Background: damages under the AVG Article 82 of the AVG provides that any person who has suffered material or immaterial damage as a result of a breach of the AVG is entitled to damages. In legal practice, the application of this provision has been frequently discussed since the introduction of

The use of artificial intelligence (AI) is accelerating. So is the need to ensure that AI systems are not only effective, but also fair, non-discriminatory, transparent, rights-based, accountable, and sustainable – in short, responsible https://edri.org/our-work/moving-from-empty-buzzwords-to-real-empowerment-a-framework-for-enabling-meaningful-engagement-of-external-stakeholders-in-ai/

Data controllers need to rely on a “legal basis” in order to process personal data lawfully. It is essential to identify the appropriate legal basis as it may come with specific requirements (e.g. consent must be free, specific, informed and unambiguous) and have consequences on individuals’ rights (e.g.

Authors: Verena Grentzenberg, Andreas Rüdiger, Ludwig Lauer In his Opinion of 27.04.2023 (C 340/21), the Advocate General of the European Court of Justice (“ECJ”) commented on the interpretation of the civil non-material right to damages pursuant to Article 82 (1) GDPR as well as on the requirements

The EDPB has launched a Data Protection Guide to help small business owners on their way to become more data protection compliant. The Guide aims to raise awareness about the GDPR and to provide practical information to SMEs about GDPR compliance in an accessible and easily understandable format. Andrea Jelinek

Adv. Rivki Dvash with the assistance of Mr. Guy Zomer1The Future of Privacy Forum’s office in Tel Aviv (Israel Technology Policy Institute – ITPI) sought to examine the judicial decisions in civil actions under Israel’s Privacy Law, which includes rules that regulate data protection. We examined the extent to

The General Data Protection Regulation (GDPR) requires Data Controllers to maintain a Record of Processing Activities (RoPA) containing specific information. Controllers and processors must be able to provide these records to the Data Protection Commission (DPC) upon request. A well-drafted RoPA demonstrates compliance with the principle of accountability set out

On March 14, 2023, the European Parliament approved the bill for the Data Act, legislation that is part of the European data strategy and aims to contribute to the development of new digital services through increased data sharing, with a considerable impact on trade secrets. Below are the most relevant

On April 20, 2023, the Ministry of Education, Culture and Science informed the House of Representatives how an earlier AP opinion on the use of Google products in education was followed up. The parliamentary letter also named some additional findings about the use of Google products. It is good that

Italy's data protection authority, the Garante, published an information page on dark patterns. The Garante said the resource explores the "increasingly widespread phenomenon" of deceptive design patterns that are "still unknown to most users of digital services" and is "part of a large information and awareness project on data protection,

Italy's data protection authority, the Garante, published an information page on dark patterns. The Garante said the resource explores the "increasingly widespread phenomenon" of deceptive design patterns that are "still unknown to most users of digital services" and is "part of a large information and awareness project on data protection,

Digital tracking pixels and similar technologies are posing an increasing cybersecurity risk, Corvus Insurance Senior Vice President of Risk and Response Lauren Winchester writes in InfoSecurity Magazine. Law firms, regulators and insurers are paying heightened attention to the tracking pixels' vulnerabilities when they assess a company's risk. Winchester said companies

Following public consultation, the EDPB has adopted a final version of the Guidelines on data subject rights - Right of access. The Guidelines analyse the various aspects of the right of access and provide more precise guidance on how the right of access has to be implemented in different situations.

Alessandra Silveira (Editor) ▪            1) What is new about this process? Article 22 GDPR is finally being considered for before the European Court of Justice (ECJ) – and on 16 March 2023, the Advocate General’s Opinion in Case C-634/21 [SCHUFA Holding and Others (Scoring)][1] was published. Article 22 GDPR

The ruling concerns a dispute between market researcher Blauw and ICT service provider Nebu. Blauw uses the services of Nebu. A cyber attack took place at Nebu, during which data was stolen. Nebu informed its clients about this (to a limited extent); however, Blauw demanded more information. Thereupon Blauw initiated

Alongside the traditional profiles of civil liability for human acts, we must confront the legal profiles of civil liability arising from the use of artificial intelligence (AI) systems. Artificial intelligence systems are reaching increasingly advanced levels of autonomy, also thanks to the boost given by generative AI systems with the

Over the last few months, we have seen generative AI systems and Large Language Models (LLMs), like OpenAI’s ChatGPT, Google Bard, Stable Diffusion, and Dall-E, send shockwaves throughout society. Companies are racing to bake AI features into existing products and roll out new services. Many Americans are worrying whether

On March 30, the Future of Privacy Forum launched a new report comparing three regional model contractual frameworks for cross-border data transfers. The report compares the EU’s Standard Contractual Clauses (SCCs), the ASEAN Model Contractual Clauses (MCCs), and the Iberoamerican Network’s Model Transfer Agreement (MTA). The three frameworks

IAPP Westin Research Fellow Amy Olivero parsed through the EU General Data Protection Regulation's data protection officer provisions, spelling out key considerations companies and DPOs should bear in mind as regulators begin their enforcement sweep. Topics include designating, positioning and tasking a DPO, looking ahead, as well as additional resources.

On Monday, March 27,, 2023, the Centre for Information Policy Leadership at Hunton Andrews Kurth submitted a response to the California Privacy Protection Agency Invitation for Preliminary Comments on Proposed Rulemaking Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking.  Continue Reading https://www.huntonprivacyblog.com/2023/03/29/uk-government-publishes-ai-white-paper/

Today, the Future of Privacy Forum (FPF), a global non-profit focused on privacy and data protection, is pleased to release an infographic, “Open Banking And The Customer Experience,” visualizing the US open banking ecosystem. FPF’s open banking infographic is supported by over a year of meetings and outreach with

On March 15, 2023, the Provincial Council elections will be held. Political parties that campaign - for example through microtargeting - must comply with privacy rules in doing so. Political parties are increasingly using personal data - or hiring companies to do so - to reach their members and potential

This is an excerpt from CIPL President Bojana Bellamy’s recently published piece in the IAPP “Privacy Perspectives” blog. This piece discusses binding corporate rules as important transfer mechanism. Continue Reading https://www.huntonprivacyblog.com/2023/03/15/international-data-transfers-time-to-rethink-binding-corporate-rules/

By Jan Pohle, Dr. Philipp Adelberg In its judgment of 2 March 2023, the European Court of Justice (ECJ) (C-268/21) issued a preliminary ruling on whether and to what extent provisions of the General Data Protection Regulation (GDPR) are applicable in the context of national civil procedural law of

The Czech Republic’s data protection authority, the Úřad pro ochranu osobních údajů, published guidance on cookie disclosures for web operators. The guide states web operators must disclose if their website uses "non-technical cookies" that collect visitor’s personal data. However, the use of technical cookies does not necessitate introducing