Following the positions expressed by the Austrian, German and French Supervisory Authorities (see our previous Alert), the Italian Supervisory Authority (Garante per la Protezione dei Dati Personali, Garante-) published on 9 June 2022 a specific measure, according to which website analytics solutions used to measure online audience (Analytics Service Solutions) infringe on the EU General Data Protection Regulation no. 2016/679 (GDPR – external source) when such use implies a transfer of personal data to a third country without an adequate level of personal data protection, such as the United States. Generally speaking, the Garante, aligned its position on the matter with its counterparts.
(more…)UK: Government Publishes New Proposed Data Protection Law
July 27th, 2022 | Posted by in English | Europe | Legislation | Privacy - (0 Comments)The UK Government has finally published its highly anticipated Data Protection and Digital Information Bill (the Bill), marking the first significant post-Brexit change to the UK’s data protection regime. Following Brexit, the UK continued following the EU General Data Protection Regulation, incorporated into UK law as the UK GDPR, and the UK implementation of the EU ePrivacy Directive, the Privacy and Electronic Communications Regulations 2003 (PECR), also remained in force.
The Bill is only at the start of the legislative process, and it remains to be seen how it will develop if it is amended during its passage through Parliament, but early indications are that it represents more of an evolution than a revolution in the UK regime. That will come as a relief to businesses that transfer personal data from the EU to the UK, because it reduces the risk that the EU might rescind the UK’s adequacy status.
For a start, the Bill actually preserves the UK GDPR, its enabling legislation the Data Protection Act 2018, and the PECR, because it is drafted as an amending act rather than a completely new legislative instrument. This does not contribute to user-friendliness, as interpreting UK data protection requirements will require a great deal of cross-referencing across texts.
The more eye-catching proposed changes in the Bill include:
- The inclusion of a list of “legitimate interests” that will automatically qualify as being covered by the lawful basis in UK GDPR Article 6(e).
- Some limitations on data subject access requests, such as the possibility of refusing “vexatious or excessive” requests.
- More exemptions from the requirement to obtain consent to cookies.
- Much higher fees for breach of PECR.
The Bill will now progress through various Parliamentary stages over the coming months in order to become law.
First Publication: K&L Gates Cyber Law Watch in collaboration with Noirin McFadden & Keisha Phippen
France: New Requirements Concerning the Sale of Digital Goods
July 21st, 2022 | Posted by in eCommerce | France | internet | IT | Legislation - (0 Comments)On 29 June 2022, Decree n° 2022-946 (the “Decree”) supplemented the regulatory framework resulting from the Ordinance n° 2021-1247 of 29 September 2021 on the legal warranty of conformity for goods, digital content and digital services (the “Ordinance”). Stakeholders have under 1 October 2022 to implement the following measures, aiming at protecting consumers of digital goods.
1. General information about the Ordinance
Implementing two 2019 European directives on certain aspects of contracts for the supply of digital content and digital services and contracts for the sale of goods (respectively Directives (EU) 2019/770 and 2019/771 dated 20 May 2019), the Ordinance aimed to foster the safety of consumers when purchasing both physical and digital goods and, to a lesser extent, to reduce the environmental impact of digital goods.
This Ordinance amended the French Consumer Code in depth, notably by expanding the legal warranty of conformity, which now covers digital products and services but is also applicable to both B2C as well as B2B contracts, when the latter are executed between professionals and non-professionals (i.e. legal entities acting outside of their direct professional activities).
(more…)GDPR: The Importance of Managing DSARs
June 22nd, 2022 | Posted by in France | Privacy - (0 Comments)Individuals having difficulties in obtaining responses to their personal data subject access requests (DSAR) from French telephone operator Free Mobile filed several complaints before the Frenchdata protection authority (CNIL). These requests related to accessing their personal data and objecting to receiving direct marketing messages by electronic means. After its investigations, the CNIL imposed a fine of €300,000 against Free Mobile on 28 December 2021.
(more…)UK: Queen’s Speech Heralds GDPR Overhaul
June 7th, 2022 | Posted by in Brexit | Privacy - (0 Comments)In the Queen’s speech at the state opening of parliament on 10 May 2022, the UK government announced its intention to change the UK’s data protection regime in a new Data Reform Bill. This follows a consultation last Autumn on how the UK GDPR could be reformed following the UK’s exit from the European Union (EU).
The government claims that the new Bill would:
- Create a data protection framework focused on “privacy outcomes” that would reduce the burdens on businesses, and a “clearer regulatory environment” to encourage “responsible innovation”.
- Ensure that citizens’ data is “protected to a gold standard”, while enabling more efficient sharing of data between public bodies.
- Modernise the Information Commissioner’s Office and require it to be “more accountable to Parliament and the public”.
The Queen’s speech also announced plans to replace the Human Rights Act 1998, which incorporated the European Convention on Human Rights into UK law. According to the government a new “Bill of Rights” would “end the abuse of the human rights framework and restore some common sense to [the] justice system”. This would be achieved by “establishing the primacy of UK case law”, which means that UK courts would no longer be required to follow the case law of the European Court of Human Rights.
Taken together, both of these proposed new legislative measures could change the balance of protection of individuals’ rights in the UK, both generally and in the specific area of personal data regulation. Their development will be closely watched by data protection professionals, because any significant changes in the UK data protection regime could prompt the EU to review its post-Brexit UK adequacy decision, potentially leading to the end of decades of seamless transfers of personal data from the EU to the UK.
First publication on K&L Gates Cyber Law Watch in collaboration with Nóirín McFadden
Guidelines 06/2022 on the practical implementation of amicable settlements
May 12th, 2022 | Posted by in Europe | Guidelines | Privacy - (0 Comments)EDPB Guidelines on Amicable Settlements: Key Points
The European Data Protection Board (EDPB) has released guidelines on how supervisory authorities (SAs) should handle amicable settlements under GDPR. Here are the key takeaways:
What is an Amicable Settlement?
- A process where data protection authorities facilitate resolution of complaints between data subjects and controllers
- Aims to achieve compliance with GDPR while satisfying both parties’ interests
- Most suitable for cases involving:
- Limited number of data subjects
- Non-systematic violations
- Incidental/accidental breaches
- Limited personal data
- Non-serious violations
Key Principles
- Not all EU countries allow amicable settlements (14 countries explicitly don’t permit them)
- Can be used in both local cases and cross-border processing scenarios
- Must respect principles of good administration and due process
- Should lead to swift resolution while maintaining high level of data protection
Cross-border Cases
In One-Stop-Shop (OSS) mechanism:
- Lead Supervisory Authority (LSA) must keep Concerned Supervisory Authorities (CSAs) informed
- Settlement requires formal decision under Article 60 GDPR
- CSAs must be consulted before finalizing settlement
- LSA remains “sole interlocutor” with the controller
Important Considerations
- Settlement doesn’t prevent further investigation if systemic issues are discovered
- Can be partial – some aspects of complaint may require formal investigation
- Must be documented and communicated properly to all parties
- Should include proof of compliance from controller and satisfaction from data subject
These guidelines represent a significant step toward harmonizing how data protection authorities handle complaints across the EU, while maintaining flexibility to account for national legal frameworks and specific case circumstances.
Litigation Minute: Creating an Incident Response Plan
May 10th, 2022 | Posted by in Privacy | Violation de données - (0 Comments)WHAT YOU NEED TO KNOW IN A MINUTE OR LESS
Reported incidents of data breaches have reached record levels over the last two years1)Experian Data Breach Resolution. (2021). Eighth Annual Study: Is Your Company Ready for a Big Data Breach? Ponemon Institute.. Given this undeniable reality, a data security incident response plan is no longer a luxury; it is a vital tool in every company’s larger crisis management plan. A well-thought-out and thorough response plan can not only significantly reduce the confusion that often follows a data security incident, but can also reduce the pitfalls that often lead to regulatory scrutiny and putative class actions in the United States and the fairly recent “group actions” in the European Union.
In a minute or less, here are the essential components of a working incident response plan.
(more…)References
| ↑1 | Experian Data Breach Resolution. (2021). Eighth Annual Study: Is Your Company Ready for a Big Data Breach? Ponemon Institute. |
|---|
Legal 500 Rankings 2022 – Data Privacy and Data Protection – Tier 2 & Leading Individual – France
April 11th, 2022 | Posted by in France | Privacy | Rankings - (0 Comments)‘Specialist in new technologies’, K&L Gates LLP‘s team has an outstanding reputation for legal advice on innovative technologies and data-related concerns. Claude-Etienne Armingaud and Raphael Bloch are recognised as ‘exceptional lawyers who miss no details and who know their fields to perfection’. Claude-Etienne Armingaud has developed particular knowledge of multijurisdictional transactional matters dealing with IT outsourcing and data protection for blockchain and fintech, connected cars, and big data services.
Leading individuals: Claude-Etienne Armingaud – K&L Gates LLP
Practice head(s): Claude-Etienne Armingaud
Other key lawyers: Raphael Bloch
(more…)
Copyright © 2025 All rights reserved.
Designed by 