Yes. The GDPR anticipates that a company may process personal data as long as one (or more) of six lawful purposes applies. One of those lawful purposes relates to the collection of personal data about a person as part of...more
No. Although Article 30 of the GDPR states that companies must “maintain a record” of their processing activities, the provision contains an exemption for small businesses. Specifically, it states that if a company employs...more
A Berlin regional court recently ruled that Facebook’s use of personal data was illegal because the social media platform did not adequately secured the informed consent of its users. A German consumer rights group, the...more
The EU-US Privacy Shield, designed to protect EU citizens’ personal data when it is transferred to US organisations, has now been in place for a couple of months. How is it shaping up?...more
The European Union Article 29 Working Party (Article 29) issued an opinion on the proposed EU-U.S. Privacy Shield framework agreement (Privacy Shield) last month, stating that although the Privacy Shield was a “great step...more
Antitrust and competition - A welcome limitation on the investigatory powers of the Commission when requesting information from companies - On 10 March 2016, the Court of Justice of the European Union (“CJEU”) set aside...more
The Article 29 Working Party (The Working Party), which includes representative data protection authorities from each EU member country and the European Data Protection Supervisor, issued a 58-page opinion yesterday that...more