[{"innerBlocks":[],"postId":1279,"name":"core\/freeform","blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"},"metadata":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"blockHooks":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":" $\"\"$ \n\nThis quarterly update highlights some of the international data protection issues that have caught our attention, and the attention of our clients, in the past three months.\n\nEurope, the Middle East and Africa<\/strong>\n\nCookies and Tracking Technologies<\/strong> \u2013 On March 31, 2021, the revised guidelines<\/a> on cookies and trackers from the French data protection authority, the Commission nationale de l'informatique et des libert\u00e9s (CNIL), will be fully enforceable. The CNIL has already handed out<\/a> serious fines<\/a> for violations of France\u2019s law implementing the ePrivacy Directive, and it indicated earlier this month<\/a> that cookies violations remain a priority enforcement area in 2021, along with cybersecurity and health data protection. Businesses active in France should be prepared to comply by auditing their use of cookies, ensuring they obtain appropriate consents for nonessential cookies and modifying cookie banners in light of the CNIL\u2019s recommendations<\/a>, including through the use of a second-level cookie banner with granular cookies preference options. FAQs<\/a> and other information<\/a> published<\/a> on the CNIL\u2019s website offer additional clarity about what is needed for compliance. Adding to the already complex European cookies requirements, in February, the Danish data protection authority released its quick guide<\/a> for the use of cookies, which generally tracks the French guidance.\n\nData Breach Notification<\/strong> \u2013 The European Data Protection Board (EDPB) published new draft guidance<\/a> in January for data breach notification. This guidance presents examples typical of the most common data breach notification scenarios, according to European data protection authorities, including ransomware, data exfiltration attacks and lost or stolen devices. Responses from the public consultation on this draft guidance<\/a> are now available on the EDPB\u2019s website.\n\nHealth Data<\/strong> \u2013 In response to a request from the European Commission (EC), the EDPB published clarifications for consistent application of the General Data Protection Regulation (GDPR) when using personal data<\/a> for health research. The EC also published its assessment of EU member states rules on health data<\/a> under the GDPR. This assessment highlights the fragmented member state approaches to the implementation of health data laws and the negative impact on cross-border cooperation in the provision of healthcare, administration of healthcare systems, public health issues and research.\n\nDiscovery or Data Subject Access Request?<\/strong> \u2013 The Irish Data Protection Commission (DPC) published a statement in February to clarify a decision<\/a> from the Irish High Court related to document discovery in litigation. The High Court determined<\/a> that a business was not required to disclose CCTV recordings of an incident that occurred at the business to an individual identifiable in the recordings who was claiming damages related to the incident. As the DPC explained, the purpose of discovery is to give litigating parties access to information necessary to the matter before the court. The right to access one\u2019s own personal data applies whether an individual is involved in litigation or not.\n\nCompensable Damages and Fines Under the GDPR<\/strong> \u2013 In February, the German Federal Constitutional Court overturned a lower court decision<\/a> and sent a minor lawsuit to the Court of Justice of the European Union to determine the scope of compensable damages under the GDPR, including any materiality threshold under Article 82. Article 82 allows anyone who \u201chas suffered material or non-material damage\u201d as a result of a violation of the GDPR to receive compensation for the damage suffered. The lower court had determined that the individual who brought the lawsuit had not suffered compensable damages when one marketing email was sent without consent to his business email address. In a different German court challenge, the Berlin District Court overturned a fine<\/a> issued by the Berlin data protection authority due to the authority\u2019s failure to meet the requirements of German law, which sets a higher bar than the GDPR, namely that there must be evidence of a specific act by management or legal counsel that resulted in the fineable offense.\n\nU.K. Adequacy<\/strong> \u2013 The United Kingdom\u2019s post-Brexit adequacy decision moved forward with the EC\u2019s publication of its draft adequacy decision<\/a> in February. A finalized adequacy decision would help ensure the continuation of free data flows between the EU and the United Kingdom. The interim period during which free data flows may continue absent a final adequacy decision following Brexit will expire on June 30, 2021. Adequacy will not bring the United Kingdom back within the \u201cone-stop-shop\u201d mechanism<\/a> of the EU\u2019s GDPR. Businesses will also still need to consider appropriate data transfer mechanisms for any onward transfers from the United Kingdom to a third country. The United Kingdom has also developed its own process<\/a> for new adequacy decisions under the U.K. GDPR.\n\nEU Data Transfers<\/strong> \u2013 Many businesses remain in limbo with regard to data transfers following the Schrems II <\/em>decision<\/a> last summer. We continue to wait for finalized, revised Standard Contractual Clauses (SCCs)<\/a> from the EC. In January, the EDPB and the European Data Protection Supervisor (EDPS) issued a joint opinion on the draft cross-border SCCs<\/a> issued in November 2020. The joint opinion requested improvements related to liability provisions, onward personal data transfers, assessments of third-country laws and notifications to be provided to data protection authorities, among other issues. We also continue to wait for a finalized version of the EDPB\u2019s draft recommendations on supplemental transfer measures to ensure compliance with the EU level of protection of personal data<\/a>; the public consultation period ended in December 2020. Meanwhile, in France, a lawsuit has been filed<\/a> to try to force the CNIL to take action on a data transfer issue, and the Irish Data Protection Commission<\/a> has come under fire<\/a> for being slow to act<\/a> and not properly enforcing<\/a> the GDPR. DPA enforcement actions in Spain<\/a> and Germany<\/a> have recently targeted cross-border data transfers as well.\n\nRussia\u2019s Amended Law on Personal Data<\/strong> \u2013 On March 1, Russia\u2019s amendments to its Federal Law on Personal Data entered into force. According to a statement<\/a> from the Duma, these amendments add protections related to consent<\/a> and the deletion of personal data. In particular, consent by default, such as through inaction or silence, is no longer allowed. Rather, consent must be given directly through an affirmative action. Russia\u2019s Code of Administrative Offenses<\/a> also was amended in February to introduce new maximum penalties for personal data violations that take effect on March 27, 2021. Russia\u2019s data protection authority has proposed<\/a> adding new restrictions on cross-border data transfers and explicitly extending the scope of Russia\u2019s data protection laws to include Internet sites operated in other countries.\n\nAsia-Pacific<\/strong>\n\nChina\u2019s Civil Code<\/strong> \u2013 As of January 1, 2021, the Civil Code of the People\u2019s Republic of China (Civil Code<\/a>), which was adopted in May 2020, is now in effect. Notably, the Civil Code defines the right to privacy, lists activities that require consent and provides civil liabilities for infringing on an individual\u2019s privacy. Any business processing data is subject to the Civil Code\u2019s provisions, and a number of the new provisions relate to the collection, usage and other processing of personal data and the adoption of security measures. Many of the provisions of this new Civil Code are similar to existing provisions in China\u2019s Cybersecurity Law, but the Civil Code extends the Cybersecurity Law and introduces certain individual rights, such as the right to access, copy or correct personal information.\n\nSingapore\u2019s Personal Data Protection Act Amendments<\/strong> \u2013 Amendments to Singapore\u2019s Personal Data Protection Act<\/a> (PDPA) began to be implemented on February 1<\/a>. The amendments now in effect include new mandatory data breach notification requirements, changes to consent obligations and individual liability for certain data misuses. The Personal Data Protection Commission has updated its advisory guidance<\/a> to account for these changes now in effect.\n\nNew Zealand\u2019s Data Transfer Tools<\/strong> \u2013 In February, New Zealand issued revised guidance<\/a> for personal data transfers to third countries under the Privacy Act 2020, which includes two useful online tools. The first is a decision tree<\/a> with online questions to help businesses determine whether Principle 12 of the Privacy Act, which restricts overseas personal data transfers, is applicable. The second is a model clause builder<\/a> that customizes model clauses to cover the transfer, which creates an agreement that can be downloaded and completed by the parties.\n\nThe Americas<\/strong>\n\nBrazil and the LGPD<\/strong> \u2013 Currently, enforcement of Brazil\u2019s General Personal Data Protection Law (the Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais, or LGPD) appears set to begin on August 1, 2021, but two bills were introduced in February that might change that date. One bill<\/a> seeks immediate enforcement of the LGPD; the other<\/a> would extend the enforcement date into early 2022. Meanwhile, Brazil\u2019s new data protection authority (Autoridade Nacional de Prote\u00e7\u00e3o de Dados, or ANPD) has been steadily releasing new draft compliance guidance, including a recent public comment version of its guidance on data breach reporting procedures<\/a> under the LGPD. This guidance details the notification obligations of the data controller; what information must be provided to the ANPD, setting a deadline of two working days from incident awareness for notification; and when and how individuals need to be notified. Further, the Supreme Court of Brazil has called into question the constitutionality<\/a> of the LGPD\u2019s right to be forgotten<\/a>.\n\nPanama\u2019s New Data Protection Law<\/strong> \u2013 Panama\u2019s new Law No. 81 on Personal Data Protection<\/a> is effective on March 29, 2021. The law applies to public and private entities that process personal data. Among the law\u2019s provisions are requirements regarding international data storage, explicit consent and data retention obligations.\n\nSelected Enforcement Actions<\/strong>\n
\n \t
The French CNIL fined a controller (\u20ac150,000) and a processor (\u20ac75,000)<\/a> for the same incident related to repeat credential stuffing attacks that were not properly mitigated in a timely manner through the implementation of sufficient security measures.<\/li>\n \t
The South Korean regulator, the Personal Information Protection Committee (PIPC), has issued several recent fines related to data breaches, at least one of which had been undiscovered prior to an audit<\/a> by the Korean Internet and Security Agency (a pseudo-governmental organization). The company\u2019s report to PIPC following the discovery led to the fine. Another fine highlighted a lack of security measures<\/a> that led to the data breach, including inadequate access rights and insufficient encryption.<\/li>\n \t
The data protection authority of the German state of Lower Saxony fined a retailer \u20ac10.4 million for its employee video monitoring practices<\/a>. The retailer claimed the video monitoring was implemented to prevent employee theft, but the Lower Saxon data protection authority found this to be an insufficient legal basis for the video monitoring. Specifically, less-intrusive methods could have been used initially that would not have affected the retailer\u2019s customers, and 60 days was too long to retain the videos. The data protection authority reminded the retailer that video monitoring for crime deterrence is only allowed on the basis of a specific suspicion.<\/li>\n \t
The U.K.\u2019s Information Commissioner\u2019s Office (ICO) issued a \u20ac250,000 fine under the U.K.\u2019s Privacy and Electronic Communications Regulations 2003<\/a> to a company that sent more that 2.6 million \u201cnuisance text messages\u201d to individuals without their consent. The company intentionally created a text message that appeared to come from a different company to mislead recipients. More than 10,000 individuals lodged complaints related to the original text messages. According to the ICO<\/a>, the company then continued to send texts during and after the ICO\u2019s investigation and failed to cooperate completely with the investigation.<\/li>\n \t
The Spanish data protection authority (Agencia Espa\u00f1ola de Protecci\u00f3n de Datos, or AEPD), which has been particularly active in the enforcement space so far this year, fined a telecommunications provider \u20ac8.15 million<\/a> for unlawful telemarketing, including phone calls, emails and text messages. In its decision, the AEPD cited the company\u2019s failure to implement appropriate security measures, violations of individuals\u2019 rights under the GDPR and relevant Spanish law, and international data transfers without an approved data transfer mechanism. The AEPD issued another large fine related to data transfers in January when it fined a bank \u20ac6 million<\/a> for improper customer consents to intracompany data transfers.<\/li>\n<\/ul>","saveContent":" $\"\"$ \n\nThis quarterly update highlights some of the international data protection issues that have caught our attention, and the attention of our clients, in the past three months.\n\nEurope, the Middle East and Africa<\/strong>\n\nCookies and Tracking Technologies<\/strong> \u2013 On March 31, 2021, the revised guidelines<\/a> on cookies and trackers from the French data protection authority, the Commission nationale de l'informatique et des libert\u00e9s (CNIL), will be fully enforceable. The CNIL has already handed out<\/a> serious fines<\/a> for violations of France\u2019s law implementing the ePrivacy Directive, and it indicated earlier this month<\/a> that cookies violations remain a priority enforcement area in 2021, along with cybersecurity and health data protection. Businesses active in France should be prepared to comply by auditing their use of cookies, ensuring they obtain appropriate consents for nonessential cookies and modifying cookie banners in light of the CNIL\u2019s recommendations<\/a>, including through the use of a second-level cookie banner with granular cookies preference options. FAQs<\/a> and other information<\/a> published<\/a> on the CNIL\u2019s website offer additional clarity about what is needed for compliance. Adding to the already complex European cookies requirements, in February, the Danish data protection authority released its quick guide<\/a> for the use of cookies, which generally tracks the French guidance.\n\nData Breach Notification<\/strong> \u2013 The European Data Protection Board (EDPB) published new draft guidance<\/a> in January for data breach notification. This guidance presents examples typical of the most common data breach notification scenarios, according to European data protection authorities, including ransomware, data exfiltration attacks and lost or stolen devices. Responses from the public consultation on this draft guidance<\/a> are now available on the EDPB\u2019s website.\n\nHealth Data<\/strong> \u2013 In response to a request from the European Commission (EC), the EDPB published clarifications for consistent application of the General Data Protection Regulation (GDPR) when using personal data<\/a> for health research. The EC also published its assessment of EU member states rules on health data<\/a> under the GDPR. This assessment highlights the fragmented member state approaches to the implementation of health data laws and the negative impact on cross-border cooperation in the provision of healthcare, administration of healthcare systems, public health issues and research.\n\nDiscovery or Data Subject Access Request?<\/strong> \u2013 The Irish Data Protection Commission (DPC) published a statement in February to clarify a decision<\/a> from the Irish High Court related to document discovery in litigation. The High Court determined<\/a> that a business was not required to disclose CCTV recordings of an incident that occurred at the business to an individual identifiable in the recordings who was claiming damages related to the incident. As the DPC explained, the purpose of discovery is to give litigating parties access to information necessary to the matter before the court. The right to access one\u2019s own personal data applies whether an individual is involved in litigation or not.\n\nCompensable Damages and Fines Under the GDPR<\/strong> \u2013 In February, the German Federal Constitutional Court overturned a lower court decision<\/a> and sent a minor lawsuit to the Court of Justice of the European Union to determine the scope of compensable damages under the GDPR, including any materiality threshold under Article 82. Article 82 allows anyone who \u201chas suffered material or non-material damage\u201d as a result of a violation of the GDPR to receive compensation for the damage suffered. The lower court had determined that the individual who brought the lawsuit had not suffered compensable damages when one marketing email was sent without consent to his business email address. In a different German court challenge, the Berlin District Court overturned a fine<\/a> issued by the Berlin data protection authority due to the authority\u2019s failure to meet the requirements of German law, which sets a higher bar than the GDPR, namely that there must be evidence of a specific act by management or legal counsel that resulted in the fineable offense.\n\nU.K. Adequacy<\/strong> \u2013 The United Kingdom\u2019s post-Brexit adequacy decision moved forward with the EC\u2019s publication of its draft adequacy decision<\/a> in February. A finalized adequacy decision would help ensure the continuation of free data flows between the EU and the United Kingdom. The interim period during which free data flows may continue absent a final adequacy decision following Brexit will expire on June 30, 2021. Adequacy will not bring the United Kingdom back within the \u201cone-stop-shop\u201d mechanism<\/a> of the EU\u2019s GDPR. Businesses will also still need to consider appropriate data transfer mechanisms for any onward transfers from the United Kingdom to a third country. The United Kingdom has also developed its own process<\/a> for new adequacy decisions under the U.K. GDPR.\n\nEU Data Transfers<\/strong> \u2013 Many businesses remain in limbo with regard to data transfers following the Schrems II <\/em>decision<\/a> last summer. We continue to wait for finalized, revised Standard Contractual Clauses (SCCs)<\/a> from the EC. In January, the EDPB and the European Data Protection Supervisor (EDPS) issued a joint opinion on the draft cross-border SCCs<\/a> issued in November 2020. The joint opinion requested improvements related to liability provisions, onward personal data transfers, assessments of third-country laws and notifications to be provided to data protection authorities, among other issues. We also continue to wait for a finalized version of the EDPB\u2019s draft recommendations on supplemental transfer measures to ensure compliance with the EU level of protection of personal data<\/a>; the public consultation period ended in December 2020. Meanwhile, in France, a lawsuit has been filed<\/a> to try to force the CNIL to take action on a data transfer issue, and the Irish Data Protection Commission<\/a> has come under fire<\/a> for being slow to act<\/a> and not properly enforcing<\/a> the GDPR. DPA enforcement actions in Spain<\/a> and Germany<\/a> have recently targeted cross-border data transfers as well.\n\nRussia\u2019s Amended Law on Personal Data<\/strong> \u2013 On March 1, Russia\u2019s amendments to its Federal Law on Personal Data entered into force. According to a statement<\/a> from the Duma, these amendments add protections related to consent<\/a> and the deletion of personal data. In particular, consent by default, such as through inaction or silence, is no longer allowed. Rather, consent must be given directly through an affirmative action. Russia\u2019s Code of Administrative Offenses<\/a> also was amended in February to introduce new maximum penalties for personal data violations that take effect on March 27, 2021. Russia\u2019s data protection authority has proposed<\/a> adding new restrictions on cross-border data transfers and explicitly extending the scope of Russia\u2019s data protection laws to include Internet sites operated in other countries.\n\nAsia-Pacific<\/strong>\n\nChina\u2019s Civil Code<\/strong> \u2013 As of January 1, 2021, the Civil Code of the People\u2019s Republic of China (Civil Code<\/a>), which was adopted in May 2020, is now in effect. Notably, the Civil Code defines the right to privacy, lists activities that require consent and provides civil liabilities for infringing on an individual\u2019s privacy. Any business processing data is subject to the Civil Code\u2019s provisions, and a number of the new provisions relate to the collection, usage and other processing of personal data and the adoption of security measures. Many of the provisions of this new Civil Code are similar to existing provisions in China\u2019s Cybersecurity Law, but the Civil Code extends the Cybersecurity Law and introduces certain individual rights, such as the right to access, copy or correct personal information.\n\nSingapore\u2019s Personal Data Protection Act Amendments<\/strong> \u2013 Amendments to Singapore\u2019s Personal Data Protection Act<\/a> (PDPA) began to be implemented on February 1<\/a>. The amendments now in effect include new mandatory data breach notification requirements, changes to consent obligations and individual liability for certain data misuses. The Personal Data Protection Commission has updated its advisory guidance<\/a> to account for these changes now in effect.\n\nNew Zealand\u2019s Data Transfer Tools<\/strong> \u2013 In February, New Zealand issued revised guidance<\/a> for personal data transfers to third countries under the Privacy Act 2020, which includes two useful online tools. The first is a decision tree<\/a> with online questions to help businesses determine whether Principle 12 of the Privacy Act, which restricts overseas personal data transfers, is applicable. The second is a model clause builder<\/a> that customizes model clauses to cover the transfer, which creates an agreement that can be downloaded and completed by the parties.\n\nThe Americas<\/strong>\n\nBrazil and the LGPD<\/strong> \u2013 Currently, enforcement of Brazil\u2019s General Personal Data Protection Law (the Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais, or LGPD) appears set to begin on August 1, 2021, but two bills were introduced in February that might change that date. One bill<\/a> seeks immediate enforcement of the LGPD; the other<\/a> would extend the enforcement date into early 2022. Meanwhile, Brazil\u2019s new data protection authority (Autoridade Nacional de Prote\u00e7\u00e3o de Dados, or ANPD) has been steadily releasing new draft compliance guidance, including a recent public comment version of its guidance on data breach reporting procedures<\/a> under the LGPD. This guidance details the notification obligations of the data controller; what information must be provided to the ANPD, setting a deadline of two working days from incident awareness for notification; and when and how individuals need to be notified. Further, the Supreme Court of Brazil has called into question the constitutionality<\/a> of the LGPD\u2019s right to be forgotten<\/a>.\n\nPanama\u2019s New Data Protection Law<\/strong> \u2013 Panama\u2019s new Law No. 81 on Personal Data Protection<\/a> is effective on March 29, 2021. The law applies to public and private entities that process personal data. Among the law\u2019s provisions are requirements regarding international data storage, explicit consent and data retention obligations.\n\nSelected Enforcement Actions<\/strong>\n
\n \t
The French CNIL fined a controller (\u20ac150,000) and a processor (\u20ac75,000)<\/a> for the same incident related to repeat credential stuffing attacks that were not properly mitigated in a timely manner through the implementation of sufficient security measures.<\/li>\n \t
The South Korean regulator, the Personal Information Protection Committee (PIPC), has issued several recent fines related to data breaches, at least one of which had been undiscovered prior to an audit<\/a> by the Korean Internet and Security Agency (a pseudo-governmental organization). The company\u2019s report to PIPC following the discovery led to the fine. Another fine highlighted a lack of security measures<\/a> that led to the data breach, including inadequate access rights and insufficient encryption.<\/li>\n \t
The data protection authority of the German state of Lower Saxony fined a retailer \u20ac10.4 million for its employee video monitoring practices<\/a>. The retailer claimed the video monitoring was implemented to prevent employee theft, but the Lower Saxon data protection authority found this to be an insufficient legal basis for the video monitoring. Specifically, less-intrusive methods could have been used initially that would not have affected the retailer\u2019s customers, and 60 days was too long to retain the videos. The data protection authority reminded the retailer that video monitoring for crime deterrence is only allowed on the basis of a specific suspicion.<\/li>\n \t
The U.K.\u2019s Information Commissioner\u2019s Office (ICO) issued a \u20ac250,000 fine under the U.K.\u2019s Privacy and Electronic Communications Regulations 2003<\/a> to a company that sent more that 2.6 million \u201cnuisance text messages\u201d to individuals without their consent. The company intentionally created a text message that appeared to come from a different company to mislead recipients. More than 10,000 individuals lodged complaints related to the original text messages. According to the ICO<\/a>, the company then continued to send texts during and after the ICO\u2019s investigation and failed to cooperate completely with the investigation.<\/li>\n \t
The Spanish data protection authority (Agencia Espa\u00f1ola de Protecci\u00f3n de Datos, or AEPD), which has been particularly active in the enforcement space so far this year, fined a telecommunications provider \u20ac8.15 million<\/a> for unlawful telemarketing, including phone calls, emails and text messages. In its decision, the AEPD cited the company\u2019s failure to implement appropriate security measures, violations of individuals\u2019 rights under the GDPR and relevant Spanish law, and international data transfers without an approved data transfer mechanism. The AEPD issued another large fine related to data transfers in January when it fined a bank \u20ac6 million<\/a> for improper customer consents to intracompany data transfers.<\/li>\n<\/ul>","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"},"metadata":{"type":"object"}},"dynamicContent":null}]

International Data Protection Update – First Quarter 2021