EU Regulators Define Data Transfers

Photo of Cédric BurtonPhoto of Jan DhontPhoto of Laura De BoelPhoto of Rossana FolBy Cédric Burton, Jan Dhont, Laura De Boel and Rossana Fol on Posted in European Union, Privacy, Regulatory

They State That Direct Collection of Personal Data by Non-EU Companies Is Not a “Data Transfer” Under the GDPR

On November 18, 2021, the European Data Protection Board (EDPB) issued guidelines (Guidelines) that—for the first time—clarify the notion of “data transfer.” Departing from common understanding, the EDPB has determined that there is no data transfer where EU data subjects disclose on their own initiative personal data directly to a non-EU company. Consequently, there is no need to implement a transfer tool in such situations. The Guidelines are open to public consultation until the end of January 2022. Continue Reading

CNIL Issues Guidance on Alternatives to Third-Party Cookies

Photo of Alexandre LépinePhoto of Jan DhontBy Alexandre Lépine and Jan Dhont on Posted in European Union, Privacy, Regulatory

On October 13, 2021, the French data protection authority (the CNIL) issued a short note (the “Note,” in French) on technologies such as fingerprinting, unique identifiers, and cohort-targeting, developed to replace traditional third-party cookies.

While the CNIL acknowledges that some of these technologies are less privacy invasive than third-party cookies, it stresses that the consent and transparency requirements also apply to these technologies. Continue Reading

California Privacy Protection Agency Issues Invitation for Preliminary Comments on Proposed Rulemaking Under the California Privacy Rights Act

Photo of Edward HolmanPhoto of Tracy ShapiroBy Edward Holman, Tracy Shapiro and David Cornell on Posted in Uncategorized

The California Privacy Protection Agency (CPPA), the newly formed state agency responsible for implementing the California Privacy Rights Act (CPRA), recently posted its first invitation for public comment on proposed rulemaking activities under the CPRA. Here is what you need to know: Continue Reading

Don’t Forget to Use the New SCCs to Transfer EU Personal Data as of September 27, 2021

Photo of Laura De BoelPhoto of Rossana FolPhoto of Cédric BurtonBy Laura De Boel, Rossana Fol and Cédric Burton on Posted in Cybersecurity, Privacy, Regulatory

As of September 27, 2021, companies relying on Standard Contractual Clauses (SCCs) to transfer personal data outside the European Union (EU) must use the new Standard Contractual Clauses (New SCCs) when signing data processing agreements. As a result, it is time to update template data processing agreements to ensure that your company can meet this deadline. Continue Reading

CJEU Confirms Exceptions to One-Stop-Shop Mechanism Under the GDPR

Photo of Jan DhontPhoto of Nikolaos TheodorakisBy Jan Dhont, Nikolaos Theodorakis and Joanna Juzak on Posted in European Union, Privacy

On June 15, 2021, the Court of Justice of the European Union (CJEU) confirmed[1] that non-leading supervisory authorities (SAs) can initiate national judicial proceedings concerning cross-border data processing in two circumstances:[2] i) where there is an “urgent need” to act, or ii) if the case has a local impact. Continue Reading

LexBlog

We use cookies on our site to analyze traffic, enhance your experience, and provide you with tailored content. For more information or to opt-out, visit our privacy policy.

I agree