EU-U.S. Privacy Shield Review Report Outlines Steps To Improve Enforcement and Monitor Compliance

The Privacy Shield – a mechanism by which U.S. companies can legally transfer data to the European Union, continues to draw the attention of regulators and policymakers. On December 19, 2018, the European Commission (the Commission) announced the publication of its report on the second annual review of the EU-U.S. Privacy Shield. The report offers companies insight into what aspects of the Privacy Shield officials find most important and what steps are planned to strengthen…

READ MORE

Belgian Data Protection Authority Publishes Review of Post-GDPR Activity

The Belgian Data Protection Authority (Belgian DPA) published a review of its activities in the six months since the EU General Data Protection Regulation (GDPR) took effect on May 25, 2018. This early report offers a window into the impact of the GDPR on companies, the public and the activity of at least one regulator’s office.  The review, available in French and Dutch, notes that since the GDPR came into force, the Belgian DPA has…

READ MORE

Achieved Chats: Takeaways: 40th International Conference of Data Protection and Privacy Commissioners

Achieved Compliance hosted the third installment in our series of “Achieved Chats” informal webinars on Tuesday, November 13, 2018. We discussed important takeaways from the 40th International Conference of Data Protection and Privacy Commissioners held recently in Brussels and touched on some of the ethical issues surrounding artificial intelligence.

READ MORE

Data Regulators Focus on Artificial Intelligence and Data Ethics at Annual International Meeting in Brussels

Achieved Compliance attended the 40th Annual International Conference of Data Protection and Privacy Commissioners which convened this year in Brussels. This meeting is the largest and most significant gathering of data protection authorities in the world. It provides an important window on the status of data protection law and regulation, the impact of new technology on privacy and what is top of mind for regulators. While companies continue to grapple with the requirements of the General Data…

READ MORE

European Data Protection Supervisor Predicts Sanctions Coming Soon for Violations of General Data Protection Regulation

Regulators in the European Union could impose sanctions for violations of the General Data Protection Regulation (GDPR) as soon as by the end of 2018, according to European Data Protection Supervisor Giovanni Buttarelli. According to a Reuter’s news report, Butarelli said in an interview, “I expect first GDPR fines for some cases by the end of the year. Not necessarily fines but also decisions to admonish the controllers, to impose a preliminary ban, a temporary…

READ MORE

U.S. Federal Trade Commission Begins Hearings on Competition and Consumer Protection in the 21st Century

On September 13 and 14, the Federal Trade Commission (FTC), together with Georgetown University Law Center, will co-sponsor the first in a series of Hearings on Competition and Consumer Privacy in the 21st Century. These public forums will consider whether changes in the economy, technology, and emerging business practices warrant changes to law, enforcement and policy. Specifically, they will consider whether these changes require expansion of the FTC’s enforcement power over corporate privacy practices. At…

READ MORE

Article 29 Working Party Provides Important Guidance about Data Protection Impact Assessments

Data Protection Impact Assessments (DPIAs) are critical to companies’ successful compliance with the General Data Protection Regulation (GDPR), and to their efforts to establish responsible, effective data governance within their organizations. Article 35 of the GDPR requires companies to conduct a DPIA when processing is likely to raise “high risk” to individuals. On August 6, we blogged about the advice of the Belgian data protection authority on this aspect of the GDPR. But the Belgian…

READ MORE

Belgian Privacy Commission Issues Recommendation on Data Protection Impact Assessments

An important aspect of the General Data Protection Regulation (GDPR) that may be new to companies is the requirement set forth in Articles 35 and 36 that they conduct data protection impact assessments (DPIAs) when embarking on new data processing activities. While some organizations may have experience with DPIAs, often referred to as Privacy Impact Assessments in the United States, many may be unfamiliar with how they should be carried out and what data protection…

READ MORE