710 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

710 articles

CJEU RULING IN THE MATTER OF “SCHUFA” NOT ONLY AFFECTS CREDIT SCORING (C-634/21)

In December 2023, the European Court of Justice (CJEU) had to decide yet another case that will have a significant effect beyond the core facts of the case. The ruling will likely affect not only credit scoring agencies but every sector and controller that works with some probability analysis to predict and ultimately influence data subjects’ decisions or may legally affect them otherwise.

25 April 2024

Data subject rights

Does the GDPR trump the Bible? Probably not, but it might trump religious administration

Depending on where you live, religious ceremonies can trigger a certain degree of administrative follow-up. In Belgium – like in many other Member States - parishes of the Catholic Church keep baptismal records indicating who underwent this particular sacrament. But what if a baptised person no longer wants their records to be kept? A recent decision from the Belgian data protection authority on the right to be forgotten may have far reaching consequences.

23 April 2024

Legislation

Turkish Personal Data Protection Law 2.0 (“PDPL 2.0”)

The first step has been taken in the long-awaited harmonisation of the Turkish Data Protection Law with the GDPR. With this step, the regulations of the Law, especially on data transfer and processing of sensitive data, have been made more applicable for data controllers. In addition, we have summarised the changes made, although more major changes are expected in the coming periods.

18 April 2024

International transfersLegislation

The European Commission confirms that Argentina has adequate legislation for the international transfer of personal data

Argentina, along with 10 other countries, receives ratification from the European Union on its adequacy note for the international transfer of personal data from Europe to these countries. After a process that lasted a few years, and which was temporarily interrupted by some pending decisions of the European courts, Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Ma, Israel, Jersey, New Zealand, Switzerland and Uruguay received confirmation of their adequacy note.

16 April 2024

AI & automation

The Brazilian Data Protection Authority´s Regulatory Sandbox Pilot Program on Artificial Intelligence and Data Protection: A Brief Overview.

The current debates on artificial intelligence create a timely opportunity for the development of mechanisms that balance the promotion of innovation and the protection of fundamental rights, such as privacy and data protection. This article presents a brief overview of The Brazilian Data Protection Authority´s Regulatory Sandbox Pilot Program on Artificial Intelligence and Data Protection as a potencial regulatory tool for artificial intelligence.

11 April 2024

Employment data

Further processing videosurveillance recordings for assessing performance of employees is inadmissible.

Bulgarian Personal Data Protection Commission has issued an opinion on the admissibility of processing video surveillance records with sound for the purposes of assessing the personal performance of the employees and for determining their bonuses. The opinion of the commission is that such further processing of the personal data does not comply with the requirements of Art. 6, para. 4 of GDPR and therefore is inadmissible.

20 March 2024

Litigation

CJEU increases the requirements for claiming non-material damage within the meaning of the GDPR

Whether or not (nearly) any and all violation of the General Data Protection Regulation (GDPR) entitles data subjects to non-material damages has been the subject of substantial debate. On 14 December 2023 the Court of Justice of the European Union (CJEU) issued a first decision on this topic holding, that such damages may in principle be claimed for all violations, as the GDPR not only does not require a ‘de minimis threshold’, but even pre-cludes national legislation or a national practice which sets such threshold. This caused the data protection community to predict a wave of incoming data-protection related litigation. 1 month and 11 days later, this has changed yet again.

14 March 2024

INPLP internal

INPLP Activity Report 2023 published

The past year was a success for the INPLP, marked by robust collaboration and network growth. The annual conference in Dublin, hosted by Rob Corbet (Arthur Cox), was a key milestone. Our priorities included strengthening collaboration, facilitating knowledge transfer, and expanding the network.

13 March 2024

Legislation

Extraterritorial Implications of Turkish Data Protection Legislation

This article explores the regulatory landscape for data controllers located outside Turkey and their obligations under the Turkish Data Protection Law.

16 February 2024

Violation of personal data protection by the City of Trnava as the Controller of personal data

In a recent decision by the Office for Personal Data Protection, we witnessed a case of violation of the Personal Data Protection Act and GDPR. The breach of personal data protection concerned the Controller, who unlawfully disclosed personal data of 47 affected individuals, including the applicant, in a resolution of the City Council of Trnava (“Resolution”).

13 February 2024

Breach notification

A thin line between a typo and a data breach: A case study in enhancing data security practices

In a recent case, the Serbian Commissioner for Information of Public Importance and Personal Data Protection issued a cautionary notice to a bank, shedding light on its procedures for collecting and managing clients' email addresses for communication purposes.

9 February 2024

AI & automationLegislation

Europe’s AI Act: a new role for the Dutch Data Protection Authority?

"The genie is out of the bottle. We need to move forward on artificial intelligence development but we also need to be mindful of its very real dangers. I fear that AI may replace humans altogether." This quote from Stephen Hawking in 2017 is more relevant today than ever.

7 February 2024

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership