Another significant fine for the lack of adequate security measures on personal data was recently issued by a European Supervisory Authority (SA) to a controller responsible for private customers´ data. In the present case, the Swedish Supervisory Authority (IMY) imposed a fine of SEK 35 million (approx. EUR 2.9 million) to the insurance company Trygg-Hansa, […]
English Posts
Update of the Application for Approval and Guiding Principles for the Controller Binding Corporate Rules (BCR-C)
On the 20th of June 2023 the European Data Protection Board (EDPB) adopted the recommendations 01/2022 on the application for approval and on the elements and principles to be found in the Controller Binding Corporate Rules (BCRs or more specific BCR-C, Art. 47 GDPR). The decision to update some of the principles and guidelines to […]
India’s new Digital Personal Data Protection Act
On August 11, 2023, the President of India gave his assent to the Digital Personal Data Protection Act, 2023 (DPDP Act). India, as a tech-savvy nation with a booming digital economy, recognized the need for a structured data protection framework. It shall come into force on such date as the Central Government may notify in […]
The Long-Awaited U.S. Adequacy Decision Has Been Issued By The European Commission
Last year in Spring I mentioned in my article, Will Spring Bring a New EU-U.S. Privacy Shield Agreement?, how the EU and the U.S. were working to bring about an easier way to transfer data across the Atlantic. It was stated by Sean Heather, senior vice president of regulatory affairs for the U.S. Chamber of […]
Italian DPA imposes €240,000 fine on Benetton Group
In April 2023 the Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined the famous fashion brand Benetton with 240,000 Euros for violations of the GDPR related to marketing practices involving consumer data. The Garante’s investigation started in 2019 during the course of a scheduled investigation related to marketing activities and […]
Data Protection in (Mental) Health Apps
Mental health matters – and with global crises such as the Covid pandemic shaping our lives in the 2020s, everyone has been talking about it. A common piece of advice for people who are struggling with their mental health is to get help: Find a therapist or speak to a coach or counselor. However, these […]
Google Bard released in the EU after privacy concerns were addressed
Google has finally released its AI chatbot Bard in the European Union, after previously delaying the launch due to privacy concerns. The company said that it has addressed the concerns of the Irish Data Protection Commission (DPC), which is the lead regulator for Google’s data privacy practices in the EU. Bard can be considered Google’s […]
How the upcoming Cyber Resilience Act will impact privacy
One of the biggest challenges faced by data controllers today is the ever-looming risk of cyber attacks. Vulnerabilities in systems and devices can result in not only the loss of vast amounts of personal data and the potential for ransom demands but also the imposition of hefty fines by authorities for neglecting proper technical and […]
Why Strong Identity Verification is Vital in Data Protection
In the realm of data protection, identity verification plays a crucial role in safeguarding personal information. In this article, we explore a recent incident involving Vodafone España, shedding light on the significance of strong identity verification procedures. We’ll examine the case, discuss the consequences faced by Vodafone, and delve into best practices for verifying someone’s […]
Google is getting rid of passwords – Should your company do the same?
In the ever-evolving digital landscape, the traditional password has long been the gatekeeper of our online identities. From email accounts to social media profiles, passwords have been the first line of defense against unauthorized access. But recently Google has announced a paradigm shift in its approach to account security that could signal the beginning of […]
Insights from the BfDI on how to navigate Privacy Challenges in the Era of Generative AI
The Federal Commissioner for Data Protection and Freedom of Information of Germany, also known as BfDI (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit), recently published an opinion on the topic of Generative Artificial Intelligence (AI). In a previous article, we discussed Generative AI, which refers to artificial intelligence applications capable of generating new content, rather […]
Meta Platforms Faced with Largest Fine in GDPR History for Unlawful Personal Data Transfer to the United States
In a remarkable development that has sent shockwaves across the digital domain, Ireland’s Data Protection Commission (DPC) has imposed a €1.2 billion fine to conclude its long-term investigation into Meta Platforms Ireland Limited – formerly Facebook Ireland – over its data transfers from the EU/EEA to the United States. Let us take a look at […]
“Decreto Trasparenza”: Italian businesses to comply with new obligations for automated processing of employee data
In August 2022, Italy implemented the EU Directive No. 2019/1152 of the European Parliament and of the Council of 20 June 2019 on transparent and predictable working conditions in the European Union by adopting the new Legislative Decree 2022/104 (so called “Decreto Trasparenza”, meaning the “Transparency Decree”). What areas does the Decree cover? The new […]
ChatGPT is back in Italy – What changes have been made and what do users need to know?
OpenAI, the company behind the successful ChatGPT, has been in the spotlight recently due to privacy concerns, particularly in the European Union. Italy’s data protection authority, known as the Garante, imposed a temporary ban on the platform on 31 March, following reports of a data breach that affected ChatGPT users‘ conversations and payment information. As […]
New regime for data transfers from China to third countries
February 2023 was a busy month for China’s data protection regulator and supervisory authority – the Cyberspace Administration of China (CAC). This month marks the end of the six-month grace period for the Regulation of Security Assessment for Outbound Data Transfer (hereinafter referred to as the “Regulation”). With the Regulation now fully in force, companies […]