German DPA against Facebook for processing data without permission

Posted on by Federica Romanelli
On October 24, 2017, Advocate General Bot issued his preliminary opinion in case C‑210/16, opining on the definition of a data controller, applicable national law, and jurisdiction under EU data protection law under Directive 95/46/EC. The opinion is not binding but if followed by the European Court of Justice (CJEU), EU companies that have been advertising through Facebook might be considered data controllers and be accused of infringing national data protection laws. After Facebook’s privacy Read more [...]

A closer look to damages liability under the GDPR

Posted on by Federica Romanelli
The General Data Protection Regulation, GDPR (Regulation (EU) 2016/679) started to apply on May 25, 2018. See here. The GDPR sets forth the data subject’s right to compensation and liability for the damages caused by processing infringing the GDPR. Pursuant to Article 82, GDPR: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered”. Let’s Read more [...]

ICO served GDPR enforcement notice on a non resident organization (Canadian company)

Posted on by Federica Romanelli
On July 6, 2018, the UK Data Protection Authority, the Information Commissioner Officer (ICO), served what looks like the first enforcement notice regarding the processing of UK individuals’ personal data by a nonresident organization. The notice was directed to Aggregate IQ (AIQ), a digital advertising, web and software development company based in Canada.  According to the ICO, AIQ received personal data (including names and email addresses) from political organizations and used them to target Read more [...]

Italian GDPR harmonization law is now in force

Posted on by Federica Romanelli
On September 19, 2018, Legislative Decree n. 101/2018 harmonizing the Italian privacy law with the General Data Protection Regulation (GDPR) entered into force. Legislative Decree was published on the Official Italian Gazette (Gazzetta ufficiale n. 205 04-09-2018) on September 4, 2018. More on the Legislative Decree and the Italian Privacy Code (Legislative Decree 196/2003) is available at http://www.technethics.com….   For more information on this and for advice on GDPR implementation, Read more [...]

Update on French Conseil d’Etat’s request for a preliminary ruling on the right to be forgotten

Posted on by Federica Romanelli
  On September 11, 2018, the Court of Justice of the European Union (CJEU) began hearing evidence from over 70 stakeholders in the case whose judgement shall outline the territorial scope of the right to be forgotten. The panel of 15 CJEU judges will rule in 2019. The request for a preliminary ruling (Case C-507/17) was lodged by the French Conseil d’Étaton 21 August 2017 with reference to the case Google Inc. v Commission nationale de l’informatique et des libertés (CNIL). While Read more [...]