Loading

Category: Privacy

Previous Standard Contractual Clauses can no longer be used: CNIL issues reminder

CNIL of France recently issued a reminder that the previous Standard Contractual Clauses can no longer be used for the transfer of data outside of the EU. CNIL of France has recently issued a reminder that the old Standard Contractual Clauses (SCCs) can no longer be used, as of 27th December. Data exporters and importers

Controller Binding Corporate Rules: New recommendations from the EDPB

The EDPB recently published Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules.   The European Data Protection Board (EDPB) has recently adopted recommendations for the Controller Binding Corporate Rules (BCR-Cs) during their November plenary. The document includes recommendations on the Application for

Processor Code of Conduct published by LfDI of Baden-Württemberg, Germany

Baden-Württemberg DPA, LfDI has published a Processor Code of Conduct to aid data processors with self regulation.    The DPA of Baden-Württemberg, Germany has published a code of conduct for processors, providing more legal certainty with regard to data processing under the GDPR. Businesses and organisations within Germany and in general within the EU, who

Guidance on international transfers from the ICO

The UK’s ICO has published guidance on international transfers for businesses and organisations which process personal data.   In the aftermath of the publishing of the International Data Transfer Agreement (IDTA) and the Addendum to the European Union Standard Contractual Clauses (SCCs), the ICO has published guidance on international data transfers. This guidance includes a

Processing of health data by complementary health insurance providers: CNIL calls for further clarification

CNIL calls for clarification regarding the processing of health data by complementary health insurance providers in the face of several complaints.   CNIL calls for clarification regarding which conditions under which complementary health insurance providers are allowed to collect health data, after receiving several complaints regarding the legality of these insurance providers receiving data generated

GPS tracking must be appropriate and necessary

Slovenia SA rules that while the security of property can be a legitimate interest for GPS tracking, it must be appropriate and necessary.    The Slovenian Supervisory Authority (SA) determined that a data controller which engaged in GPS tracking of eight company vehicles, did not have a legal basis to do so, according to this

UK Department for Education reprimanded by the ICO

The ICO has issued a reprimand to the UK Department for Education, relating to the misuse of personal information of children.   Following an investigation into the use of a database of pupils’ learning records by Trust Systems Software UK Limited, the ICO believes this to be a case of poor diligence on the part

Brecha Advisory tool launched by AEPD

The AEPD has launched the Brecha Advisory tool to facilitate compliance with data protection laws by data controllers and processors.   The AEPD has launched the Brecha Advisory tool, which is intended to guide the application of the Spanish data protection legislation to facilitate compliance by data controllers and processors. This tool provides advice on

Guidelines on the use of AI and data in teaching and learning for teachers

The European Commission has published guidelines on the use of AI and data in teaching and learning for teachers.   As the field of AI rapidly develops, it has the potential to change our lives and transform the way we work, live, and learn. The development of AI is also an opportunity to address many

Electronic mail marketing: Guidance from the ICO on achieving compliance with PECR

The ICO released guidance on electronic mail marketing, to help organisations achieve compliance with the PECR.   Earlier this month, Aphaia reported on guidance published by the ICO for organisations regarding live phone calls made for marketing purposes, to help organisations to remain in compliance with the Privacy and Electronic Communications Regulations (PECR), also known