Every child wakes up with an extra little twinkle in their eye on Christmas morning. Whether that twinkle comes on the 24th of December when the Christ Child visits in Southern Germany or on the 25th when Santa leaves goodies for all the good girls and boys throughout the US. The magic of Christmas is […]
GDPR
What does the Data Privacy Framework Self-Certification mean for your company?
Let’s take a closer look at what the decision to self-certify under the DPF means for your company. In terms of costs, other then the applicable fees, you need to consider administrative and organizational costs aimed at ensuring accountability while implementing mechanisms to allow data subjects the exercise of their rights. We are providing you […]
Does your Company Need a Data Privacy Framework Certification?
Well, it depends. Let me begin by providing an overview of the Data Privacy Framework as adopted on July 11th 2023 and follow by providing my opinion on whether and for which companies a certification under the new framework would add value. The EU-US Data Privacy Framework in the Big Picture of the Adequacy Decisions […]
Access to employee emails: A delicate balance between business needs and privacy rights
In the landscape of corporate operations, accessing employee emails may sometimes feel like a necessity for companies. Whether to investigate suspected misconduct of current employees, facilitate operational management during an employee’s prolonged absence, or streamline the transition after an employee departs, the reasons can be varied. However, this task is not straightforward as there are […]
CJEU rules on Right of Access and first copy of personal data: what companies should know
The Court of Justice of the European Union (CJEU) issued a recent ruling in case C-307/22, highlighting important considerations regarding the extent of the right of access under Article 15 of the GDPR. This ruling carries significant implications for companies that process personal data under the GDPR. It asserts that the GDPR right of access […]
New Data Protection Law in Saudi Arabia
Individual privacy in Saudi Arabia and the protection of personal data have long fallen under the general provisions of Saudi law and not under the specific provisions on „data protection“ or „data security“. In the absence of specific laws, Islamic law generally applies in Saudi Arabia. Thus, Saudi courts dealt with data protection issues according […]
WhatsApp switches its legal basis to „Legitimate Interest“ due to severe sanctions
It is by far not the first time that Meta and its platforms had to face scrutiny in terms of their privacy policy. This time around, the Irish Data Protection Commission (DPC) sanctioned WhatsApp with a fine of 5.5 million Euros due to the lack of a legitimate legal basis for processing personal data in […]
Overcoming Challenges in Developing a GDPR-Compliant Data Deletion Framework
The General Data Protection Regulation (GDPR) has transformed the way companies manage personal data, introducing stringent requirements for data deletion. In accordance with the GDPR, personal data cannot be stored indefinitely, and companies must develop comprehensive deletion frameworks as explained in detail here. However, creating and implementing these frameworks presents significant challenges for organizations. In […]
Roadmap to the Development of a Deletion Framework
A data deletion framework refers to a structured set of guidelines and procedures governing an organization’s adherence to deletion obligations according to data protection and statutory laws, as well as its processes for managing and executing the deletion of personal data. Essentially, a data deletion framework entails the systematic classification of personal data along with […]
Insurance company receives significant fine from Swedish SA
Another significant fine for the lack of adequate security measures on personal data was recently issued by a European Supervisory Authority (SA) to a controller responsible for private customers´ data. In the present case, the Swedish Supervisory Authority (IMY) imposed a fine of SEK 35 million (approx. EUR 2.9 million) to the insurance company Trygg-Hansa, […]
Italian DPA imposes €240,000 fine on Benetton Group
In April 2023 the Italian Data Protection Authority (Garante per la protezione dei dati personali) has fined the famous fashion brand Benetton with 240,000 Euros for violations of the GDPR related to marketing practices involving consumer data. The Garante’s investigation started in 2019 during the course of a scheduled investigation related to marketing activities and […]
Data Protection in (Mental) Health Apps
Mental health matters – and with global crises such as the Covid pandemic shaping our lives in the 2020s, everyone has been talking about it. A common piece of advice for people who are struggling with their mental health is to get help: Find a therapist or speak to a coach or counselor. However, these […]
Google Bard released in the EU after privacy concerns were addressed
Google has finally released its AI chatbot Bard in the European Union, after previously delaying the launch due to privacy concerns. The company said that it has addressed the concerns of the Irish Data Protection Commission (DPC), which is the lead regulator for Google’s data privacy practices in the EU. Bard can be considered Google’s […]
Why Strong Identity Verification is Vital in Data Protection
In the realm of data protection, identity verification plays a crucial role in safeguarding personal information. In this article, we explore a recent incident involving Vodafone España, shedding light on the significance of strong identity verification procedures. We’ll examine the case, discuss the consequences faced by Vodafone, and delve into best practices for verifying someone’s […]
Insights from the BfDI on how to navigate Privacy Challenges in the Era of Generative AI
The Federal Commissioner for Data Protection and Freedom of Information of Germany, also known as BfDI (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit), recently published an opinion on the topic of Generative Artificial Intelligence (AI). In a previous article, we discussed Generative AI, which refers to artificial intelligence applications capable of generating new content, rather […]