Tag archives: data privacy

Google and other big data companies face increased scrutiny

Photo of Jeewon Kim Serrato (US)Photo of Vic Domen (US)By Jeewon Kim Serrato (US) and Vic Domen (US) on Posted in Compliance and risk management, Enforcement
Data Protection Report - Norton Rose Fulbright

Norton Rose Fulbright’s US Head of Data Protection, Privacy and Cybersecurity Jeewon Serrato and Partner Vic Domen write about the increased scrutiny that big data companies like Google and Facebook are now facing.

A number of state attorneys general are preparing to have discussions with the US Federal Trade Commission to discuss their concerns about the use of massive amounts of personal data in the digital ad marketplace.

There is a trend among federal and state enforcers to bring these online platforms and technology markets under higher scrutiny.

Get all the details at the full legal update, “Big data … Continue Reading

Parenting support club Bounty fined in ‘unprecedented’ data breach

Photo of Lara White (UK)By Lara White (UK) on Posted in Enforcement
Norton Rose Fulbright - Data Protection Report blog

On 12 April, the Information Commissioners Office (ICO) fined Bounty, a pregnancy and parent support club, £400,000 for illegally sharing personal data belonging to more than 14 million people. As the contravention took place just before the General Data Protection Regulation (GDPR) came into force, the fine was issued under the Data Protection Act 1998 (DPA).… Continue Reading

French court issues decision on legality of Privacy Rules and Terms of Use under data protection and consumer law

Photo of Cécile Auvieux (FR)Photo of Nadège Martin (FR)By Cécile Auvieux (FR) and Nadège Martin (FR) on Posted in Dispute resolution and litigation, Enforcement
Norton Rose Fulbright - Data Protection Report blog

Five years after the commencement of legal proceedings against Google by leading French consumer association UFC Que Choisir, the Paris “Tribunal de Grande Instance” (TGI), in a decision dated 12 February 2019, issued its ruling on the legality of the Google+ Terms of Use and Privacy Rules, both with respect to consumer law and personal data protection regulations.… Continue Reading

EU Advocate General issues opinion on consent for cookies and intersection between ePrivacy-Directive and GDPR

Photo of Lara White (UK)Photo of Marcus Evans (UK)Photo of Sven Jacobs (DE)By Lara White (UK), Marcus Evans (UK) and Sven Jacobs (DE) on Posted in Dispute resolution and litigation
Norton Rose Fulbright - Data Protection Report blog

On March 21, 2019, Advocate General Szpunar released his opinion on the use of consent for the processing of personal data and for the use of cookies pursuant to the ePrivacy-Directive and the General Data Protection Regulation (GDPR).

The opinion includes several key points on whether consent is ‘freely given’ pursuant to the ePrivacy-Directive and the GDPR and also gives insight on what constitutes ‘informed consent.’… Continue Reading

German court ruled that protection of the whistle-blower confidentiality does not generally override the data subject access right

Photo of Christoph Ritzer (DE)Photo of Cornelia Marquardt (DE)Photo of Natalia Filkina (DE)By Christoph Ritzer (DE), Cornelia Marquardt (DE) and Natalia Filkina (DE) on Posted in Enforcement
Data Protection Report - Norton Rose Fulbright

A mid-level German employment court recently had to consider the scope of subject access requests under the EU General Data Protection Regulation (GDPR) in the context of compliance and whistle-blowing regimes. The Regional Labour Court (Landesarbeitsgericht) of Stuttgart decided that an employer was required not only to provide an employee with the records containing performance and behavioural data, but also to disclose information regarding internal investigations. This is the first reported successful enforcement of a data subject access right under Article 15 GDPR before a regional labour court in Germany. (The judgment was handed down on … Continue Reading

German antitrust authority prohibits Facebook from combining users’ personal data

Photo of Christoph Ritzer (DE)Photo of Maxim Kleine (DE)Photo of Natalia Filkina (DE)By Christoph Ritzer (DE), Maxim Kleine (DE) and Natalia Filkina (DE) on Posted in General
Data Protection Report - Norton Rose Fulbright

On 7 February 2019, the German antitrust authority (Bundeskartellamt, the FCO) ruled against Facebook combining user personal data from different sources, saying it was exploiting its position as a dominant social media company in violation of the EU data protection laws.

The FCO said that Facebook abused its market dominance in:

  • collecting, merging and using personal data; and
  • failing to provide a choice to its customers to prevent collection of their data.

Consequences of the German antitrust authority’s decision

Facebook can no longer combine the personal data gathered from its own website, Facebook-owned services (like WhatsApp and … Continue Reading

First multi-million Euro GDPR fine: Google LLC fined €50 million under GDPR for transparency and consent infringements in relation to use of personal data for personalized ads

Photo of Marcus Evans (UK)Photo of Lara White (UK)Photo of Cécile Auvieux (FR)By Marcus Evans (UK), Lara White (UK) and Cécile Auvieux (FR) on Posted in Compliance and risk management, Cybersecurity, Enforcement, Regulatory response
Norton Rose Fulbright - Data Protection Report blog

On January 21,2019 the French data protection authority (the CNIL) imposed a major fine on the U.S. Google entity, Google LLC.  It follows two complaints filed as soon as the GDPR came into force by two consumer rights associations, None of Your Business and La Quadrature du Net.

We focus here on four key aspects of the decision: (a) why the Irish Data Protection Commission (Irish DPC) did not take the case; (b) the consent mechanism failings; (c) the privacy policy failings; and (d) the amount of the fine.… Continue Reading

Pennsylvania Supreme Court holds common law duty for employers extends to protecting sensitive employee information

Photo of Andrea D'Ambra (US)Photo of Max Kellogg (US)By Andrea D'Ambra (US) and Max Kellogg (US) on Posted in Compliance and risk management, Data breach, General, Regulatory response
Data Protection Report - Norton Rose Fulbright

On November 21, 2018, the Pennsylvania Supreme Court broke new ground by holding that employers have a legal duty to take reasonable care to safeguard its employees’ sensitive personal information from cyberattacks. Dittman v. UPMC, 2018 Pa. LEXIS 6072199 (Pa. Nov. 21, 2018).… Continue Reading

New China Guideline for Internet Personal Information Security Protection

Photo of Barbara Li (CN)Photo of Bohua Yao (CN)By Barbara Li (CN) and Bohua Yao (CN) on Posted in Compliance and risk management, Data breach, Regulatory response

On November 30, 2018 the Cyber Security Protection Bureau, under the auspices of the PRC Ministry of Public Security (the “MPS”), issued a draft Guideline for Internet Personal Information Security Protection (the “Guideline”) along with a request for public comments.… Continue Reading

California Consumer Privacy Act: Disclosure requirements

Photo of Chris Cwalina (US)Photo of Jeewon Kim Serrato (US)Photo of Steve Roosa (US)Photo of Tristan Coughlin* (US)By Chris Cwalina (US), Jeewon Kim Serrato (US), Steve Roosa (US) and Tristan Coughlin* (US) on Posted in CCPA
Data Protection Report - Norton Rose Fulbright

This is the Data Protection Report’s fourth blog posts in a series of CCPA blog posts that will break down the major elements of the CCPA, which will culminate in a webinar on the CCPA in October. Stay tuned for additional blogs and information about our upcoming webinar on the CCPA.

The California Consumer Privacy Act (the “CCPA” or “Act”) includes significant and new disclosure requirements for businesses that collect and or sell or disclose California residents’ personal information. Below we have outlined: (1) disclosures businesses must make in their privacy policy; (2) disclosures businesses must make upon receipt of … Continue Reading

California Consumer Privacy Act blog series: Covered entities

Photo of Jeewon Kim Serrato (US)Photo of Steve Roosa (US)Photo of Alexis Wilpon (US)By Jeewon Kim Serrato (US), Steve Roosa (US) and Alexis Wilpon (US) on Posted in CCPA, Compliance and risk management, Regulatory response
Data Protection Report - Norton Rose Fulbright

This is the Data Protection Report’s second post in a series of blog posts that will break down the major elements of the CCPA which will culminate in a webinar on the CCPA in October. This blog focuses on covered entities. Stay tuned for additional posts and information about our upcoming webinar on the CCPA.

California’s new privacy law, the California Consumer Privacy Act (CCPA) grants California residents extensive new privacy rights. One of the more significant aspects of the law however, is the number of business entities to which it applies. Companies around the world must comply with the … Continue Reading

US Supreme Court expands digital privacy rights in Carpenter v. United States

Photo of Jeewon Kim Serrato (US)Photo of Anna Rudawski (US)Photo of Alexis Wilpon (US)By Jeewon Kim Serrato (US), Anna Rudawski (US) and Alexis Wilpon (US) on Posted in Dispute resolution and litigation
Data Protection Report - digital privacy, CCPA and cybersecurity

On June 22, 2018, the US Supreme Court issued a 5-4 decision in Carpenter v. United States,  holding that the federal government needs a warrant to access cellphone location records.

In the decision, the Court agreed that there should be a higher standard for accessing location records due to their intrusive nature.… Continue Reading

German DPAs publish templates and guidance on records of processing activities pursuant to Art. 30 GDPR

Photo of Christoph Ritzer (DE)By Christoph Ritzer (DE) on Posted in Compliance and risk management
Data Protection Report - Norton Rose Fulbright

The German Data Protection Authorities (DPAs, acting as the German Data Privacy Conference, Konferenz der unabhängigen Datenschutzbehörden des Bundes und der Länder) recently published templates for the records of processing activities for controllers (Art. 30 para. 1 GDPR) and processors (Art. 30 para. 2 GDPR) together with a corresponding guidance document. This guidance was expected to be released earlier as the EU General Data Protection Regulation (GDPR) will take effect in less than a hundred days and organisations must meet its requirements from 25 May 2018. However, the guidance does not contain significant new information and mainly confirms … Continue Reading

China’s proposed Cyber Security Law to have far reaching consequences for businesses operating in the country

Photo of Barbara Li (CN)By Barbara Li (CN) on Posted in Regulatory response
Data Protection Report - Norton Rose Fulbright

On July 6, 2015, China’s top legislative body – the National People’s Congress – published a draft Cyber Security Law that, if enacted in its current form, will have far-reaching consequences for businesses operating in China.

The draft expressly provides that the law will apply equally to both Chinese and international businesses.… Continue Reading

LexBlog