DATA PROTECTION

FTC ready to settle with PayPal over Venmo’s failure to disclose information to consumers about funds transfers and privacy settings

Date 03/20/2018.

On February 27, 2018, the Federal Trade Commission (FTC) announced that it reached a settlement with PayPal, Inc. over allegations that the company failed to make adequate disclosures regarding its Venmo peer-to-peer payment service. According to the FTC’s complaint, Venmo misled consumers about the extent to which they could control the privacy of their transactions. By […]

Records of processing activities of Article 30 GDPR – some model forms

Date 03/16/2018.

UPDATED Novembre 19, 2019 Article 30 GDPR requires each controller and each processor to maintain a record of processing activities under its responsibility which must be in writing (including electronic form). Article 30 details the minimum content of the record. Some DPA made available model forms and notes for keeping records of processing activities: the […]

Italian DPA opines on national DNA bank

Date 03/14/2018.

On March 9, 2017, the Garante per la Protezione dei Dati Personali, the Italian Data Protection Authority (DPA), issued a favorable opinion on a legislation that regulates the Banca Nazionale del DNA, the Italian DNA Bank. The legislation regulates the modalities of deletion of DNA profiles, the destruction of biological samples, the input and updating of the data necessary […]

Employees judicial data can be processed only with express authorization by law or Agency, Italian DPA says

Date 03/09/2018.

On June 15, 2017, the Italian Data Protection Authority, Garante per la Protezione dei Dati Personali, rejected the request of an Italian service company to be authorized to process its employees’ judiciary data because of lack of an adequate legal basis. The Italian company was looking to process the judiciary information of its employees to allegedly […]

U.S. Customs and Border Protection searches of travelers’ mobile electronic devices may be unconstitutional

Date 03/06/2018.

On September 13, 2017, ten U.S. citizens and one lawful permanent resident sued the Department of Homeland Security (DHS) before the U.S. Court of Massachusetts challenging searches and seizure of travelers’ personal electronic devices in violation of privacy and free speech protections of the U.S. Constitution. Allegedly, U.S. Customs and Border Protection (CBP) and U.S. […]

Privacy class action brought in California against Walt Disney for apps exploiting children’s personal information

Date 03/05/2018.

On August 3, 2017, several parents brought a class action in San Francisco against Walt Disney. The parents allege that Walt Disney and its partners exfiltrated the personally identifying information of their children playing online games via smart phone apps, for future commercial exploitation, in direct violation of the federal Children’s Online Privacy Protection Act […]

Yahoo still facing class claims over 2013-2016 data breaches

Date 03/05/2018.

Yahoo continues to face a massive data breach class action lawsuit after U.S. District Judge Lucy H. Koh denied the company’s motion for dismissal. The lawsuit started on August 30, 2017, when the U.S. District Court for the Northern District of California decided that Yahoo had to face nationwide litigation brought on behalf of over […]

CNIL releases guide for data processors

Date 03/01/2018.

On September 29, 2017 the French Data Protection Authority (CNIL) published a guide for data processors, Guide du sous-traitant, in French, to aid data processor implementing the obligations set forth by the new EU General Data Protection Regulation (“GDPR”). More on the CNIL’s guide is available (in French) at https://www.cnil.fr… For more information on EU data protection’s state of […]

Scientific research in Italy may be slowed down by new data processing rules

Date 02/21/2018.

In an early effort to adapt Italian privacy law to the GDP, in November 2017, a new Article 110bis was approved for introduction in the Italian Privacy Code, redrafting the discipline concerning the re-use of data for scientific research or statistical purposes. The new Article 110bis, Italian Privacy Code, (Legislative Decree n. 196/2003) introduced three changes that […]