Decree No. 2024-388 and Its Implications for Intermediation Platforms

June 10th, 2024 | Posted by Claude-Etienne Armingaud in France | Legislation | Privacy - (0 Comments)

Digital intermediation service platforms within the sectors of chauffeur-driven transportation and goods delivery have new responsibilities since the enactment of Decree no. 2024-388 on 25 Avril 2024. Operating under the framework established by Article L. 7345-1 of the French Labor Code, this Decree has initiated a systematic collection and transmission protocol for data concerning platform workers’ activities to the French Employment Platforms Social Relations Authority (“ARPE”).

This new system aims to bolster the production of statistical reports, as instrumental means to inform and transform the dialogue with the representative organizations.

Along these lines, platforms hold an equally important responsibility to revise their privacy notices. Transparency is paramount—the notices must clearly articulate these new data processing operations to the individuals concerned, ensuring that workers are fully aware of how their personal data is captured, utilized, and shared.

The implementation of Decree no. 2024-388 also signals a proactive step towards enhancing social dialogue tools within the affected sectors. Empowering ARPE to collect and leverage the data within its statutory power creates an opening for more informed policy-making and a more significant discourse between platforms, workers, and representative organizations.

The inception of the Decree manifests a shift towards a more transparent and regulated digital labor market. It requires those in authority—data controllers and intermediation platforms alike—to engage in a comprehensive update of operational protocols and privacy frameworks, thereby securing data subject rights while contributing to a broader socio-economic analysis. Such task will necessitate a keen understanding of both legal obligations and the ethical standards underscoring the digital economy.

The crucial evolution underlying the enactment of the Decree will require Platforms acting as data controllers to update in alignment their records of processing activities (RoPA) and meticulously document the nature, purpose, scope of data processed and the operational procedures for transferring requisite data to the ARPE.

First publication: K&L Gates Cyber Law Watch Blog– in collaboration with Kenza Berrada

Political groups demand ‘responsibilities’ over Parliament’s data leak

June 10th, 2024 | Posted by Claude-Etienne Armingaud in Data Breach | Europe | Interview | Privacy - (0 Comments)

Four political groups have sent letters to the European Parliament President asking for further details, action, and “responsibilities” related to a recent data breach that affected a significant amount of employees’ personal data, including passports.

(more…)

Once More Ranked Among World’s Best Data Law Firms by Global Data Review

May 5th, 2024 | Posted by Claude-Etienne Armingaud in Non classé | Privacy | Rankings | World - (0 Comments)

Once again, global law firm K&L Gates LLP has been ranked among the world’s 100 leading data law firms by Global Data Review’s GDR 100. The annual list examines law firms’ privacy and data protection capabilities, use of IP and confidentiality laws to protect proprietary data, and the firm’s work on all other personal and non-personal data laws at a global level. 

Nearly two dozen K&L Gates lawyers were recognized in the 2024 GDR 100, including Paris partner Claude-Étienne Armingaud. Other partners leading the practice and identified in the profile include Melbourne partner Cameron Abbott, Seattle partners Shannan Frisbie, Whitney McCollum, David Bateman, and Carley Andrews, Washington, D.C., partner Bruce Heiman, Chicago partner Limo Cherian, London partner Sarah Turpin, and Research Triangle Park partners Gina Bertolini and Leah Richardson.

Clients provided positive feedback of their experience working with K&L Gates’ lawyers stating the team has “deep knowledge of privacy laws and regulations, but they also understand the business impact of their advice. This sets them apart from other firms in the market.”

K&L Gates’ Data Protection, Privacy, and Security practice boasts more than 60 lawyers and professionals with experience in various technologies and methodologies. From assessing risk to incident response, breach, and crisis counseling globally, the team is qualified to handle most data privacy and security compliance issues. The practice also assists with cross-border mergers and acquisitions and specialized services focused on emerging areas such as biometric data compliance and defense.

The full K&L Gates profile can be read at Global Data Review (subscription required).

, ,

THE 2024 LAWDRAGON 500 LEADING GLOBAL CYBER LAWYERS

April 26th, 2024 | Posted by Claude-Etienne Armingaud in Privacy | Rankings | World - (0 Comments)

We are thrilled to share our newest guide – and honor the 500 global cyber lawyers recognized here.

There is little in life or law that isn’t encoiled in the digital world these days. And these are the lawyers who connect it all – data and security, innovation and inspiration, litigation and exploration.

Defining what exactly a leading cyber lawyer is was part of the mission. The core of this guide are the privacy and data security specialists who began forming this practice well over a decade ago as companies experienced data breaches and attorneys scurried to become designated as privacy specialists.

But a deep dive on what lawyers and firms globally consider to be cybersecurity these days uncovered a world robust with former intelligence officers, hackers, government officials learning to parse competition claims regarding data sets, tech dealmakers turned to for their way around cyber protocols as deal points, litigators who defend Big Tech from claims of biometric privacy invasion. Robustly represented are former prosecutors and other government leaders whose portfolios detail vast experience in cyber crime security and prosecution.

Take TikTok as an example of the vast layers of legal regulation, national security, technology and consumer protection embedded in its affairs. We’re fascinated to watch the legal teams assemble to parse demands it be sold.

Specialists in regulation of drones and autonomous vehicles are represented here, alongside the legal world’s leading minds in national security, who guide on often old battles fought with new weapons.

To create this list – our inaugural edition – we weighed nominations, independent research and views of peers. This guide is 39 percent female and 19 percent inclusive. Those noted by an asterisk are esteemed members of our Hall of Fame. 

Source: LawDragons

GDR 100 2024 profile: K&L Gates

April 17th, 2024 | Posted by Claude-Etienne Armingaud in Europe | Non classé | Privacy | Rankings | World - (0 Comments)

K&L Gates’s expertise in data and tech work has recently seen it advise on matters as diverse as AI and machine learning projects’ impact on personal data retention and transparency and the implications of augmented reality make-up applications and smart fragrances. While the firm has some significant tech companies on board, the client base skews more heavily towards advising more traditional industries through digital transformation.
The data protection, privacy and security practice has multiple leaders, reflecting its wide geographic spread.
Claude-Étienne Armingaud in Paris, who is a dual-qualified French and New York lawyer, is a stand-out name: besides GDPR and privacy compliance, he also has extensive experience advising on tech transactions, for example relating to software, blockchain, connected cars and more. Other partners leading the practice are Cameron Abbott in Melbourne; Shannan Frisbie, Whitney McCollum, David Bateman and Carley Andrews in the firm’s Seattle headquarters; Bruce Heiman in Washington, DC; Limo Cherian in Chicago; Gina Bertolini and Leah Richardson in the Research Triangle Park office in North Carolina; and Sarah Turpin in London.

The K&L Gates practice’s senior ranks grew with the addition of San Francisco partner Michael Stortz, who was formerly at Akin Gump. Thomas Nietsch was promoted to the partnership in Berlin. The firm also hired counsel Veronica Muratori in Milan from Withersworldwide; Avril Love in Los Angeles from Tucker Ellis; and Ulrike Elteste in Frankfurt from Covington & Burling.

Client references


“K&L Gates has deep expertise and knowledge in this area and is always responsive. Advice is always timely and well-considered.”


“Collaboration with K&L Gates is always seamless. The team have deep knowledge of privacy laws and regulations, but they also understand the business impact of their advice. This sets them apart from other firms in the market.”

First publication: Lexology GDR100

Legal 500 Rankings 2024 – Data Privacy and Data Protection – Tier 2 & Leading Individual – France

March 27th, 2024 | Posted by Claude-Etienne Armingaud in France | Privacy | Rankings - (0 Comments)

The ‘young and innovative team’ at K&L Gates LLP has a strong reputation in the market for its ability to handle data protection liability issues in M&A transactions and global data protection compliance mandates. Areas of activity for the practice include machine learning, autonomous driving and blockchain-based services. Claude-Étienne Armingaud heads up the team and is described as a ‘fount of knowledge on the subject of privacy and data protection‘. He is frequently sought out by clients from the software industry for assistance with cross-border technology transactions.

Leading individuals: Claude-Etienne Armingaud – K&L Gates LLP

Practice head(s): Claude-Etienne Armingaud

Other Key Lawyer(s): Camille Scarparo

(more…)

, ,

Employment Practices and Data Protection: Monitoring Workers 101

March 26th, 2024 | Posted by Claude-Etienne Armingaud in Europe | Guidelines | Non classé | Privacy - (0 Comments)

The Information Commissioner’s Office (ICO) has recently published guidance for employers on monitoring workers lawfully, transparently and fairly. The guidance aims to protect workers’ data protection rights and help employers to build trust with workers, customers and service users. With Artificial Intelligence (AI) on the rise, the temptation may be strong for employers to leverage those emerging technologies in that space. This alert summarizes some specific steps employers should prioritise in light of the ICO guidance.

(more…)

Chambers Europe: TMT: Data Protection 2024

March 15th, 2024 | Posted by Claude-Etienne Armingaud in Non classé | Privacy | Rankings - (0 Comments)

Entering Chambers Europe/France TMT: Data Protection ranking as an Up & Coming lawyer.

Client testimonials:

Claude-Étienne has a vision that goes beyond IT into other areas, so he gives multidisciplinary and strategic insights. He is also pleasant to work with and efficient.

He works really efficiently for us; he is really dedicated and clearly passionate about it too.

Source: Chambers Europe

,

🇺🇸 Regulating AI Part-IV: The EU AI Ac – The Expected International Impacts of the First Comprehensive AI Regulation

February 19th, 2024 | Posted by Claude-Etienne Armingaud in Artificial Intelligence | Conference | Europe | Intelligence Artificielle | Legislation | Privacy - (0 Comments)

Part IV of our series “Regulating AI: The Potential Impact of Global Regulation of Artificial Intelligence” will focus on recent developments in general availability of AI and how generative AI solutions are leading regulators, at a global level, to consider legal frameworks to protect both individuals affected by AI and digital sovereignty.

The program will feature a panel addressing the EU AI Act, on which a preliminary political agreement was reached last December and unanimously approved by the ambassadors of the 27 countries of the European Union on 2 February 2024, prior to its upcoming final votes.

Like the GDPR before it, the EU AI Act will be a trailblazing piece of legislation which will impact companies at global level.

Our panelists will discuss the consequences of the EU AI Act on companies contemplating the provision of AI solutions in the EU market or leveraging AI in the EU, with a special focus on non-EU companies.

Additional topics in our Regulating AI — The Potential Impact of Global Regulation of Artificial Intelligence series include:  

  • Part I – 13 September 2023 (EU / U.K.) – View Recording
  • Part II – 7 December 2023 (Asia-Pacific Region: China, Hong Kong, Singapore, Japan) – View Recording
  • Part III – 12 December 2023 (United States)

Register or watch the replay here.

Access the full text of the EU AI Act here.

ICO Introduces Consultation Series on Data Protection and Generative AI

February 13th, 2024 | Posted by Claude-Etienne Armingaud in Artificial Intelligence | Europe | IT | Non classé | Privacy - (0 Comments)

The Information Commissioner’s Office (ICO) recently launched a consultation series on how data protection laws should apply to the development and use of generative AI models (“Gen AI”). In the coming months, the ICO will publish further views on how to interpret specific requirements of UK GDPR and Part 2 of the DPA 2018 in relation to Gen AI. This first part of the consultation focusses on whether it is lawful to train Gen AI on personal data scraped from the web. The consultation seeks feedback from stakeholders with an interest in Gen AI.

As outlined by the ICO, web scraping will involve the collection and processing of personal data, which may not have been placed online directly by the data subjects themselves. To comply with the UK GDPR, Gen AI developers would need to ensure there is a valid lawful basis for their processing under UK GDPR, as well as comply with the relevant information requirements pertaining to indirect personal data collection.

For the first part of the consultation series, the ICO published a policy position on the lawful basis for training Gen AI models on web-scraped data which can be found here. More specifically, this consultation focusses on the ‘legitimate interest’ lawful basis under art. 6(1)(f) UK GDPR and the ‘three-part’ test that a data controller must pass to meet the legitimate interest basis (a so-called Legitimate Interest Assessment). The ICO has considered various actions that Gen AI developers could take to meet this three-part legitimate interest test to guarantee that the collection of training data through web scraping, i.e. processing of data, is complaint with the principles of UK GDPR. The ICO would now like to hear from relevant stakeholders on their view of the proposed regulatory approach and the impact this would have on their organisation. A link to the survey can be found here.

The deadline to submit a response is 1 March 2024.

First publication: K&L Gates Cyber Law Watch blog with Sophie Verstraeten