707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

Enforcement of the GPDR in Luxembourg: an issue at stake?

Max Schrems and his organisation NOYB (None Of Your Business) have recently begun a new battle, taking place in Luxembourg! Legal proceedings have been issued against two decisions of the Luxemburg Data Protection Authority (the “CNPD”). These decisions dismissed two complaints lodged against two different US-based data controllers, Apollo and RocketReach. These claims are currently pending before the Luxembourg Administrative Court.

14 May 2021

Legislation

Amendment on Enforcement Rules of the Japanese Privacy Law

The amendment on Enforcement Rules for the Act on the Protection of Personal Information was promulgated on March 26 of this year. The amended enforcement rules will be enforced on April 1st, 2022 together with the amended Act on the Protection of Personal Information. This article introduces the main points of the amended Enforcement Rules.

12 May 2021

Monaco: Overview Of The Prior Control Activity Of The Personal Data Protection Authority (“Ccin”) Since 2020

According to the current Monegasque legislation, the automated processing of personal data is subject to the control of the CCIN prior to its implementation. Here is an overview of the authorisations and prior notices of the CCIN concerning automated processing implemented in Monaco in the private and public sectors since 2020.

12 May 2021

INPLP internal

A new member has joined the INPLP: Peter Hense (Germany)

Spirit Legal is based in Leipzig, although they advise domestic and foreign businesses with an international focus, regardless of their location. They advise established business owners on capital inc…

11 May 2021

German Federal Cartel Office vs. Facebook – The one who wins the battle might not win the war

The dispute between the German Federal Cartel Office and Facebook continues before the ECJ. This may mean that business models of the digital economy will change in Europe.

10 May 2021

International transfersLegislation

The challenges related to the transfer of personal data from the perspective of the new Law on Personal Data Protection

The purpose of this Article is to provide an overview of the legal mechanisms by which personal data can be transferred from the Republic of North Macedonia.

7 May 2021

Data subject rightsBreach notification

Personal data breach resulting from data subjects' mistakes have to be notified!

The Polish Data Protection Authority has imposed on WARTA. S.A, a Polish insurance and reinsurance company, a new administrative sanction in the amount of c.a. EUR 20.000,00 for failure to notify a personal data breach that resulted from data subject’s mistake.

4 May 2021

Health data

Scientific research using health data: Is the GDPR in contradiction with FAIR principles?

Medical research is becoming increasingly reliant on the analysis of large amounts of biologically derived data. Greater scientific and societal value are achievable if these research data are processed in accordance with the FAIR – Findable, Accessible, Interoperable and Reusable – principles. Contemporary scientific research within the EU is guided by these principles; for example, the European Cloud Initiative. They ensure verifiability, transparency and trustworthiness of research, as well as the availability of the raw data for further scientific research. The implementation of FAIR data goes hand-in-hand with the principle that research data must be “as Open as possible and as closed as necessary”.

30 April 2021

Cloud & vendors

EDPB’s Guidelines on the concepts of controller and processor in the GDPR

The European Data Protection Board issued the Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 1.0, adopted on 02 September 2020. We made a selection of a number of paragraphs which offer relevant insight for groups of companies:

27 April 2021

Enforcement & fines

GDPR Fines: Ramping up and DPAs Setting standards

European Supervisory Authorities imposed more than €158m in fines under the GDPR during 2020; close to a 40% increase on the previous 20-month period. This brings the total amount of fines to more than €272m in the period from May 2018 to end 2020. Businesses now have greater insight into, and detail about, the amount of potential financial penalties for failing to comply with the GDPR.

23 April 2021

When is the right to privacy more important than the right to life itself?

In Israel, as in many other countries, the coronavirus is rampant. There are various strategies available to contend with this epidemic, almost all of which impinge on one’s autonomy and privacy. The question being asked is “when the right to privacy is more important than the right to life?”

20 April 2021

Breach notificationHealth data

Data breaches in healthcare due to human errors: two hospitals and a Local Health Administration Unit sanctioned by the Italian Data Protection Authority

Data breaches are violations of database security that may result not only from cyber attacks, as it is usually assumed, but also from human errors committed by persons who, under the direct authority of the data controller or the data processor, are authorized to process personal data. The absence of corporate procedures for the proper handling of patient data within a healthcare facility throughout their lifecycle or the inadequacy of these policies to cover all possible cases, in particular, can lead to material errors being made by the staff, such as the communication of patient's data to persons other than the data subject or to unauthorised persons. Such breaches in the health sector have a potentially very serious and detrimental impact on the rights of data subjects, given the special nature of the data processed, which consist of information on a person's state of health. This issue has been the subject of three recent decisions of the Italian Data Protection Authority which are briefly described in this news.

13 April 2021

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership