public Information, i.e. the controlling authority pursuant to Data Protection Law No. 25,326, recently published its 2021 Annual Report on the protection of personal data.

1 June 2022

Can audio surveillance be justified?

At the end of 2021, the Estonian Data Protection Inspectorate (DPA) issued a precept to a gas station using audio surveillance in its service stations, requiring them to, among other things, stop using audio surveillance. In the DPA’s opinion, audio surveillance could only be justified by very exceptional circumstances.

30 May 2022

Legislation

China’s New Regulations on Controlling Algorithmic Recommendations in Applications

The Cyberspace Administration of China (CAC) has circulated the Regulations on the Management of Algorithm Recommendations for Internet Information Services Provisions") since August 2021. The Regulations has been put in effect on 1 Mar 2022. The enactment of the Regulations certainly has good intention and in the positive direction. However, to follow the Regulations, some data profiling technologies might be needed. Additional considerations might be needed to ensure these technologies are used in compliance with other legal requirements.

27 May 2022

Legislation

Three criteria for the elaboration of the Regulation to the Ecuadorian data protection law

Ecuador continues to build its personal data protection system, for which those responsible for developing the regulation must properly understand and apply the criteria of the regulatory model that was assumed with the Personal Data Protection Law. Abstraction and flexibility; minimum administrative requirements and ex post control are key criteria to consider.

25 May 2022

Enforcement & fines

Unpacking the New Privacy Regime in India: The When, Who, What, and How?

The new Indian Privacy law mimics GDPR when it requires a ‘privacy by design’ architecture, sets up a central data protection authority, and mandates heavy fines for non-compliance! And, if this new bill has even a fraction of the seminal impact that GDPR had on European businesses back in 2016, we are looking at a law that will fundamentally change the way business is conducted in India. This article answers some basic questions about the new Indian law.

23 May 2022

Enforcement & finesAI & automation

The destruction of the algorithm: the new sanction for breaching the GDPR?

Since 2019, The Federlñ Trade Commission (FTC) has been seeking ways to punish the new digital unfair practices, consisting on illegally obtaining personal information from Internet users and exploit it with artificial intelligence tools. In this case, the punishment consists on what is called “the destruction of the algorithm”.

20 May 2022

Personal data protection in Ecuador, a few steps forward

The process of designating the Personal Data Protection Authority, the next milestone in the construction of the national data protection system in Ecuador, begins.

18 May 2022

Employment data

CCTV monitoring and the practice of the Hungarian DPA

CCTV monitoring has long been a key field for the Hungarian DPA. The article summarizes the DPA’s practice, as well as the related latests updates.

16 May 2022

Expensive update for Tesla: Car seller liable for failing to provide essential information

In September 2021, Munich’s regional court (the LG Munich) awarded a plaintiff 130,446 euros in damages. A vehicle purchased by the plaintiff – a Tesla Model X P100D – was no longer height-adjustable after its owner performed a software update. This article examines the obligations of a manufacturer of automobiles ("connected cars") prior to rolling out and installation of over-the-air (OTA) updates and the obligations to provide information regarding functions or changes to functions and the legality of certain features.

13 May 2022

International transfers

Schrems II resolved? Unpacking the EU-US Trans-Atlantic Data Privacy Framework

The United States and the European Commission have agreed in principle to a new Trans-Atlantic Data Privacy Framework (the ‘Framework’) to foster EU-US data flows and address the concerns raised by the Court of Justice of the European Union (‘CJEU’) in the now infamous Schrems II decision. This is highly welcomed by businesses on both sides of the Atlantic, with continued data flows between the two regions underpinning €900 billion in cross-border commerce each year.

11 May 2022

International transfers

Important concepts in cross-border transfer of data from China

The Data Security Law (“DSL”) and Personal Information Protection Law (“PIPL”) of mainland China, which came into force last year, play an important role in regulating data privacy in mainland China, alongside the existing Cybersecurity Law (“CSL”). These three laws contain important rules that companies need to pay attention to and follow when dealing with data collected, used or transferred, in particular when the transfer is from mainland China to other jurisdictions. This article focuses on the latter.

9 May 2022

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership