Sharing personal data with data brokers or other businesses partners? French regulator, CNIL, has new guidelines for you to follow.

Highlights include:

  • The individual whose data is shared must give consent before any transmission to partners.
  • The individual must be able to identify the partners, recipients of the data, from the form from which the

IF Brexit AND Privacy Shield THEN (amend privacy notice).

If you use the EU U.S. Privacy Shield mechanism to transfer Personal Data from the UK to the U.S., you will need to amend your privacy disclosure to state specifically that the commitment extends to personal data received from the UK in reliance on Privacy Shield

The Irish Data Protection Commissioner (DPC) has launched a public consultation on children and data protection issues.

The consultation will have two streams: one aimed at adult stakeholders, and the other aimed directly at children and young people.

To do this, the DPC has created a lesson plan on personal data and data protection rights

A Data Protection Impact Assessment (DPIA) is a process, required by the EU General Data Protection Regulation (GDPR), to help identify and minimize the data protection risks of a project.

The UK Information Commissioner’s Office (ICO) has published a new guidance on DPIA’s.

Per the guidance you are required you to do a DPIA if

In its second annual review, the European Commission notes that the Privacy Shield scheme provides adequate protection for personal data but improvements are still in order.

Highlights include:

  • Since the first annual review, the Department of Commerce (DOC) referred more than 50 cases to the Federal Trade Commission (FTC), to take enforcement action where necessary.

The UK Information Commissioner’s Office (ICO) has issued a new guidance on the liabilities of Controllers and Processors, advising that the Controller is responsible for assessing that its Processor is competent to process personal data in line with GDPR’s requirements.

  • The assessment by Controller should take into account the nature of the processing and the

The UK Information Commissioner’s Office (ICO) has issued several new guidance documents on Data Controllers, Data Processors and the interaction among them.

Key points of the Contracts guidance include:

  • Whenever a controller uses a processor, there must be a written contract (or other legal act) in place.
  • If a processor uses another organization (ie. a

For your GDPR compliance: Have a plan. Try your best. Embrace privacy.

UK Information Commissioner Elizabeth Denham spoke recently in New Zealand about data breaches and the state of the EU General Data Protection Regulation (GDPR) after six months.

Key takeaways included:

  • “EU data protection regulators [are] going to prioritize …enforcement activity towards those bad

If at first they don’t consent, try, try again?

A new form of privacy fraud further complicates the relationship between the Ad Tech industry and GDPR.

As Ad Tech vendors struggle to comply with the strict requirements of the EU General Data Protection Regulation (GDPR), especially around the acquisition of freely given, specific, informed and

The European Parliament Committee on Civil Liberties, Justice and Home Affairs has weighed in on blockchain with the following key points:

  • If you want to use a blockchain structure to handle personal data you need to specifically design the blockchain platform to support data sovereignty.
  • Personal data in the blockchain is generally not anonymous and