eu – Cyber Law Watch

The Importance of Managing DSARs

Jun 28 2022

By Claude-Étienne Armingaud and Inès Demmou

With its December 2021 fine imposed on French telephone operator Free Mobile, the French data protection authority (CNIL) reiterated the importance of responding to data subject access requests (DSARs) within the relevant timeline (usually 30 days), with all the relevant and required information (Article 13 and 14 GDPR) and ensuring the security of users’ personal data (Article 32 GDPR).

Another sanction by the Dutch Supervisory Authority relating to the principle of data minimization confirmed that such DSARs could not be conditioned by overly complex mechanisms, such as a requirement to upload a full copy of an identity document.

These sanctions demonstrate that data subjects have acquired the awareness necessary to exercise their rights, and that data controllers must implement effective channels and internal processes to handle DSARs properly, effectively, in a timely manner, and in a way that would not, in turn, generate its own set of breaches of the GDPR.

To find out more, see our full alert here.

Cookies, Directories, Advertising and Personal Data: New EU Rules on Privacy in Electronic Communications

Jan 20 2017

By Cameron Abbott and Allison Wallace

With the EU heading full throttle towards the implementation of new data protection regulations in May 2018, there has been a lot of buzz around the impact the regulations will have, not only on day-to-day life, but other existing regulations.

One of these regulations is the Directive 2002/58/EC aka the ePrivacy Directive, which has been urgently reviewed ahead of the data protection regulations being implemented.

Brussels partner Ignasi Guardans has detailed the review and its implications here.

EU-US Privacy Shield certifications to open in August

Jul 14 2016

By Cameron Abbott, Simon Ly and Rowena Baer

As a follow up to our latest blog post, the European Union and European Commission yesterday announced that the Privacy Shield arrangement has been adopted.

Companies wanting to utilise the Privacy Shield for their Trans-Atlantic data transfers are able to apply for certification with the U.S. Department of Commerce from 1 August 2016, with the US and EU to brief companies on the application process later this week.

For a legal perspective and analysis of the Privacy Shield, please see our colleagues’ report here.

To keep up to date and for an overview of the changes, please see here.

Tag:eu