The European Data Protection Board (EDPB), based on the request of the Irish Supervisory Authority, issued its opinion under Art. 64(2) GDPR on certain data protection aspects related to the processing of personal data in the context of AI models (the "Opinion").
Below, I briefly summarise the…
Are cars already driven by data?
In recent years, vehicles have been increasingly transformed into computers on four wheels. Connected or smart vehicles collect a lot of data in their operation and the data collection is not limited to their users, but also affects their immediate or wider environment. This data collection will…
How should small businesses apply the GDPR?
Nowadays it is almost inconceivable to carry out any economic activity without data processing. No matter how small the business may be, the processing of personal data, including customer data, partner data or employee data, is usually a necessary part of its operations. Therefore, compliance with…
Data transfers to the USA: is the new Privacy Shield coming?
The European Commission and the United States announced in a joint statement earlier this year that an agreement on the principles of a new Trans-Atlantic Data Privacy Framework had been reached. After this announcement, everyone has been waiting for the publication of the Executive Order to be…
International data transfers after Schrems II
One of the most important data protection related news this summer is the European Court of Justice's judgment in Schrems II case published on 16th of July (Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd, and Maximillian Schrems).
The judgment contains the following main…
The German DPAs' new concept on calculating GDPR fines
The Conference of the independent Data Protection Authorities of Germany (Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder; DSK) published its generally applicable principles on imposing GDPR fines on companies. By publishing its concept, the DSK follows the Dutsch…
Data processing in the course of providing online services
Important new guidelines became available
Online services became part of our everyday life. The provision of online services, in almost all cases, goes hand in hand with data processing. On the one hand, we provide our data intentionally to the service providers when we decide to use services online but in other cases, data are collected…
Lists of mandatory DPIAs
GDPR requires supervisory authories to establish and make public their lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment (DPIA).
22 supervisory authorities submitted their draft lists to the European Data Protection Board (EDPB)…
List of mandatory data protection impact assessments in Hungary
The Hungarian Data Protection Authority (NAIH) published its "black list" on processing activities that shall be subject to data protection impact assessment, in line with Section 35 (4) of the GDPR. The European Data Protection Board provided its opinion on the draft list at the end of September…
Developing case law under the GDPR
Five months have passed since May 25 when the General Data Protection Regulaton (GDPR) became applicable in the European Union. Data controllers and processors struggled a lot to be ready for the application of the rules of the GDPR. However, there are several rules in the GDPR that leave space for…