With the coming into effect of the GDPR on 25 May 2018, the modernisation of European privacy laws has reached a critical milestone. Businesses operating in Europe or targeting European customers now need to comply with the new regime. At stake are not only the consequences of non-compliance, but also the ability to take advantage of new technologies, data analytics and the immense value of personal information. From determining when European law applies to devising a workable cooperation strategy with national regulators, there are many intricate novelties to understand and address.
Nothing challenges the effectiveness of data protection law like technological innovation. You think you have cracked a technology neutral framework and then along comes the next evolutionary step in the chain to rock the boat. It happened with the cloud. It happened with social media, with mobile, with online behavioural targeting and with the Internet of Things. And from the combination of all of that, artificial intelligence is emerging as the new testing ground. 21st century artificial intelligence relies on machine learning, and machine learning relies on…? You guessed it:
It is finally here. This is the year of the GDPR. A journey that started with an ambitious policy paper about modernising data protection almost a decade ago – a decade! – is about to reach flying altitude. No more ‘in May next year this, in May next year that’. Our time has come. Given the amount of attention that the GDPR has received in recent times, data protection professionals are in high demand but we are ready. We knew this was coming and we have had years to prepare.
Following the European Commission and European Parliament’s proposed versions of the EU Regulation on Privacy and Electronic Communications (the ePR), we are now waiting for the Council of the European Union to agree their position before discussions between the three bodies can begin. A discussion paper from the Bulgarian Presidency of the Council dated 11 January 2018 (the Paper) shows that the Council is still considering multiple options in relation to several critical issues. In particular: The Commission’s draft of the ePR clarified that communications between machines (M2M communications) are
This blog post was provided by Belén Gámez in our Madrid office We previously reported that back in November, the Court of Justice of the European Union (“CJEU“) declared that Spain’s refusal to permit the “legitimate interest” justification for the processing of personal data — instead, requiring data subjects’ consent as the way of carrying out the majority of the data processing in Spain — violated section 7.f of the European Data Protection Directive 95/46/EC. In a ruling made public on February 13, the Spanish Supreme Court incorporated the CJEU’s
By Pablo Rivas in our Madrid Office A decision last week by the Court of Justice of the European Union (“ECJ”) introduces an important change to the Spanish data protection framework. Prior to the decision, Spain did not recognize the “legitimate interest” justification for the processing of personal data; “legitimate interest” was only applicable for the processing of data collected from public sources or where the “legitimate interest” was specifically provided for in Spanish or European Community law. As a result, companies had to rely on data subjects’ consent as