Privacy and Cybersecurity Law

JULY 26, 2021

On July 5, 2021, the Italian supervisory authority (“ Garante ”) published an injunction against a company operating a food delivery app (“ Company ”) over the processing of riders’ personal data with respect to the use of algorithms for the management of the orders. Retention period. The need for a DPIA.

Personal data 52

Personal data GDPR e-Delivery Communications 52

Hunton Privacy

JANUARY 19, 2024

In line with the CCPA and other state privacy laws, the New Jersey law broadly defines “sale” as the disclosure of personal data to a third party for “monetary or other valuable consideration.” The law also requires controllers to specify the express purposes for which personal data is processed.

Privacy 97

Privacy Personal data Sales Risk 97

DLA Piper Privacy Matters

APRIL 27, 2023

In the course of this cyber-attack, personal data – mainly tax and social security information – of approximately 4 million Bulgarian citizens (or approximately 6 million citizens in total, including foreign citizens) had been accessed and published on the Internet.

Personal data 52

Personal data GDPR Access Data breaches 52

Hunton Privacy

MARCH 13, 2024

The thresholds are closer to those of, e.g. , Delaware’s Personal Data Privacy Act (H.B. Controller Obligations Similar to most of the comprehensive state privacy laws, SB 255 contains fundamental data minimization, purpose limitation and data protection requirements.

Privacy 120

Privacy Personal data Sales Risk 120

Hunton Privacy

APRIL 18, 2023

SB 5’s protections would apply to residents of Indiana who act for a personal, family or household purpose, with express exemption for individuals acting in a commercial or employment context.

Privacy 132

Privacy Personal data Sales Insurance 132

DLA Piper Privacy Matters

SEPTEMBER 17, 2018

30 of 2018 on the Personal Data Protection Law (PDPL). It will provide individuals with rights in relation to how their personal data can be collected, processed and stored. The PDPL also imposes new obligations upon businesses to ensure that the personal data they collect is kept secure. REGULATION.

Personal data 49

Personal data GDPR Compliance Risk 49

IT Governance

MARCH 30, 2023

Article 17 of the GDPR (General Data Protection Regulation) plays a distinctive yet essential role in data protection law. It enshrines “the right to erasure” (sometimes referred to as “the right to be forgotten”), which allows people to request that an organisation deletes any personal data related to them.

GDPR 96

GDPR Personal data Compliance Government 96

Security Affairs

JULY 4, 2024

Brazil’s data protection authority, Autoridade Nacional de Proteção de Dados (ANPD), has imposed a temporary ban on Meta from processing users’ personal data for training its artificial intelligence (AI) models. ” reads the announcement published by ANPD.

Artificial Intelligence 109

Artificial Intelligence Personal data Privacy Compliance 109

DLA Piper Privacy Matters

JUNE 1, 2022

Organisations engaging in cross border transfers of personal data may now rely on the Recommended Model Contractual Clauses (RMCs), recently published by the Privacy Commissioner for Personal Data (PCPD). The two sets of RMCs are intended for controller to controller transfers, and controller to processor transfers.

Personal data 97

Personal data Compliance Data breaches Privacy 97

Hunton Privacy

MARCH 24, 2022

Similar to the CPA and VCDPA, the UCPA contains exemptions for covered entities, business associates and protected health information subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and financial institutions or personal data subject to the Gramm-Leach-Bliley Act (“GLB”).

Privacy 113

Privacy Personal data B2B Sales 113

AIIM

APRIL 13, 2021

Technology and apps that are helping to prevent illness, accidents, and crime also happen to collect a vast amount of personal data. The AIIM community has been engaged in the personal data privacy conversation for a while now.

Data Privacy 170

Data Privacy Privacy Artificial Intelligence Personal data 170

Schneier on Security

MARCH 2, 2020

Privacy International has the details : Key facts: Despite Facebook claim, "Download Your Information" doesn't provide users with a list of all advertisers who uploaded a list with their personal data. As a user this means you can't exercise your rights under GDPR because you don't know which companies have uploaded data to Facebook.

Personal data 136

Personal data GDPR Data collection Privacy 136

DLA Piper Privacy Matters

JANUARY 24, 2019

The Supplementary Rules bridge several differences between the two data protection systems and provide with additional safeguards. These Supplementary Rules are binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.

Personal data 61

Personal data GDPR Paper Access 61

Hunton Privacy

MAY 19, 2021

In this context, the Dutch DPA also found that the online platform did not have establishments in the EU and did not appoint a representative, making it difficult for data subject to exercise their data protection rights.

Personal data 114

Personal data GDPR Risk IT 114

HL Chronicle of Data Protection

JULY 7, 2020

The Dutch Data Protection Authority (DPA) issued a EUR 830,000 (approximately USD 937,000) fine against the Dutch Credit Registration Bureau (BKR) for violating data subject rights. The fine stems from BKR’s practice of charging fees and discouraging individuals who wanted to access their personal data.

GDPR 112

GDPR Personal data Data collection Access 112

Hunton Privacy

APRIL 28, 2023

Beginning January 1, 2025, controllers must allow a consumer to opt out of targeted advertising and the sale of their personal data through an opt-out preference signal. Consumer” means an individual who is a Montana resident and does not include an individual acting in a commercial or employment context.

Privacy 58

Privacy Personal data Sales Data Privacy 58

Hunton Privacy

JANUARY 2, 2019

On December 28, 2018, the French Data Protection Authority (the “CNIL”) published guidance regarding the conditions to be met by organizations in order to lawfully share personal data with business partners or other third parties, such as data brokers.

Personal data 109

Personal data Data collection Marketing Communications 109

Hunton Privacy

NOVEMBER 7, 2022

On November 2, 2022, the ICO issued to the UK Department for Education (“ DfE ”) a formal reprimand following an investigation into the sharing of personal data stored on the Learning Records Service (“ LRS ”), a database which provides a record of pupils’ qualifications that the DfE has overall responsibility for.

Education 102

Education Personal data Access IT 102

DLA Piper Privacy Matters

JULY 8, 2020

The fine has been imposed due to the fact that BKR’s procedure for data subjects to obtain access to their personal data was not in line with GDPR. Article 12(2) GDPR states that the controller shall facilitate the exercise of, inter alia, the right of access (Article 15 GDPR).

Access 98

Access GDPR Personal data IT 98

Hunton Privacy

NOVEMBER 1, 2022

Right to Request to Exercise Personal Data Rights (Rule 4.02 – Rule 4.07; 6.11). The proposed regulation provides the people of Colorado with a mechanism to protect their personal data rights by making requests directly to data controllers, or businesses who control their personal data.

Privacy 78

Privacy Personal data Data collection Compliance 78

Data Protection Report

JUNE 6, 2023

This MPN and its accompanying annexes set out details of TikTok’s non-compliance with data protection law and the reasons why the ICO considered that a fine was appropriate. The requirement to detail “recipient or categories of recipients of the personal data” (Art 13(1)(e)): Vague, broad lists of categories of recipients are not sufficient.

Privacy 97

Privacy GDPR Personal data Compliance 97

DLA Piper Privacy Matters

JULY 18, 2018

An adequacy decision is a decision establishing that a third country provides a comparable level of protection of personal data to that in the European Union. Adequacy decision is one of the tools provided for under the General Data Protection Regulation to transfer personal data from the EU to third countries.

Personal data 40

Personal data GDPR Access IT 40

Hunton Privacy

MARCH 13, 2021

These tools are available on most smartphones and other devices and collect significant amounts of personal data, such as through user commands. In addition, VVAs require a terminal device equipped with a microphone and transfer data to remote service.

Personal data 105

Personal data Compliance GDPR Privacy 105

Data Protector

AUGUST 17, 2020

Some UK organisations will inevitably have to follow all the EU’s data protection rules because they will continue to process the personal data of individuals in the EU. Organisations have also spent many hours working out what legal basis each business process should rely on when personal data is processed.

Privacy 156

Privacy GDPR Personal data Computer and Electronics 156

Data Protection Report

JUNE 21, 2023

The new law also gives controllers certain rights to use the data, including to “prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity” as well as to “conduct internal research to develop, improve, or repair products, services, or technology.”

Privacy 84

Privacy Personal data Sales Retail 84

DLA Piper Privacy Matters

JULY 23, 2019

The European Data Protection Board ( “EDPB” ) has published guidelines on the processing of personal data through video devices (the “ Guidelines “) (currently subject to a public consultation process). technical and organisational measures required for such data processing.

Personal data 40

Personal data GDPR Access Marketing 40

DLA Piper Privacy Matters

DECEMBER 3, 2021

45 of 2021 on the Protection of Personal Data Protection (“ PDPL ”), which was issued on 26 September 2021. Reassuringly, the PDPL does not contain any major divergences from other well-known data protection regimes, including the GDPR. What does the PDPL cover and who does it apply to? Definitions. Territoriality. Exceptions.

Personal data 105

Personal data Data breaches GDPR Compliance 105

Data Protection Report

JUNE 17, 2020

This judgement concerns the legality of the European Commission approved Standard Contractual Clauses ( SCCs ) which many organisations rely on to transfer personal data outside of the UK and the European Economic Area ( EEA ), particularly in relation to outsourcing services.

Personal data 119

Personal data Communications Access GDPR 119

Data Protector

AUGUST 17, 2020

It is also possible that, in the near future, the EU will publish revised sets of Standard Contractual Clauses to replace the existing SCCs in a bold effort to ensure that flows of personal data outside the European Union remain suitably protected. To expect them to commission a similar exercise so soon is cruel (and costly).

GDPR 120

GDPR Personal data Government Privacy 120

Hunton Privacy

JULY 12, 2023

Consumer” means a natural person who resides in Oregon and acts in any capacity other than in a commercial or employment context. Thus, like most other comprehensive state privacy laws, employee data and business-to-business data are excluded from the scope of the OCPA.

Privacy 52

Privacy Personal data Insurance Sales 52

Data Protection Report

SEPTEMBER 11, 2024

The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP) announced a fine of €290 million on Uber Technologies Inc. The fine relates to the transfer of drivers’ personal data to the US. Did transfers of personal data to the US take place? However, driver personal data is stored by UTI.

GDPR 92

GDPR Personal data Compliance Artificial Intelligence 92

Hunton Privacy

APRIL 25, 2022

Data Protection Assessments (“DPA”) – The Department wants to clarify the form, content and circumstances of data protection assessments required by the CPA, and questions if it should follow any existing model, such as the EU General Data Protection Regulation, and acknowledge interoperability of DPAs conducted for another regime.

Privacy 110

Privacy Personal data Sales Compliance 110

DLA Piper Privacy Matters

AUGUST 3, 2020

The amended APPI could have a significant impact on companies that handle personal information. Under the current APPI, data subjects have the right to request access, correction, deletion and cessation of the use of their personal data that is or is intended to be retained for six months or more (the “ Rights of Data Subjects “).

Personal data 122

Personal data Data breaches Compliance Risk 122

Hunton Privacy

JULY 9, 2020

The New DP Law will apply to companies incorporated in the DIFC, regardless of where processing takes place, or companies that, whilst incorporated elsewhere, process personal data in the DIFC as part of stable arrangements (other than occasional processing). For more detail, read the full client alert.

Personal data 127

Personal data GDPR Data breaches Compliance 127

Hunton Privacy

JULY 20, 2023

On June 30, 2023, the Delaware House of Representatives passed the Delaware Personal Data Privacy Act ( H.B. The DPDPA’s protections would apply to Delaware residents who act for a personal or household purpose, with express exemption for individuals acting in a commercial or employment context.

Privacy 52

Privacy Personal data Sales Risk 52

Hunton Privacy

FEBRUARY 6, 2013

On February 5, 2013, Singapore’s new data protection agency, the Personal Data Protection Commission , published its first consultation paper (the “Paper”) articulating proposals for a data protection regulation. Transfer of Personal Data Outside of Singapore. Access and Correction.

Personal data 40

Personal data Paper Access IT 40

Hunton Privacy

FEBRUARY 28, 2013

Following up on its February 5, 2013 consultation paper , Singapore’s Personal Data Protection Commission has issued two additional public consultation papers concerning the guidelines the Commission is empowered to issue under the new data protection law.

Personal data 40

Personal data Paper Analytics Access 40