La Corte Suprema irlandese sta decidendo se sottoporre alla CGUE la pregiudiziale sulle clausole contrattuali tipo per il trasferimento internazionale

Posted on by Federica Romanelli
La Corte Suprema irlandese sta decidendo se sottoporre alla Corte di Giustizia dell’Unione europea (CGUE) una questione pregiudiziale sulle clausole contrattuali tipo per il trasferimento di dati verso paesi terzi. Dal 7 febbraio 2017, la Corte Suprema irlandese si è riunita per decidere sulla causa intentata dal Garante Privacy irlandese contro Facebook Ireland Ltd e Max Schrems sul trasferimenti di dati internazionale UE-USA dopo lo scandalo Snowden. A seguito della decisione con cui la Read more [...]

Privacy notices, transparency and control – ICO’s good practices

Posted on by Federica Romanelli
On October 25, 2016, the UK Information Commissioner’s Office (ICO) issued a revised code of practice and checklist on privacy notices, transparency and control. The code helps organizations required by the Data Protection Act 1998 (DPA) to “collect information about people, whether directly or indirectly” to provide transparent and accessible “privacy notices” to data subjects. The code provides useful good practice tips on privacy notice’s content and form; places and Read more [...]

EU-US Privacy Shield compliance may not have to wholly transform your business model

Posted on by Federica Romanelli
When a US organization decides to self-certify under the EU-U.S. Privacy Shield, compliance with Privacy Shield principles becomes compulsory. This may be a problem for many US organizations because certain processing activities that they perform – which are perfectly lawful under American law — are unlawful under a Privacy Shield’s perspective. Why? And what to do? Let’s step back for a moment. What is the Privacy Shield? Following the decision of the European court of Justice Read more [...]

Irish High Court to decide whether to ask ECJ to issue preliminary ruling on Model Clauses vis-a-vis Safe Harbor decision

Posted on by Federica Romanelli
Starting on February 7, 2017, the Irish High Court will hear a case brought by the Irish Data Protection Authority (DPA) against Facebook Ireland Ltd and Mr Schrems over EU-US data transfers after the Snowden disclosures. After the ECJ invalidated the “Safe Harbor” decision, Facebook performed its data transfer to the US using the “Model Clauses”. Mr. Schrems requested the suspension of data flow from the Irish DPA on the assumption that standard contractual clauses (SCCs) “do Read more [...]

Data controllers have no duty to disclose data enabling an aggrieved party to bring a suit, the Advocate General opines

Posted on by Federica Romanelli
European Court of Justice — Case C‑13/16 On January 26, 2017, the Advocate General (AG) to the Court of Justice of the European Union (CJEU) Mr. Bobek opined that there is no legal obligation for a data controller under EU data protection law to disclose data enabling the identification of a person allegedly responsible for an administrative offence. In this case, there was a street accident in Riga involving a taxi and bus. The taxi company told the Latvian police who was the passenger Read more [...]