Most proposed changes to the GDPR in the European Commission's digital omnibus package would, if approved, diverge in some respects from U.K. data protection law, Stephenson Harwood data protection attorneys said in a Nov. 27 analysis that assessed how the 10 key proposed GDPR changes compare with U.K. law. However, they are unlikely to affect either side's data transfer adequacy decisions, said Hogan Lovells privacy lawyer Eduardo Ustaran.
GDPR
The General Data Protection Regulation (GDPR) is the European Union’s landmark privacy law governing how organizations collect, process and protect personal data. In effect since 2018 it applies to any entity handling EU residents’ information regardless of where the company is based and imposes strict requirements around consent, transparency, data minimization and user rights. GDPR enforcement has led to billions in fines against global companies setting a high bar for compliance frameworks worldwide and influencing privacy legislation in the U.S. and other regions.
Financial institutions may offer "targeted support" to help customers make informed decisions about their finances but must also respect data protection rights and direct marketing preferences, the U.K. ICO and Financial Conduct Authority (FCA) said Thursday.
India's detailed Digital Personal Data Protection Act (DPDPA) will potentially be a substantial compliance burden for companies, Kochlar & Company technology attorney Stephen Mathias said in a Hogan Lovells podcast Thursday.
The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) already agree that a European Commission-proposed change to the definition of personal data in the digital omnibus "seems to go further than the recent CJEU [Court of Justice of the EU] case law, and beyond a targeted modification of the GDPR," the EDPB said Thursday.
Lawyers and privacy advocates are raising questions about a key proposal in the European Commission's digital omnibus package that aims to reform the GDPR by allowing legitimate interests as a legal basis for processing personal data for AI models.
Before publishing an ad on their platforms, online marketplace owners are responsible for ensuring that an advertiser is the actual person whose sensitive information appears in an ad or that the advertiser has the express consent of that person, the European Court of Justice (ECJ) said Tuesday (Case C-492/23, Russmedia Digital and Inform Media Press).
The European Commission's proposed digital omnibus, including possible changes to the GDPR, is on the European Data Protection Board's plenary agenda for Wednesday. The discussion will focus on the proposal itself and the board's contribution to it.
The European Commission's Digital Omnibus, announced Nov. 19 (see 2511190005), sparked strong support and opposition from EU lawmakers at a streamed Tuesday evening plenary discussion with Henna Virkkunen, EC executive vice-president, tech sovereignty, security and democracy.
Public and private contracting parties often require suppliers to show evidence of compliance with labor clauses to ensure fair pay and working conditions, and this information typically takes the form of employees' payroll and timesheets, employment contracts and so forth, the Danish DPA noted Monday.
The change to the definition of "personal data" in the GDPR is one of the most significant proposals in the European Commission's new digital omnibus, privacy attorneys and advocates said. It's unclear so far whether the reform represents a pragmatic or messy approach to data protection, they added.