Message for our subscribers and readers
Dear Subscribers and Readers,
Wish you a very happy Data Protection Week, 2022! We thank you for your continuous patronage and support. We have published over 110 issues of our weekly newsletter on data protection and privacy covering enforcement, guidance, regulatory, big-tech, and region-specific updates from around the globe.
We hope you enjoy reading our newsletter just as much as we enjoy creating it. If you have any thoughts, feedback, and suggestions on our newsletter, please reach out to us on our contact form.
We will continue to bring you regular insights into the national and international developments in the field of data protection and privacy. Stay tuned for exciting updates coming soon this week! Follow us on LinkedIn and Twitter and ask your peers and colleagues to subscribe to our newsletter.
Enforcement updates
CNIL fines Google and Meta for violating cookie consent regulations
The French data protection authority (CNIL) has fined Facebook Ireland Limited for EUR 60 million, as a part of its ongoing enforcement campaign on guidelines and recommendations on cookies. The CNIL found that Facebook Ireland had inadequate measures in place failing to make it easy to reject consent to the use of cookies as it is to accept the same. In light of this, CNIL opined that this was a breach of Article 82 of the French Data Protection Act and issued the fine accordingly.
Illinois court denies Amazon’s defense in a lawsuit regarding illegal collection of biometric data
In a lawsuit filed in the US District Court of Northern District of Illinois, Eastern Division an Amazon warehouse employee accused the company of unlawfully collecting facial scans of its employees as a part of its COVID-19 wellness checks. The former employee alleged that the e-commerce giant collected his facial and other biometric data without proper consent under the Illinois Biometric Information Privacy Act. In response to this, Amazon filed a motion to dismiss the lawsuit which was declined by the court.
Morgan Stanley agrees to pay for settlement for data breach
Morgan Stanley agreed to pay USD 60 million to settle a class action lawsuit which accused them of exposing personal data of about 15 million customers. In 2016, customers had accused Morgan Stanley of negligently decommissioning two wealth management data centers which were unencrypted and contained personal data of its customers when they were sold to unauthorized third parties. According to the settlement papers, Morgan Stanley denied wrongdoings and has made substantial upgrades to its data security practices.
Guidance updates
- Italian Data Protection Authority published new guidelines on cookies and similar technologies.
- French Data Protection Authority published guidance on the right of employees to access their data and professional emails.
- Croatia’s Personal Data Protection Authority issued its views on the processing of personal data of employees for the purpose of recording work hours.
- Germany’s Minister of Justice announced transposition of the EU Directive on certain aspects concerning contracts for the supply of digital content services.
Regulatory updates around the globe
- UK’s Department of Business, Energy and Industrial Strategy published Appropriate Policy Document for sensitive processing for law enforcement purposes.
- Florida Privacy Protection Act was introduced to the Florida State Senate as a Senate Bill.
- Brazil’s Official Gazette of the Union announced the enactment of a law for preserving the confidentiality of personal information related to HIV.
US updates
- Federal Communications Commission published proposals for new data breach reporting requirements.
- New York Attorney General announced results of its investigation into credential stuffing cyberattacks at 17 companies and released a business guide on the same.
EU updates
- NOYB issued statement on European Data Protection Supervisor’s sanction on the EU parliament for illegal EU-US data transfers.
- European Data Protection Supervisor published report emphasizing data protection in card-based payments.
- European Data Protection Board published its opinion on whether powers of the supervisory authority under the GDPR can serve as a legal basis for orders of ex-officio erasure of personal data.
India updates
- Telecommunication Engineering Center released Code of Practice for Securing Consumer Internet of Things.
- Ministry of Electronics and Information Technology is preparing a formal note for the Union Cabinet on the proposed Data Protection Bill. Reports The Economic Times.
News around the globe
- WhatsApp Ireland Limited appealed to the Court of Justice of the European Union against the decision of the European Data Protection Board to fine the company.
- Meta published a report banning surveillance-for-hire companies from its platform following an investigation.
- GDPR fines in 2021 added up to more than EUR 1 billion. Reports AtlasVPN.
Read our digital newsletter here
© 2019 Reina Consulting LLP – All rights reserved
