On May 17, the Future of Privacy Forum launched a new report on enforcement of the EU’s GDPR Data Protection by Design and by Default (DPbD&bD) obligations, which are outlined in GDPR Article 25. The Report draws from more than 92 data protection authority (DPA) cases, court rulings,

The EU Parliament’s Committees have agreed on the AI Act. However, Google’s decision to postpone the launch of Bard in the European Union prompts questions about the direction we’re headed in. The Compromise Text on the EU AI Act regulates Foundation Models (like ChatGPT, GPT4, Palm, etc.

The mere violation of the GDPR does not entitle per se to compensation, but it is not necessary for the damage suffered to reach a certain threshold of severity to produce a right to compensation. These are the conclusions reached by the Court of Justice of the European Union (CJEU)

Spain's data protection authority, the Agencia Española de Protección de Datos, published a guide for cryptographic systems as a data protection security measure in partnership with the Spanish Association for the Promotion of Information Security and Spanish Professional Association for Privacy. The guide states "encryption will be an adequate security

Dispute following inspection request The issue concerns a dispute between a consumer and the privacy regulator in Austria. The consumer had made an inspection request to a business consultancy firm that issues reports on creditworthiness (solvency). In response, the consumer had been provided with an overview of the personal data

Pseudnomized data might lead to anonymity, according to a recent ruling of the European General Court that can potentially have a massive impact on data protection compliance and sharing of (originally) personal data in the life sciences, banking, and any other sector. In the decision of April 26, 2023, T-557/

Background: damages under the AVG Article 82 of the AVG provides that any person who has suffered material or immaterial damage as a result of a breach of the AVG is entitled to damages. In legal practice, the application of this provision has been frequently discussed since the introduction of

The use of artificial intelligence (AI) is accelerating. So is the need to ensure that AI systems are not only effective, but also fair, non-discriminatory, transparent, rights-based, accountable, and sustainable – in short, responsible https://edri.org/our-work/moving-from-empty-buzzwords-to-real-empowerment-a-framework-for-enabling-meaningful-engagement-of-external-stakeholders-in-ai/

Data controllers need to rely on a “legal basis” in order to process personal data lawfully. It is essential to identify the appropriate legal basis as it may come with specific requirements (e.g. consent must be free, specific, informed and unambiguous) and have consequences on individuals’ rights (e.g.

Authors: Verena Grentzenberg, Andreas Rüdiger, Ludwig Lauer In his Opinion of 27.04.2023 (C 340/21), the Advocate General of the European Court of Justice (“ECJ”) commented on the interpretation of the civil non-material right to damages pursuant to Article 82 (1) GDPR as well as on the requirements

The EDPB has launched a Data Protection Guide to help small business owners on their way to become more data protection compliant. The Guide aims to raise awareness about the GDPR and to provide practical information to SMEs about GDPR compliance in an accessible and easily understandable format. Andrea Jelinek

Adv. Rivki Dvash with the assistance of Mr. Guy Zomer1The Future of Privacy Forum’s office in Tel Aviv (Israel Technology Policy Institute – ITPI) sought to examine the judicial decisions in civil actions under Israel’s Privacy Law, which includes rules that regulate data protection. We examined the extent to

The General Data Protection Regulation (GDPR) requires Data Controllers to maintain a Record of Processing Activities (RoPA) containing specific information. Controllers and processors must be able to provide these records to the Data Protection Commission (DPC) upon request. A well-drafted RoPA demonstrates compliance with the principle of accountability set out

On March 14, 2023, the European Parliament approved the bill for the Data Act, legislation that is part of the European data strategy and aims to contribute to the development of new digital services through increased data sharing, with a considerable impact on trade secrets. Below are the most relevant

On April 20, 2023, the Ministry of Education, Culture and Science informed the House of Representatives how an earlier AP opinion on the use of Google products in education was followed up. The parliamentary letter also named some additional findings about the use of Google products. It is good that

Italy's data protection authority, the Garante, published an information page on dark patterns. The Garante said the resource explores the "increasingly widespread phenomenon" of deceptive design patterns that are "still unknown to most users of digital services" and is "part of a large information and awareness project on data protection,

Italy's data protection authority, the Garante, published an information page on dark patterns. The Garante said the resource explores the "increasingly widespread phenomenon" of deceptive design patterns that are "still unknown to most users of digital services" and is "part of a large information and awareness project on data protection,

Digital tracking pixels and similar technologies are posing an increasing cybersecurity risk, Corvus Insurance Senior Vice President of Risk and Response Lauren Winchester writes in InfoSecurity Magazine. Law firms, regulators and insurers are paying heightened attention to the tracking pixels' vulnerabilities when they assess a company's risk. Winchester said companies

Following public consultation, the EDPB has adopted a final version of the Guidelines on data subject rights - Right of access. The Guidelines analyse the various aspects of the right of access and provide more precise guidance on how the right of access has to be implemented in different situations.

Alessandra Silveira (Editor) ▪            1) What is new about this process? Article 22 GDPR is finally being considered for before the European Court of Justice (ECJ) – and on 16 March 2023, the Advocate General’s Opinion in Case C-634/21 [SCHUFA Holding and Others (Scoring)][1] was published. Article 22 GDPR

The ruling concerns a dispute between market researcher Blauw and ICT service provider Nebu. Blauw uses the services of Nebu. A cyber attack took place at Nebu, during which data was stolen. Nebu informed its clients about this (to a limited extent); however, Blauw demanded more information. Thereupon Blauw initiated

Alongside the traditional profiles of civil liability for human acts, we must confront the legal profiles of civil liability arising from the use of artificial intelligence (AI) systems. Artificial intelligence systems are reaching increasingly advanced levels of autonomy, also thanks to the boost given by generative AI systems with the

Over the last few months, we have seen generative AI systems and Large Language Models (LLMs), like OpenAI’s ChatGPT, Google Bard, Stable Diffusion, and Dall-E, send shockwaves throughout society. Companies are racing to bake AI features into existing products and roll out new services. Many Americans are worrying whether

On March 30, the Future of Privacy Forum launched a new report comparing three regional model contractual frameworks for cross-border data transfers. The report compares the EU’s Standard Contractual Clauses (SCCs), the ASEAN Model Contractual Clauses (MCCs), and the Iberoamerican Network’s Model Transfer Agreement (MTA). The three frameworks

IAPP Westin Research Fellow Amy Olivero parsed through the EU General Data Protection Regulation's data protection officer provisions, spelling out key considerations companies and DPOs should bear in mind as regulators begin their enforcement sweep. Topics include designating, positioning and tasking a DPO, looking ahead, as well as additional resources.