(Data Protection News & Services)
On 23 September 2020, the CNIL published an article reminding employers of the conditions under which they can implement personal data processing for the purpose of fighting the spread of the COVID-19 virus. The CNIL reminds employers and employees/agents of (i)their
During this 37th plenary session, the Board adopted Guidelines on the concepts of controller and processor and Guidelines on the targeting of social media users. The EDPB also created a taskforce focusing complaints following the CJEU Schrems II judgement and
By decision of 28 July 2020, the CNIL imposed a fine of €250,000 and an obligation to comply with the GDPR within 3 months of the decision, on SPARTOO, an online shoe retailer operating in 13 European countries. This is
On 23 July 2020, the European Data Protection Board (EDPB) released a FAQ on the consequences of the CJEU’s judgement of 16 Juley 2020 (Schrems 2)
This judgment invalidates the Privacy Shield, an EU-US data transfer mechanisms, and conditions the validity of the Standards contractual clauses (SCCs), another transfer mechanisms, to the prior analysis of the level of protection provided by the third country recipient and the implementation of additional measures where necessary.
This FAQ provides a glimpse of the position of the Authorities following the CJEU Decision that calls into question the possibility to transfer any personal data to the US. However, the EDPB remains relatively unspecific as it is currently working on more detailed guidance that should be released shortly.
By a decision of 23 June 2020, the German Federal Supreme Court provisionally confirms the allegation of abuse of a dominant position by Facebook because its users were not given the choice over the level of personalisation of their Facebook experience, which entails the collection of data from sources outside the Facebook network (e.g. Instragram, internet browsing etc.).
The Court considered that Facebook practice may hinder the competition in the social network and online advertising market due to its dominant position and provisionally upheld the decision of the German Federal Cartel Office (“Bundeskartellamt”) prohibiting Facebook from processing personal data collected outside the Facebook environment without the users’ additional consent.
This decision is interesting as it shows that in certain cases a breach of GDPR provisions may also have consequences on competition law matters.