In this episode, Claude Etienne Armingaud, Eleonora Curreri, and Camille Scarparo introduce a case regarding a U.S. company’s data privacy breach, the consequences a company may face for being non-compliant with GDPR for companies established outside of the EU, and which steps companies can take to prevent these situations.
First publication: K&L Gates Hub with Eleonora Curreri & Camille Scarparo
Version 2.0 – Adopted 28 March 2023
| Version 1.0 | 10 October 2022 | Adoption of the Guidelines (updated version of the previous guidelines WP250 (rev.01) adopted by the Working Party 29 and endorsed by the EDPB on 25 May 2018) for a targeted public consultation |
|---|---|---|
| Version 2.0 | 28 March 2023 | Adoption of the Guidelines following the targeted public consultation on the subject of data breach notification for controllers not established in the EEA. |
Well, that’s a wrap on #DPI23 France!
Claude-Étienne Armingaud, CIPP/E, Partner, Data Protection Privacy and Security Practice Group Coordinator, K&L Gates
Gabriela Mercuri, Managing Director, SCOPE Europe
Jörn Wittmann, Director Privacy Legislative Strategy and Public Policy, Volkswagen AG
Codes of conduct overseen by accredited monitoring bodies are one of the breakthrough innovations introduced by EU General Data Protection Regulation. As part of its accountability framework, GDPR not only shifted the onus of demonstrative compliance, but also created the possibility for stakeholders to engage in co-regulatory practices. The goal was to allow the industry to support regulatory implementation by developing workable guidance to concretize the GDPR’s provisions. More flexible than other previously adopted compliance tools, CoCs generated high expectations, particularly in the wake of Schrems II, as a possible solution to address international data transfers and enable legal foreseeability. CoCs have not yet reached their full potential, with only a handful of national CoCs deployed and even less at the pan-European level. However, as the cloud ecosystem leads the way, this panel will explore the background of this sectoral success while highlighting CoC’s benefits, as well as their limitations.
What you will learn:
• How to understand the relevancy of CoCs in a post-GDPR, post-Schrems II era.
• What CoCs can bring to an ecosystem, as well as what they should not be pursued for.
• The future of international data transfers amid emerging data protection systems at global levels.
K&L Gates ranked “Highly Recommended, Band 2/2” with Claude-Etienne Armingaud.
Source: Leaders League
(more…)K&L Gates ranked “Highly Recommended – Band 1” with Claude-Etienne Armingaud.
Source: Leaders League
(more…)Version 2.0 dated 14 February 2023
Go to the official PDF version.
The GDPR does not provide for a legal definition of the notion “transfer of personal data to a third country or to an international organisation”. Therefore, the EDPB provides these guidelines to clarify the scenarios to which it considers that the requirements of Chapter V should be applied and, to that end, it has identified three cumulative criteria to qualify a processing operation as a transfer:
If the three criteria as identified by the EDPB are met, there is a transfer and Chapter V of the GDPR is applicable. This means that the transfer can only take place under certain conditions, such as in the context of an adequacy decision from the European Commission (Article 45) or by providing appropriate safeguards (Article 46). The provisions of Chapter V aim at ensuring the continued protection of personal data after they have been transferred to a third country or to an international organisation.
Conversely, if the three criteria are not met, there is no transfer and Chapter V of the GDPR does not apply. In this context, it is however important to recall that the controller must nevertheless comply with the other provisions of the GDPR and remains fully accountable for its processing activities, regardless of where they take place. Indeed, although a certain data transmission may not qualify as a transfer according to Chapter V, such processing can still be associated with increased risks since it takes place outside the EU, for example due to conflicting national laws or disproportionate government access in the third country. These risks need to be considered when taking measures under, inter alia, Article 5 (“Principles relating to processing of personal data”), Article 24 (“Responsibility of the controller”) and Article 32 (“Security of processing”) – in order for such processing operation to be lawful under the GDPR.
These guidelines include various examples of data flows to third countries, which are also illustrated in an Annex in order to provide further practical guidance.
(more…)In this first episode, we discuss the challenges faced by data controllers in their compliance with Article 5 GDPR following the EU Court of Justice’s Digi Case C-77/21. In particular, we focus our discussion on the purpose and data storage limitations, and how your legal team should be the 3PO protocol droid within your organization for the implementation of GDPR best practices.
May the enforcement be with you!
First publication: K&L Gates Hub with Eleonora Curreri
This program provides timely updates, best practices, and emerging developments in today’s data protection, privacy, and security industry.
