European Data Protection Board Publishes Frequently Asked Questions on Schrems II Decision

European Data Protection Board Publishes Frequently Asked Questions on Schrems II Decision   On July 24, 2020, the European Data Protection Board (the “EDPB”) published Frequently Asked Questions (the “FAQs”) on the judgment of the Court of Justice of the European Union (the “CJEU”) in the Schrems II case (case C-311/18).   In its judgment, handed down on July 16, 2020 (ACS Blog Summary) the CJEU upheld the validity of the Standard Contractual Clauses (the “SCCs”) the European Commission issued to support the lawful transfer of personal data to data processors outside of the EU.  At the same time, it struck down the EU-U.S. Privacy Shield framework. The FAQ responds to some of the many questions the Schrems II ruling raises:  The decision allows for no grace period for…

READ MORE

German Data Protection Authority. No Grace Period on EEA Data Transfers to the US

German Data Protection Authority. No Grace Period on EEA Data Transfers to the US On July 28, 2020, German supervisory authorities (Datenschutzkonferenz, the “DSK”) issued a statement emphasizing that organizations that rely on Standard Contractual Clauses (“SCCs”) or Binding Corporate Rules (BCRs”) must implement additional safeguards to lawfully transfer personal data to third countries.  In keeping with the Court of Justice of the European Union  CJEU’s judgment of 7/16, and the European Data Protection Board EDPB FAQ Memo of 7/20, the German DSK statement affirmed it’s intent of enforcing GDPR under the framework of the Court’s ruling, and with no grace period to comply.  The highlights of the German DSK statement are:  Organizations receiving transfers of EU Personal Data outside of the European Economic Area…

READ MORE

Court of Justice of the European Union Invalidates the EU-U.S. Privacy Shield, Finds Standard Contractual Clauses Valid

The Court of Justice of the European Union (CJEU) in a surprise decision invalidated the U.S. Privacy Shield in a case called, Schrems II – a decision important to all companies doing business in the EU and collecting personal data about its residents. It found that the Standard Contractual Clauses (SCC) issued by the European Commission to support the lawful transfer of personal data to processors established outside of the EU are valid. At the same time, the Court unexpectedly invalidated the EU-U.S. Privacy Shield framework. This decision will require companies to re-examine their approach to transferring data between the U.S and the EU. Background In 2015 Max…

READ MORE

Data Protection Conference in Tirana Forecasts an International Focus in 2020 on Converging Privacy Laws and Accountability

Last fall, the International Data Protection and Privacy Commissioners’ Conference convened in Tirana, Albania. Achieved Compliance once again participated in this annual meeting, which brings together regulators, experts, advocates and practitioners from around the globe. By attending this meeting, Achieved Compliance benefits from the opportunity to understand what concerns data protection authorities and on what issues they will focus their attention over the coming year. The theme of this year’s meeting was Convergence and Connectivity:  Raising Global Data Protection Standards in the Digital Age. The conference posed the questions – How are laws converging, and what factors are driving convergence? What are the challenges in building more convergence…

READ MORE
Dutch DPA Report

Dutch Report Provides a Window on GDPR-Related Complaints and DPA Response

On September 9, 2019, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, the Dutch DPA) published a report on privacy complaints it received between January 2019 and June 2019. The report reviews the rate of consumer complaint activity since the enactment of the GDPR, the nature of those complaints, and how they are handled by the Dutch data authority. Overview of the Dutch DPA Report During the first half of 2019, just over 19,000 individuals and organizations contacted the Dutch DPA with concerns and questions related to the European Union’s (EU) General Data Protection Regulation (GDPR) or other privacy-related concerns. Of these, the Dutch DPA identified 15,313 inquiries as privacy complaints,…

READ MORE