Data Protection in the News - June 2021

Expert commentary from Tim Lennard with a roundup of recent data privacy stories
from around the globe

The last few days have seen the publication by the EU of long awaited revised Standard Contractual Clauses (SCCs) intended to better reflect the GDPR. The new modular version of the SCCs, while widening how they can be applied, introduces some complexity for organizations. Their use is limited for contracts with entities that are not subject to the GDPR, and this is a trip hazard. Many overseas processors are subject to GDPR as a result of the existing extra-territorial scope defined under Article 3, so that leaves the question of when SCCs should be used.
 
There has been noise in the EU parliament from some vocal MEPs on the granting of ‘adequacy status to the UK’. Those that are dissatisfied with the outcome may have to rely on the 4-year sunset period for that agreement and challenge any renewal at that point. There have also been voices of censure and dissatisfaction over the lack of apparent vigour and urgency that the Irish regulator (DPC) has shown with regard to pursuing actions against the tech giants that fall within its jurisdiction. The EU Parliament voted to pressure its Commission to begin infringement proceedings against the Irish DPC.

Bowing to the related concern about exporting personal data from the EU, Microsoft has announced that it will provide infrastructure for its customers to host and process all data inside the EU.

Watch out for cookie compliance! NYB, the organization behind Max Schrems, the author of the downfall of the US Privacy Shield, is beginning a programmatic review of the cookie notifications of thousands of commercial EU websites to expose those that are non-compliant in providing ease of ‘opt out’. Expect some significant findings in this area.

view full newsletter