Tag archives: personal data

Pennsylvania Supreme Court holds common law duty for employers extends to protecting sensitive employee information

Data Protection Report - Norton Rose FulbrightOn November 21, 2018, the Pennsylvania Supreme Court broke new ground by holding that employers have a legal duty to take reasonable care to safeguard its employees’ sensitive personal information from cyberattacks. … Continue reading

California Consumer Privacy Act: GDPR-like definition of personal information

Data Protection Report - Norton Rose FulbrightThis is the Data Protection Report’s third blog in a series of blogs that will break down the major elements of the CCPA which will culminate in a webinar on the CCPA in October. This blog focuses on the CCPA’s broad definition of Personal Information. Stay tuned for additional blogs and information about our upcoming … Continue reading

Overview of Thailand Draft Personal Data Protection Act

Data Protection Report - Norton Rose FulbrightData protection laws in Asia continue to be introduced and updated. One of the most recent developments in South East Asia is in Thailand. On 22 May 2018, the Thai Cabinet approved in principle a revised draft of Thailand’s first personal data protection act (Draft Act). This Draft Act is currently under consideration by the … Continue reading

Ninth Circuit further entrenches circuit split over standing in data breach cases

Norton Rose Fulbright - Data Protection Report blogOn March 8, 2018, the Ninth Circuit issued its highly anticipated decision in In re Zappos.com, Inc., finding that allegations of future risk of identity theft from a data breach are sufficient to confer standing. This decision fuels an ongoing circuit split, pitting the D.C., Sixth, Seventh and now Ninth Circuits against the Second, Fourth, … Continue reading

CJEU Judgement: Dynamic IP Addresses Constitute Personal Data

Data Protection Report - Norton Rose FulbrightOn October 19, 2016, the Court of Justice of the European Union (CJEU) decided that the dynamic IP address of a website visitor is  “personal data” under Directive 95/46EC (Data Protection Directive) in the hands of a website operator that has the means to compel an internet service provider to identify an individual based on the IP … Continue reading

Privacy Shield Update: EU Member States Approve Amended Framework

Data Protection Report - Norton Rose FulbrightOn July 8, 2016, European Member States approved the proposed EU-US Privacy Shield framework, with four Member States – Austria, Bulgaria, Croatia, and Slovenia – reportedly abstaining. Before the framework can be implemented, formal approval by the European Commission is required. Although the European Commission has yet to formally release a copy of the revised … Continue reading

Big data: French and German authorities explore antitrust issues

Data Protection Report - Norton Rose FulbrightOn May 10, 2016, the French and German antitrust authorities published a joint study on competition law and the collection and use of data, particularly so-called big data (the Big Data Study). Data protection as such is outside the scope of EU competition laws, but antitrust authorities have considered the significance of data on a … Continue reading

Details of Privacy Shield published

Data Protection Report - Norton Rose FulbrightOn February 29, 2016, the European Commission published the documents comprising the new EU-U.S. Privacy Shield, the adoption of which we previously covered on our blog. In the Commission’s opinion, the new framework reflects the requirements set forth by the European Court of Justice in the Schrems ruling, which invalidated the U.S.-EU Safe Harbor framework. The … Continue reading

EU-US Privacy Shield scrutinized in Article 29 Working Party initial response

Data Protection Report - Norton Rose FulbrightOn February 3, 2016, the Article 29 Working Party (WP29) released a statement on the consequences of the Schrems judgment, following an assessment of the legal framework and the practices of US intelligence services. The WP29 expressed continuing concerns about the US framework for processing personal data for intelligence purposes, in spite of recent reforms.… Continue reading

EU and US reach agreement on cross-border data transfer framework, but uncertainty remains

Data Protection Report - Norton Rose FulbrightOn February 2, 2016, the European Commission and the United States reached an agreement on a new framework to permit transatlantic transfers of personal data.  The new framework — named “EU-US Privacy Shield”  — is slated to replace the US-EU Safe Harbor framework that was invalidated by the Court of Justice for the European Union.… Continue reading

Russia’s data localization requirements delayed for Facebook, Google and Twitter

Data Protection Report - Norton Rose FulbrightThe Russian data protection authority, Roscomnadzor, has given major U.S. technology companies extra time to comply with the Russian data localization law. The law, which went into effect on September 1, 2015, requires companies to store and process all personal data of Russian citizens using databases located in Russia.  The law imposes a variety of penalties … Continue reading

Russian data protection authority explains data localization law; says cross-border transfer still permitted

Data Protection Report - Norton Rose FulbrightRussia’s data protection authority, Roscomnadzor, has held a number of meetings with business associations to respond to the wave of questions that have arisen about the interpretation and application of Russia’s personal data localization law. The law, which enters into force on September 1, 2015, requires that an operator, while collecting personal data, ensures the recording, … Continue reading

Google challenges applicability of CNIL’s “right to be forgotten” order to domain extensions outside the EU

Data Protection Report - Norton Rose FulbrightIn a recent blog post, reflecting on Google’s ongoing dispute with France’s CNIL about the scope of the “right to be forgotten,” Peter Fleisher, Google’s Global Privacy Counsel, announced that Google will maintain its position that that company would not comply with the CNIL’s formal notice dated May 21, 2015 to implement individuals’ requests to … Continue reading

China’s proposed Cyber Security Law to have far reaching consequences for businesses operating in the country

Data Protection Report - Norton Rose FulbrightOn July 6, 2015, China’s top legislative body – the National People’s Congress – published a draft Cyber Security Law that, if enacted in its current form, will have far-reaching consequences for businesses operating in China. The draft expressly provides that the law will apply equally to both Chinese and international businesses.… Continue reading

UK Court of Appeal Establishes Data Protection Rights in Privacy Case

Data Protection Report - Norton Rose FulbrightA recent English Court of Appeal judgment could significantly broaden the circumstances in which data protection litigation can be brought – and damages can be awarded – under English law. Background Vidal-Hall et al v Google ([2015] EWCA Civ 311) involves claims brought by three individual users against Google. The users alleged that Google collected private … Continue reading
LexBlog