DPO Newsletter: Data Protection & Privacy News (issue #12)

We’ve compiled the latest in Data Protection and Privacy news for your convenience below.

1) Newly Published Documentation

• The Lithuanian and the Swiss Data Protection Authorities have issued their annual reports. Read the Lithuanian annual report here → (in Lithuanian) and the Swiss annual report here → / Tweet this →
• The Spanish Data Protection Authority has published Guidance on Risk management and impact assessment in personal data processing. Access them here → (in Spanish) / Tweet this →
• The European Data Protection Board has published a leaflet about its One-stop-shop for data protection enforcement. Open it by clicking here → / Tweet this →
• The South African Information Regulator has published Guidance on special categories of data. Open the Guidance here → / Tweet this →

2) Notable Case Law

• The Italian Data Protection Authority (Garante) issued a decision to fine a company €2.6 million for a lack of transparency and accuracy in their use of algorithms to manage employees. In addition to the fine, the Garante ordered the company to implement measures that protect employees from the risks resulting from automated decision-making (for instance, the right to obtain human intervention). The company was also ordered to verify the accuracy of the data fuelling the algorithm and to prevent discrimination in the systems based on customer feedback. Read the decision here → / Tweet this →
• The Norwegian Data Protection Authority (Datatilsynet) issued a decision to fine a company NOK 150,000 for failing to close and further accessing a former employee’s e-mail box after the termination of their contract. Read the decision here → / Tweet this →
• In the United States, after Accellion (a company used to securely transfer files) suffered a data breach, the Supermarket chain Kroger Co. agreed to pay $5 million in a settlement on behalf of about 3.82 million customers and employees. The company had been accused of not putting in place sufficient security measures to protect the processed data. Read the motion for a preliminary approval of the class action settlement here → / Tweet this →

3) New and Upcoming Legislation

• US (Maine) – A law was passed banning facial recognition in schools and by government officials and employees. It will come into force on the 1st of October 2021 / Tweet this →
• United Kingdom and Singapore – The negotiations for a digital economy agreement were launched / Tweet this →

4) Strong Impact Tech

• The French Data Protection Authority has issued a third version of its Data Protection Impact Assessment software / Tweet this →

Other Key information from the past weeks

• The European Commission has adopted the two adequacy decisions for the United Kingdom. The Commission and the UK Authority (the ICO) have issued statements / Tweet this →
• Google has announced that their phasing-out of third-party cookies in the Chrome browser would be pushed back to 2023 / Tweet this →