Observations on Office Re – Engineering: Privacy Offices and Research Offices

Earlier today I had the opportunity to watch the highly useful IAPP webinar entitled What Works: Benchmarking and Improving your Privacy Program. I was particularly intrigued by the comments directed at improving / re - engineering a privacy office. The presenters emphasized the constant evolution of privacy regimes on a global scale, and that today … Continue reading Observations on Office Re – Engineering: Privacy Offices and Research Offices

Tiktok moves under control of Irish DPC

From 29 July 2020 onwards, Tiktok Ireland will control the data of all users in the EEA and Switzerland. Nothing specific, just another smart move of a non-EEA company (parental company Tiktok Inc incorporated in the US) in an attempt to use one-stop-shop mechanism via its EEA subsidiaries. Except for one thing. The recent French … Continue reading Tiktok moves under control of Irish DPC

An interesting twist in the ‘cookie walls’ saga.

France's Council of State has ordered the CNIL (French data protection watchdog) to cancel parts of its guidelines on cookies as the ban on cookies walls was not valid. The court explained that the CNIL exceeded its specific mandate under an act called "flexible law" which refers to instruments, such as regulatory authorities' guidelines, which … Continue reading An interesting twist in the ‘cookie walls’ saga.

Breaking news: EDPB has published the “one-stop-shop” decision register.

Being a great tool for privacy pros to keep up to date with extensive case law, it also increases the overall awareness of how data protection laws are applied in cooperation between the lead DPA and the other DPAs concerned (the GDPR Article 60). As I expect more comments on this occasion in the days/weeks … Continue reading Breaking news: EDPB has published the “one-stop-shop” decision register.

PwC vs. employee privacy

PwC developed a facial recognition tool that logs when employees are absent from their computer screens while they work from home. In particular, there have to be a specific excuse for any absence (including toilet breaks). Too invasive? No doubt. Disproportionate with no likely legal grounds? WP29 Opinion 2/2017 on data processing at work suggests … Continue reading PwC vs. employee privacy

Interplay between the GDPR Articles 25 (‘Data protection by design’, DPbD) and 35 (DPIA).

One is not a ‘special case’ of another as it may seem prima facie. The KEY consideration here is that DPIA is conducted prior to rolling out new projects implying data processing operations posing a high risk and thus tailored specifically to them. In contrast, DPbD comes into play at the very earliest stage of … Continue reading Interplay between the GDPR Articles 25 (‘Data protection by design’, DPbD) and 35 (DPIA).

Status of non-EU processors under Article 3(2) GDPR

A thorough analysis of clear things and grey zones of the EDPB Guidelines 3/2018 on territorial scope. My attention was, in particular, drawn by a friendly reminder that a status of a non-EU processor is dual as per Article 3(2): it is indirectly influenced by the GDPR if carries out processing on behalf of a … Continue reading Status of non-EU processors under Article 3(2) GDPR

Ticking time-bomb in the EDPB Guidelines on consent?

An old issue each privacy pro learnt by heart: "risk of negative consequences (e.g. substantial extra costs)" for data subject = no freely-given consent.  Substantial. But what if extra costs are not substantial? What if, say, 10$ turns into 11$ if you refuse to consent? Is it ok?  At leats, German watchdog seems to say … Continue reading Ticking time-bomb in the EDPB Guidelines on consent?

CJEU & legitimate interest in scope: what the controller should remember of.

CJEU gave the Judgement in the course of a preliminary ruling on whether Articles 6(1)(c) and 7(f) of the Data Protection Directive (95/46/EC) precluded national law from allowing installation of a CCTV system in the common parts of a residential building, relying on a legitimate interest (Case C-708/18).   The overall answer is "No, it … Continue reading CJEU & legitimate interest in scope: what the controller should remember of.

‘Privacy by design’: does all begin with corporate privacy culture?

In scope - a useful hands-on guidance from IAPP authors for privacy pros on what to focus when taking very first steps to internalize PbD principle. It may come as a surprise for us being buried under tons of privacy-related papers that the author suggests to begin with the inner privacy culture and getting C-level … Continue reading ‘Privacy by design’: does all begin with corporate privacy culture?