🇫🇷 Flottes connectees, reglementation et experiences reussies

Très heureux d’avoir accueilli ce matin en nos locaux GEOTAB pour la conférence « Flottes connectées, réglementation et expériences réussies », modérée par François Denis, Directeur Général France GEOTAB.

Claude-Etienne Armingaud, CIPP/E, associé Protection des données, nous a exposé les enjeux du droit des données à caractère personnel en lien avec les véhicules connectés.

Pascal Six, Business Development Manager, a retracé la manière dont GEOTAB a développé et continue d’adapter son offre, dans le respect des lois applicables en matière de protection des données à caractère personnel.

Pour terminer, Bertrand MATHIEU Directeur des Opérations VAC / Hardouin Loc, nous a fait part de son expérience client réussie avec GEOTAB.

Merci aux intervenants et participants !

UK Data Protection: Beware of the Consequences of Unsolicited Marketing Emails

October 12th, 2022 | Posted by Claude-Etienne Armingaud in English | Europe | Marketing | Privacy - (0 Comments)

Sending unsolicited marketing emails could prove costly to UK organisations, as bike and car accessory retailer Halfords have recently discovered.

Last month, Halfords were handed a fine of £30,000 by the Information Commissioner’s Office (ICO) for sending around half a million unsolicited marketing email messages to customers who had not previously opted-in to marketing (see here).

The fine was issued under the Privacy and Electronic Communications Regulations (PECR), which gives people specific privacy rights in relation to electronic communications and restricts how unsolicited direct marketing is carried out.

An investigation carried out by the ICO found that the retailer broke the laws governing electronic communications by sending out emails relating to a government voucher scheme that gave people £50 off the cost of repairing a bike at any participating store or mechanic in England. The email not only pointed customers to the government website, it also invited them to book a bike assessment and to redeem their voucher at their chosen Halfords store. The ICO concluded that the insinuation of Halfords having a direct connection with the government scheme encouraged its customers to redeem the voucher in its stores and that Halfords was therefore advertising its own services.

PECR prevents organisations from sending emails or messages to people unless they have consented to it or they are an existing customer who has bought similar products or services in the past (known as the “soft opt-in” rule).

Halfords argued that the email constituted a service message and should not be categorised as direct marketing, but the ICO maintained that the email did constitute direct marketing because it satisfied the definition of such under Paragraph 35 of the ICO’s Direct Marketing Guidance (see here). In addition, the ICO concluded that the soft opt-in rule could not apply because the targeted customers had already opted out.

Andy Curry, Head of Investigations at the ICO said: “This [decision] sends a message to similar organisations to review their electronic marketing operations, and that we will take necessary action if they break the law.”

First publication: K&L Gates Cyber Law Watch in collaboration with Keisha Phippen

🇺🇸 AntiCor France, Surmontez les defis du RGPD et des lois sur la protection de la vie privee dans le contexte de l’anti-corruption

Claude-Etienne, Armingaud, Associé
K&L Gates

Stéphane Bonifassi, Associé fondateur
Bonifassi Avocats

Les options d’examen et d’analyse assistées par la technologie sont de plus en plus utilisées dans les enquêtes internes et externes, notamment par les multinationales. L’utilisation de l’analyse des données peut apporter efficacité, précision et réduction des coûts. Cependant, le croisement entre le droit et la technologie soulève des préoccupations uniques en matière de protection de la vie privée et d’autres questions juridiques lors des enquêtes internes et externes : cette session permettra de vous mettre à niveau. Les sujets de discussion incluront :

Étudier la manière dont l’analyse des données et la découverte électronique peuvent aider les enquêtes multinationales.
Comprendre vos obligations selon la loi Schrems II, le RGPD et d’autres législations.
Apprendre les meilleures pratiques pour se conformer à ces obligations lors des enquêtes internes ou externes, de la diligence raisonnable et de la dénonciation des dysfonctionnements.
Comparer et intégrer des lignes directrices de la CNIL et du Conseil européen de la protection des données, entre autres.
Déterminer l’impact de la proposition de cadre transatlantique pour la protection des données sur votre pratique quotidienne.

Plus d’information

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (Text with EEA relevance) [Full Text]

Read the full text.

(more…)

Digital, DMA, europe, official text, regualation

UK: Government Publishes New Proposed Data Protection Law

July 27th, 2022 | Posted by Claude-Etienne Armingaud in English | Europe | Legislation | Privacy - (0 Comments)

The UK Government has finally published its highly anticipated Data Protection and Digital Information Bill (the Bill), marking the first significant post-Brexit change to the UK’s data protection regime. Following Brexit, the UK continued following the EU General Data Protection Regulation, incorporated into UK law as the UK GDPR, and the UK implementation of the EU ePrivacy Directive, the Privacy and Electronic Communications Regulations 2003 (PECR), also remained in force.

The Bill is only at the start of the legislative process, and it remains to be seen how it will develop if it is amended during its passage through Parliament, but early indications are that it represents more of an evolution than a revolution in the UK regime. That will come as a relief to businesses that transfer personal data from the EU to the UK, because it reduces the risk that the EU might rescind the UK’s adequacy status.

For a start, the Bill actually preserves the UK GDPR, its enabling legislation the Data Protection Act 2018, and the PECR, because it is drafted as an amending act rather than a completely new legislative instrument. This does not contribute to user-friendliness, as interpreting UK data protection requirements will require a great deal of cross-referencing across texts.

The more eye-catching proposed changes in the Bill include:

The inclusion of a list of “legitimate interests” that will automatically qualify as being covered by the lawful basis in UK GDPR Article 6(e).
Some limitations on data subject access requests, such as the possibility of refusing “vexatious or excessive” requests.
More exemptions from the requirement to obtain consent to cookies.
Much higher fees for breach of PECR.

The Bill will now progress through various Parliamentary stages over the coming months in order to become law.

First Publication: K&L Gates Cyber Law Watch in collaboration with Noirin McFadden & Keisha Phippen

GDPR: The Importance of Managing DSARs

June 22nd, 2022 | Posted by Claude-Etienne Armingaud in France | Privacy - (0 Comments)

Individuals having difficulties in obtaining responses to their personal data subject access requests (DSAR) from French telephone operator Free Mobile filed several complaints before the Frenchdata protection authority (CNIL). These requests related to accessing their personal data and objecting to receiving direct marketing messages by electronic means. After its investigations, the CNIL imposed a fine of €300,000 against Free Mobile on 28 December 2021.

(more…)

UK: Queen’s Speech Heralds GDPR Overhaul

June 7th, 2022 | Posted by Claude-Etienne Armingaud in Brexit | Privacy - (0 Comments)

In the Queen’s speech at the state opening of parliament on 10 May 2022, the UK government announced its intention to change the UK’s data protection regime in a new Data Reform Bill. This follows a consultation last Autumn on how the UK GDPR could be reformed following the UK’s exit from the European Union (EU).

The government claims that the new Bill would:

Create a data protection framework focused on “privacy outcomes” that would reduce the burdens on businesses, and a “clearer regulatory environment” to encourage “responsible innovation”.
Ensure that citizens’ data is “protected to a gold standard”, while enabling more efficient sharing of data between public bodies.
Modernise the Information Commissioner’s Office and require it to be “more accountable to Parliament and the public”.

The Queen’s speech also announced plans to replace the Human Rights Act 1998, which incorporated the European Convention on Human Rights into UK law. According to the government a new “Bill of Rights” would “end the abuse of the human rights framework and restore some common sense to [the] justice system”. This would be achieved by “establishing the primacy of UK case law”, which means that UK courts would no longer be required to follow the case law of the European Court of Human Rights.

Taken together, both of these proposed new legislative measures could change the balance of protection of individuals’ rights in the UK, both generally and in the specific area of personal data regulation. Their development will be closely watched by data protection professionals, because any significant changes in the UK data protection regime could prompt the EU to review its post-Brexit UK adequacy decision, potentially leading to the end of decades of seamless transfers of personal data from the EU to the UK.

First publication on K&L Gates Cyber Law Watch in collaboration with Nóirín McFadden

Guidelines 06/2022 on the practical implementation of amicable settlements

May 12th, 2022 | Posted by Claude-Etienne Armingaud in Europe | Guidelines | Privacy - (0 Comments)

EDPB Guidelines on Amicable Settlements: Key Points

The European Data Protection Board (EDPB) has released guidelines on how supervisory authorities (SAs) should handle amicable settlements under GDPR. Here are the key takeaways:

What is an Amicable Settlement?

A process where data protection authorities facilitate resolution of complaints between data subjects and controllers
Aims to achieve compliance with GDPR while satisfying both parties’ interests
Most suitable for cases involving:
- Limited number of data subjects
- Non-systematic violations
- Incidental/accidental breaches
- Limited personal data
- Non-serious violations

Key Principles

Not all EU countries allow amicable settlements (14 countries explicitly don’t permit them)
Can be used in both local cases and cross-border processing scenarios
Must respect principles of good administration and due process
Should lead to swift resolution while maintaining high level of data protection

Cross-border Cases

In One-Stop-Shop (OSS) mechanism:

Lead Supervisory Authority (LSA) must keep Concerned Supervisory Authorities (CSAs) informed
Settlement requires formal decision under Article 60 GDPR
CSAs must be consulted before finalizing settlement
LSA remains “sole interlocutor” with the controller

Important Considerations

Settlement doesn’t prevent further investigation if systemic issues are discovered
Can be partial – some aspects of complaint may require formal investigation
Must be documented and communicated properly to all parties
Should include proof of compliance from controller and satisfaction from data subject

These guidelines represent a significant step toward harmonizing how data protection authorities handle complaints across the EU, while maintaining flexibility to account for national legal frameworks and specific case circumstances.

Go to the full guidelines.