Judit Garrido-Fontova and Alex Dittel give an update on recent developments in privacy law as part of Kemp Little’s KLick DPO service, including:

1. Data protection impact assessment materials including EDPS’ report on EU institutions’ use of DPIAs (link), EDPS infographic (link) and video (link) and CNIL’s DPIA guidance for IOT devices (link).
2. The Spanish AEPD explains misconceptions about biometric data (link).
3. The latest on the e-privacy draft including progress report (link) and proposal (link).
4. Smart-TV sector investigation by the German federal competition authority (link).
5. EDPS data protection flowchart and joint controller status (link).
6. California’s California Consumer Privacy Act enforced since 1 July 2020 (link), the third amendment to the CCPA released on 1 June 2020 (link), impact of adtech “service providers” and the brand new California Privacy Rights and Enforcement Act 2020 proposal (CPRA) (link).
7. French administrative court Le Conseil d’État strikes prohibition on cookie walls from CNIL’s cookie guidance (link).
8. Data transfers: Privacy Shield invalided by the ECJ “again” (link). UK’s adequacy update and readiness at the end of the transition period (link). FTC settlement focuses on those other Privacy Shield Framework requirements (link).
9. EDPS strategy 2020-2024 (link).
10. Mobile phone data extraction by police forces in England and Wales, investigation report (link).
11. European Union Agency for Fundamental Rights (FRA) and EDPS are increasing cooperation (link).
12. South Africa’s Protection of Personal Information Act 4 of 2013 (POPI) in force since 1 July 2020 (link).
13. Online platforms and digital advertising market study by UK’s competition authority (link).
14. Covid-19 related: Irish COVID tracker app DPIA (link) and privacy notice (link). National Association of Attorneys General in the US send a letter to Apple and Google (link). New Zeeland leak (link). ICO on visitor details (link).
15. Credit referencing agency Stichting Bureau Krediet Registration fined €830,000 by Dutch Autoriteit Persoonsgegevens for charging a fee for access to credit records (link).
16. Fines for breach of the security principle: The Spanish AEPD fined Iberdrola Clientes €24,000 for breach of the security principle (link). Norwegian Datatilsynet proposes a fine of approx. €111,680 Hospital Østfold for breach of the security principle. The highest GDPR fine in Hungary of €285,000 imposed on Digi Távközlési Szolgáltató Kft. for failing to secure a website security vulnerability (link).
17. EDPS opinion on the European strategy for data of European institutions (link).
18. Activity reports from the CNIL (link), the Irish DPC (link) and the EDPB (link).

Also available on Cybersecurity Conferences.

• Share this blog

• Twitter
• Facebook
• Linkedin