We’ve compiled the latest in Data Protection and Privacy news for your convenience below.

1) Newly Published Documentation

The US Federal Trade Commission (FTC) has published a Privacy and Data Security Update summarising some of its recent enforcement actions in the US. Available here →
The Irish Data Protection Authority has published a summary of its 2020 and 2021 decisions. Read the decision here →
The Brazilian Data Protection Authority has published a Guidance which specifies the role of the Data Controllers and of Data Protection Officers. Guidance available here → (in Portuguese)

2) Notable Case Law

The European Court of Human Rights delivered a judgment on the UK’s bulk interception of communications regime, which was notably found to be in violation of Articles 8 and 10 of the European Convention. Read the judgment here →
The Italian High Court issued a judgment (Garante per la Protezione dei Dati Personali v. Associazione Mevaluate Onlus) stating that a company had used Artificial Intelligence tools based on invalid consent; users were not sufficiently informed before granting their consent. The case was referred back to the court of Rome. Read the judgment here → (available in Italian)
The Data Protection Authority from Baden-Württemberg opened proceedings against the company Face Recognition Solutions Ltd and its mass collection of biometric information. Read the press release here → (available in German)

United States (Colorado) – the Colorado Senate has unanimously passed the Colorado Privacy Bill, it will now move to the House. The legislative session will close on June 12th. Track the Bill’s progress here →
United Kingdom – the Government has issued a response to the National Data Strategy consultation. The ICO’s Data Sharing Code of Practice was also laid before Parliament for forty days before coming into force.
France – The CNIL has opened a consultation on its draft recommendations for the conservation of logging data.

The NGO noyb.eu has sent out over 500 draft complaints to website owners for their implementation of cookie banners which, they argue, would violate GDPR principles by making it unnecessarily complicated for users to express their consent preferences. The draft complaints were accompanied by a guide to comply. It also gave companies a month to change their cookie banner practices before an official GDPR complaint would be filed. Read more about the campaign here →

In Germany, the data protection and privacy law for regulating telecommunications and telemedia was passed by the Assembly.
The Italian Data Protection Authority (the Garante) has issued Guidelines and FAQs clarifying the role of the Data Protection Officer.
The European Data Protection Board (EDPB) has adopted two Opinions on the first transnational Code of Conduct.