DATA PROTECTION

Public employees’ communications about public business are subject to disclosure under the Cal. Public Records Act even if employees use personal account, Cal. SC. holds

Date 04/06/2017.

On March 2, 2017, the California Supreme Court held that the electronic communications of a public employee about the conduct of public business may be subject to disclosure under the California Public Records Act (“CPRA”) even if the employee used a personal account. The court considered how the law, originally designed to cover paper documents, […]

Consent to data processing should not be consideration for a free service, EDPS says

Date 04/04/2017.

  On March 14, 2017, the European Data Protection Supervisor (EDPS) released Opinion 4/2017 on the 2015 Proposal for a Directive (1) on certain aspects concerning contracts for the supply of digital content  (1) on certain aspects concerning contracts for the supply of digital content and  (2) on certain aspects concerning contracts for the online and […]

WP29 deems that the ePrivacy Regulation Proposal lowers GDPR’s standards

Date 04/04/2017.

On April 4, 2017, the Working Party 29 (WP29) released Opinion 1/2017 on the Proposed Regulation for the ePrivacy Regulation (2002/58/EC) – wp247 (ePrivacy Regulation Proposal). The WP29 welcomes the Proposal for the Regulation. However, it expressed several points of concern and suggested amendments. The European Commission, along with the European Parliament and the European […]

House of Representatives voted to repeal FCC’s Broadband Privacy Rules

Date 03/29/2017.

On March 28, 2017, the US House of Representatives approved 215 to 205 a joint resolution to repeal the order “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (“Order”) published on November 2016. See here. The joint resolution (S.J.RES34) passed by the US Senate and the House of Representatives disapproves the Order submitted […]

Home Depot to settle financial institution class against 2014’s data breach

Date 03/29/2017.

On March 8, 2017, Home Depot Inc. (Home Depot) reached an agreement that, if approved, will bring the putative class action, brought by certain financial institutions impacted by the company’s 2014 data breach, to an end. In September 2014, Home Depot announced that its payment data systems had been breached. See here. Investigation revealed hackers placed […]

The House to vote today to repeal Internet Privacy Rules

Date 03/28/2017.

The House is voting today on a bill to repeal Obama Administration’s internet privacy rules. The Senate already voted last Thursday (March 23, 2017) to repeal those rules. The rules that protect consumers’ online activity (Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (81 Fed. Reg. 87274 (December 2, 2016) were passed last year […]

ECJ holds dynamic IP addresses are personal data if additional information allowing user identification can reasonably be obtained from third parties

Date 03/16/2017.

On October 19, 2016, the European Court of Justice (“ECJ”) presented its conclusions in Patrick Breyer v. Bundesrepublik Deutschland (case C‑582/14). According to the ECJ The dynamic internet protocol address of a visitor constitutes personal data, with respect to the operator of the website, if that operator has the legal means allowing it to identify […]

Privacy Shield certification does not mean compliance needs to extend beyond European data

Date 03/10/2017.

When a US organization decides to self-certify under the EU-U.S. Privacy Shield, compliance with Privacy Shield principles becomes compulsory. This may be a problem for many US organizations because certain processing activities that they perform – which are perfectly lawful under American law — are unlawful under a Privacy Shield’s perspective. Why? And what to do? Let’s step […]

Cristina Vicarelli, La disciplina di Google Analytics a cavallo tra Italia e Germania

Date 03/08/2017.

Nel giugno del 2016, l’Autorità per la protezione dei dati personali (di seguito anche DPA) di Amburgo, in accordo con le altre presenti in Germania, si è occupata della compatibilità di Google Analytics con la normativa nazionale sulla protezione dei dati. Le indicazioni che sono emerse dal provvedimento dell’Autorità di Amburgo  appaiono a un primo […]