The Hamburg Commissioner for Data Protection and Freedom of Information Wednesday unveiled a draft discussion paper aimed at building a bridge between the General Data Protection Regulation and the EU AI Act.
GDPR
The General Data Protection Regulation (GDPR) is the European Union’s landmark privacy law governing how organizations collect, process and protect personal data. In effect since 2018 it applies to any entity handling EU residents’ information regardless of where the company is based and imposes strict requirements around consent, transparency, data minimization and user rights. GDPR enforcement has led to billions in fines against global companies setting a high bar for compliance frameworks worldwide and influencing privacy legislation in the U.S. and other regions.
The variety in privacy laws and standards give companies some flexibility in how consent banners are displayed on their websites, said panelists during an IAPP webinar Tuesday. But they cautioned that teams throughout an organization must understand how trackers operate on the site and what data is collected.
Europe's public interest and digital sectors dueled over the European Commission's plans to reduce regulatory burdens, including the General Data Protection Regulation (GDPR), in documents published Tuesday.
Data minimization is an evolving regulatory landscape that is garnering increased awareness lately as trust and transparency become more of a focus for organizations and data breaches highlight the impact of having extra data, said panelists during a webinar hosted by compliance vendor TrustArc on Thursday.
The EU General Court threw out a challenge to the EU-U.S. Data Privacy Framework (DPF) on Wednesday, confirming that the U.S. adequately protects Europeans' personal data and that trans-Atlantic data flows can continue.
The EU Data Act, which takes effect Sept. 12, is awash with uncertainties that will likely spark challenges from consumer and plaintiff lawyers and impel data protection authorities (DPAs) to "become active very early on," Latham & Watkins data, cyber and tech lawyer Tim Wybitul told Privacy Daily this week.
Femtech offers groundbreaking innovations in women's health but also poses serious privacy threats, data protection lawyers said. Even the EU, with its General Data Protection Regulation and AI Act, and the U.K., with its version of the GDPR, may not always provide adequate protection for the highly sensitive personal data that femtech apps collect and use, they added.
Europeans seeking compensation for non-material damages such as emotional stress arising from data breaches shouldn't generally expect large sums, according to attorneys from William Fry and Austrian lawyer and privacy advocate Max Schrems.
A German regional court on Tuesday dismissed a request for a preliminary injunction in a General Data Protection Regulation-related lawsuit against Meta over its AI-related data processing.
Asian AI developers looking to do business in the U.S., EU or U.K. face several key compliance challenges, Finnegan lawyers said Wednesday at the law firm's webinar.