On 27 October 2022, the Digital Services Act (DSA) was published in the EU Official Journal as Regulation (EU) 2022/2065, with the aim to fully harmonize the rules on the safety of online services and the dissemination of illegal content online. The Digital Services Act will require online intermediaries to amend their terms of service, to better handle complaints, and to increase their transparency, especially with respect to advertising.
(more…)EU Digital Services Act: Fundamental Changes for Online Intermediaries?
November 5th, 2022 | Posted by in Competition | eCommerce | Europe | internet | Legislation - (0 Comments) UK Data Protection: Beware of the Consequences of Unsolicited Marketing Emails
October 12th, 2022 | Posted by in English | Europe | Marketing | Privacy - (0 Comments) Sending unsolicited marketing emails could prove costly to UK organisations, as bike and car accessory retailer Halfords have recently discovered.
Last month, Halfords were handed a fine of £30,000 by the Information Commissioner’s Office (ICO) for sending around half a million unsolicited marketing email messages to customers who had not previously opted-in to marketing (see here).
The fine was issued under the Privacy and Electronic Communications Regulations (PECR), which gives people specific privacy rights in relation to electronic communications and restricts how unsolicited direct marketing is carried out.
An investigation carried out by the ICO found that the retailer broke the laws governing electronic communications by sending out emails relating to a government voucher scheme that gave people £50 off the cost of repairing a bike at any participating store or mechanic in England. The email not only pointed customers to the government website, it also invited them to book a bike assessment and to redeem their voucher at their chosen Halfords store. The ICO concluded that the insinuation of Halfords having a direct connection with the government scheme encouraged its customers to redeem the voucher in its stores and that Halfords was therefore advertising its own services.
PECR prevents organisations from sending emails or messages to people unless they have consented to it or they are an existing customer who has bought similar products or services in the past (known as the “soft opt-in” rule).
Halfords argued that the email constituted a service message and should not be categorised as direct marketing, but the ICO maintained that the email did constitute direct marketing because it satisfied the definition of such under Paragraph 35 of the ICO’s Direct Marketing Guidance (see here). In addition, the ICO concluded that the soft opt-in rule could not apply because the targeted customers had already opted out.
Andy Curry, Head of Investigations at the ICO said: “This [decision] sends a message to similar organisations to review their electronic marketing operations, and that we will take necessary action if they break the law.”
First publication: K&L Gates Cyber Law Watch in collaboration with Keisha Phippen
AntiCor France, Surmontez les defis du RGPD et des lois sur la protection de la vie privee dans le contexte de l’anti-corruption
October 10th, 2022 | Posted by in Conference | Data Transfer | Europe | France | Privacy - (0 Comments) 
Claude-Etienne, Armingaud, Associé
K&L Gates
Stéphane Bonifassi, Associé fondateur
Bonifassi Avocats
Les options d’examen et d’analyse assistées par la technologie sont de plus en plus utilisées dans les enquêtes internes et externes, notamment par les multinationales. L’utilisation de l’analyse des données peut apporter efficacité, précision et réduction des coûts. Cependant, le croisement entre le droit et la technologie soulève des préoccupations uniques en matière de protection de la vie privée et d’autres questions juridiques lors des enquêtes internes et externes : cette session permettra de vous mettre à niveau. Les sujets de discussion incluront :
- Étudier la manière dont l’analyse des données et la découverte électronique peuvent aider les enquêtes multinationales.
- Comprendre vos obligations selon la loi Schrems II, le RGPD et d’autres législations.
- Apprendre les meilleures pratiques pour se conformer à ces obligations lors des enquêtes internes ou externes, de la diligence raisonnable et de la dénonciation des dysfonctionnements.
- Comparer et intégrer des lignes directrices de la CNIL et du Conseil européen de la protection des données, entre autres.
- Déterminer l’impact de la proposition de cadre transatlantique pour la protection des données sur votre pratique quotidienne.
UK: Government Publishes New Proposed Data Protection Law
July 27th, 2022 | Posted by in English | Europe | Legislation | Privacy - (0 Comments) The UK Government has finally published its highly anticipated Data Protection and Digital Information Bill (the Bill), marking the first significant post-Brexit change to the UK’s data protection regime. Following Brexit, the UK continued following the EU General Data Protection Regulation, incorporated into UK law as the UK GDPR, and the UK implementation of the EU ePrivacy Directive, the Privacy and Electronic Communications Regulations 2003 (PECR), also remained in force.
The Bill is only at the start of the legislative process, and it remains to be seen how it will develop if it is amended during its passage through Parliament, but early indications are that it represents more of an evolution than a revolution in the UK regime. That will come as a relief to businesses that transfer personal data from the EU to the UK, because it reduces the risk that the EU might rescind the UK’s adequacy status.
For a start, the Bill actually preserves the UK GDPR, its enabling legislation the Data Protection Act 2018, and the PECR, because it is drafted as an amending act rather than a completely new legislative instrument. This does not contribute to user-friendliness, as interpreting UK data protection requirements will require a great deal of cross-referencing across texts.
The more eye-catching proposed changes in the Bill include:
- The inclusion of a list of “legitimate interests” that will automatically qualify as being covered by the lawful basis in UK GDPR Article 6(e).
- Some limitations on data subject access requests, such as the possibility of refusing “vexatious or excessive” requests.
- More exemptions from the requirement to obtain consent to cookies.
- Much higher fees for breach of PECR.
The Bill will now progress through various Parliamentary stages over the coming months in order to become law.
First Publication: K&L Gates Cyber Law Watch in collaboration with Noirin McFadden & Keisha Phippen
Guidelines 06/2022 on the practical implementation of amicable settlements
May 12th, 2022 | Posted by in Europe | Guidelines | Privacy - (0 Comments) EDPB Guidelines on Amicable Settlements: Key Points
The European Data Protection Board (EDPB) has released guidelines on how supervisory authorities (SAs) should handle amicable settlements under GDPR. Here are the key takeaways:
What is an Amicable Settlement?
- A process where data protection authorities facilitate resolution of complaints between data subjects and controllers
- Aims to achieve compliance with GDPR while satisfying both parties’ interests
- Most suitable for cases involving:
- Limited number of data subjects
- Non-systematic violations
- Incidental/accidental breaches
- Limited personal data
- Non-serious violations
Key Principles
- Not all EU countries allow amicable settlements (14 countries explicitly don’t permit them)
- Can be used in both local cases and cross-border processing scenarios
- Must respect principles of good administration and due process
- Should lead to swift resolution while maintaining high level of data protection
Cross-border Cases
In One-Stop-Shop (OSS) mechanism:
- Lead Supervisory Authority (LSA) must keep Concerned Supervisory Authorities (CSAs) informed
- Settlement requires formal decision under Article 60 GDPR
- CSAs must be consulted before finalizing settlement
- LSA remains “sole interlocutor” with the controller
Important Considerations
- Settlement doesn’t prevent further investigation if systemic issues are discovered
- Can be partial – some aspects of complaint may require formal investigation
- Must be documented and communicated properly to all parties
- Should include proof of compliance from controller and satisfaction from data subject
These guidelines represent a significant step toward harmonizing how data protection authorities handle complaints across the EU, while maintaining flexibility to account for national legal frameworks and specific case circumstances.
International Personal Data Transfers: An Eventful Week
March 25th, 2022 | Posted by in Brexit | Data Transfer | Europe | Privacy - (0 Comments) Transfer from the UK
On 21 March 2022, the United Kingdom finalized the adoption of its own version of the European Union’s (EU) Standard Contractual Clauses (SCC), a contractual mechanism aiming at securing personal data protected under a data protection framework to third countries not deemed to offer an “adequate” level of data protection.
On 16 July 2020, while the United Kingdom was still an EU Member State, the European Court of Justice (CJEU), through its Schrems II decision, added new requirements to the SCC (see our Alert here), relating to safeguards against access to personal data protected under EU’s General Data Protection Regulation (GDPR) by intelligence agencies. As a consequence, the European Union adopted new versions of the SCC in June 2021 (see our Alert here), but the United Kingdom having finalized Brexit in the meantime, did not adopt the new SCCs, instead operating the previous versions of the SCC, and an updated document for transfers initiated under the UK GDPR was needed.
The UK’s draft International Data Transfer Agreement (IDTA) and Addendum were laid before Parliament on 22 February 2022 and finally adopted on 21 March 2022 without changes. The IDTA is an equivalent contract to the SCC, but uses a tabular approach in place of the modules used by the SCC. The alternative instrument that was introduced, the Addendum, provides UK data exporters with a semi-seamless mechanism where they can leverage their existing SCC for transfers initiated under the EU GDPR. The Addendum consists of a form effectively selecting the relevant options of the SCC and amending EU terminology and legal references to UK-specific ones. It is likely to be more widely used than the IDTA, particularly as data exporters with operations in both the UK and the EU will look to reduce the number of contracts they need to enter into. Overall, the IDTA and the Addendum represent a narrowing in the divergence that had appeared recently in the differing safeguards required by the UK and the EU for data exporters engaged in personal data transfers from their respective jurisdictions.
As a reminder:
- Transfers between the EU and the UK do not need any specific measures as per the adequacy decision currently in place (see our Alert here)
- all data transfer agreements under the EU GDPR based on the previous versions of the SCC will need to be migrated to the new SCC on or before 27 December 2022; and
- all data transfer agreements under the UK GDPR executed on or before 21 September 2022 on the basis of any Transitional Standard Clauses (based on the previous versions of the SCC) will need to be migrated to an IDTA or Addendum on or before 21 March 2024.
Transfer from the EU to the US: En Route for Schrems III?
On 25 March 2022, European Commission President Ursula von der Leyen and United States President Joe Biden announced an “agreement in principle” on a new EU-US data sharing system, expected to replace the Privacy Shield framework invalidated under the CJEU’s Schrems II decision in 2020 (see our Alert here).
As no draft of that “agreement” has been circulated, the existing grievances against U.S. intelligence agencies’ access to personal data protected under GDPR remain and concerns relating to ‘effective legal remedies’ available to individuals protected under GDPR (Data Subjects) will need to be addressed. Data activist Maximilian Schrems and his organization, noyb, already announced that they would closely monitor the development of this new framework and challenge any decision which would not abide by the CJEU’s 2020 Schrems II decision.
While such a political statement is encouraging for the future of international data transfers, this announcement should not be construed as relieving companies subject to GDPR’s territorial scope (see our Alert here) from implementing adequate data transfer mechanisms until more concrete elements are adopted.
Such transfer mechanisms notably include:
- A transfer impact assessment (TIA), analyzing the regulatory framework applicable to the destination country and any supplemental technical and organizational measures to be implemented to safeguard the transferred personal data from undue access;
- Implementation of a transfer mechanism, such as the SCC (see above) or adhesion to Binding Corporate Rules, or to a Code of Conduct (see our Alert here).
K&L Gates’ global data protection team (including in each of our European offices) remains available to assist you in achieving the compliance of your data transfers at a global level.
First publication: K&L Gates Hub in collaboration with Noirin McFadden, Thomas Nietsch and Keisha Phippen
Copyright © 2025 All rights reserved.
Designed by 