DPO Newsletter: Data Protection & Privacy News (issue #11)

We’ve compiled the latest in Data Protection and Privacy news for your convenience below.

1) Newly Published Documentation

• The Dutch Data Protection Authority has issued guidelines on the role of the DPO. Read the guidelines here →
• The French Data Protection Authority has published a post on a step-by-step method to safely carry-out data transfers outside the European Union. You can find the post here → (in French)
• The Danish Data Protection Authority issued guidelines on how to prevent and respond to ransomware attacks.Access the guidelines here →

2) Notable Case Law

• The Data Protection Authority of Luxembourg issued an €18,000 fine against a company, notably for insufficiently involving their Data Protection Officer (DPO) in operational issues and not giving them the necessary resources. The Authority identified eleven points to verify during an investigation on the role of the DPO within an organisation. Read the decision here →
• The Spanish Data Protection Authority issued a €3,000 fine against a website owner for the implementation of their cookie banner and cookie policy. The Authority’s decision notably ordered the company to allow the data subject to reject non-necessary cookies and for their choice to be respected. Read the decision and order to comply here →
• A company was fined €2,856,169.00 by the Italian Data Protection Authority for sending telemarketing emails without the data subject’s consent. The company had not sufficiently demonstrated a balance between the rights of the data subject and the website owner’s interests. Read the decision here →

3) New and Upcoming Legislation

• UK & European Union – The Commission has adopted the two adequacy decisions for the United Kingdom today. The Commission and the UK Authority (the ICO) have issued statements. Access the full decision here →
• Australia – The Senate voted in favour of the Online Safety Act. The Act would, for instance, regulate requests for content removal.

4) Strong Impact Tech

• Google has announced that their phasing-out of third-party cookies in the Chrome browser would be pushed back to 2023.
• Apple has issued a report on their restrictions for developers.

Other Key information from the past weeks :

• The European Data Protection Board (EDPB) has adopted final recommendations on measures that supplement the existing legal tools to transfer personal data.
• The European Data Protection Supervisor and the European Data Protection Board issued a joint opinion, calling for a ban on automated recognition of human features.
• The Spanish Data Protection Authority has issued a €1.200 fine against a radio station, notably for setting non-necessary cookies on their website before obtaining the user’s consent.