On 16 July 2021, the Luxembourg data protection authority imposed a fine of 746 million euros on Amazon Europe Core.
GDPR – LUX : The Luxembourg Data Protection Authority Imposes a record high 746 million euros fine on Amazon
TikTok : The Dutch DPA issues a € 750,000 fine for a breach of children’s privacy and transfers its investigation findings to the Irish DPA for further ruling
The Dutch Data Protection Authority (DPA) has imposed a fine of € 750,000 on TikTok, a social media apps very popular amongst young users, for breaching young children’s privacy. The Dutch Authority noticed that the privacy policy provided by TikTok
Facebook – Whatsapp: The EDPB requires the Irish SA to carry out statutory investigation on Facebook
On July 15, 2021, the European Data Protection Baord (EDPB) adopted its first urgent binding decision in application of Art. 66(2) GDPR following a request from the Hamburg supervisory authority.
In this case, the Hambourg Authority ordered a ban on processing WhatsApp users’ data by Facebook Ireland for their own purposes following a change in the Terms of Service and Privacy Policy applicable to European users of WhatsApp Ireland Ltd.
However, under article 66 GDPR, as the Irish supervisory authority is the the lead supervisory authority in this matter, the Hamburg Authority needed the validation of the EDPB for these provisional measures to become final.
The EDPB rejected the Hamburg Auhtority’s request but requires further investigations to be carried out on Facebook and Whatsapp Ireland.
CNIL – France : A Purchase is Required for Sending Marketing Emails Without the Account Holders’ Consent
On 17 June 2021, the CNIL imposed a fine of 500,000 Euros and an obligation to comply within 3 months under a penalty of 500 Euros per day on BRICO PRIVÉ, a French company opearating a DIY private sales website
International Data Transfers : the UK is Officially an Adequate Third Country
As expected, the Commission has adopted two adequacy decisions for transferring personal data freely to the United Kingdom – one under the General Data Protection Regulation (GDPR) and the other for the Law Enforcement Directive. These adequacy decisions also facilitate