In recent years, vehicles have been increasingly transformed into computers on four wheels. Connected or smart vehicles collect a lot of data in their operation and the data collection is not limited to their users, but also affects their immediate or wider environment. This data collection will…

Nowadays it is almost inconceivable to carry out any economic activity without data processing. No matter how small the business may be, the processing of personal data, including customer data, partner data or employee data, is usually a necessary part of its operations. Therefore, compliance with…

The European Commission and the United States announced in a joint statement earlier this year that an agreement  on the principles of a new Trans-Atlantic Data Privacy Framework had been reached. After this announcement, everyone has been waiting for the publication of the Executive Order to be…

One of the most important data protection related news this summer is the European Court of Justice's judgment in Schrems II case published on 16th of July (Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd, and Maximillian Schrems). The judgment contains the following main…

The Conference of the independent Data Protection Authorities of Germany (Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder; DSK) published its generally applicable principles on imposing GDPR fines on companies. By publishing its concept, the DSK follows the Dutsch…

Online services became part of our everyday life. The provision of online services, in almost all cases, goes hand in hand with data processing. On the one hand, we provide our data intentionally to the service providers when we decide to use services online but in other cases, data are collected…

GDPR requires supervisory authories to establish and make public their lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment (DPIA). 22 supervisory authorities submitted their draft lists to the European Data Protection Board (EDPB)…

The Hungarian Data Protection Authority (NAIH) published its "black list" on processing activities that shall be subject to data protection impact assessment, in line with Section 35 (4) of the GDPR. The European Data Protection Board provided its opinion on the draft list at the end of September…

Five months have passed since May 25 when the General Data Protection Regulaton (GDPR) became applicable in the European Union. Data controllers and processors struggled a lot to be ready for the application of the rules of the GDPR. However, there are several rules in the GDPR that leave space for…