Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

710 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

710 articles
Data subject rights

EU Regulators Elevate the Threshold of Compliance around Data Subject Access Requests.

The European Data Protection Board and the Irish Data Protection Commission have recently published guidelines for businesses in relation to Data Subject Access Requests ("DSARs"). Both sets of guidlines signal that high standards of compliance are expected from controllers when handling DSARs. The publications are a key indicator that DSARs are very much in the spotlight from a regulatory enforcement perspective.

4 November 2022

International transfers

China's Measures for Security Assessment for Outbound Data Transfer

China’s Measures for Security Assessment for Outbound Data Transfer came into effect on 1 Sep 2022. The Measures require risk assessment, data transfer agreement and continuous monitoring to be conducted for organizations who transfer data (not just personal data but all data that maybe relevant to national security) out of China. An application to the Cybersecurity Administration and its approval are also needed for organizations meeting certain criteria.

3 November 2022

Ecuadorian Digital Transformation Policy: Data Protection implications

The current Ecuadorian government is about to issue a new digital transformation policy. Once the working tables have closed, the draft version of the policy brings some important issues that have relevant personal data protection implications as even the large-scale processing of sensitive data is being considered. This article addresses these challenges for the protection of personal data from a cross-cutting perspective to the policy and with emphasis on certain (vertical) points of the policy.

28 October 2022

Marketing & cookies

The CNIL reminds us of the rules on e-marketing and the rights of individuals

Companies have long used e-marketing to facilitate their development and attract new customers, and in our digital world, reliance on such strategies is ever-increasing. As e-marketing strategies involve the processing of personal data, unsurprisingly, e-marketing is subject to strict regulations, which can lead to non-negligible sanctions if breaches occur. On August 17th 2022 the French Data Protection Supervisory Authority, the Commission Nationale de l'Informatique et des Libertés ("CNIL"), issued a 600,000 Euro fine against French hotel group, ACCOR for carrying out e-marketing without data subject consent, thus violating customer and prospect rights. The case is interesting in that it covers both GDPR and e-privacy regulation breaches and shows the interesting cross-over between the two pieces of legislation.

26 October 2022

The Baltic DPAs to carry out joint supervision in the field of short-term rental of vehicles

This summer, the data protection authorities (DPAs) of the three Baltic States – Estonia, Latvia and Lithuania – announced that they will carry out preventive joint supervision in the field of short-term rental of vehicles (e.g., electric scooters). The purpose of the joint supervision is to develop recommendations to improve the processing and protection of personal data in the specified field.

24 October 2022

AI & automation

The Metaverse and privacy: guidance by the spanish data protection authority

The Metaverse uses a variety of technologies such as AR and VR, DLTs (Blockchain), AI, IoT, IoRT, 5G, that enable the creation of immersive virtual environments and generate a multisensory experience for the user within the framework of web 3.0. Brands, firms and companies are entering the Metaverse with impetus. As the Spanish DPA (AEPD) in a recent article put it: “The current social and technical situation has created the ideal context for the Metaverse’s development and expansion, translating human experiences into digital data processing through simulations. However, the processing of this personal data is completely real”. This article analyzes its privacy and data protection implications.

17 October 2022

Legislation

Data Protection Law and the culture change in the laboral routines of companies: the use of the data protection theme as a strategic tool

Despite being clear that Brazil’s Data Protection Law (”LGPD”) applies to employment relationships, it is not usual to discuss the practical conduct that should already have been adopted by Brazilian companies in order to be compliant with the legislation from a labor standpoint. The lack of attention to such internal compliance can be harmful, not only from a data protection point of view, but also from a strategic business development point of view.

4 October 2022

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership