Data Protection in the News - November 2020

Expert commentary from Tim Lennard with a roundup of recent data privacy stories
​from around the globe

An interesting month for data privacy, including clarification published by the EDPB on the respective roles of Controller and Processors, of relevance surely to the B2B sector where personal data is passed through a number of participants and where responsibilities can be opaque. The ICO (UK) also issued guidance on the dos and don’ts of data subject requests and the related costs and timescales. The ICO again in play with a critical report of data broking services, and censure of Experian, Equifax and TransUnion for significant shortfalls.

In the US, Californians approved the CPRA which extended and modified protection offered under the CCPA (2018).

Actions of EU regulatory authorities continue, the Hamburg Data Protection Commissioner fined clothing retailer H&M €35.2 million for several violations of the GDPR related to collection of employee data.

The UK ICO levied a £20m fine on British Airways, which was a significant climb down from the initially reported £183m penalty. The ICO has come under criticism for failing to ‘play hard’; the same criticism surrounded their ‘quiet’ closure of a complaint over real-time bidding in the ad tech industry, where they had already published a damning analysis of practices in that space. The Belgian DPA weighing in with findings that the Internet Advertising Bureau’s (IAB) Transparency and Consent Framework (TCF), widely adopted by ad tech players, fails to meet the required legal standards of data protection.

One cannot help but wonder how the quiet war between the tech industry and consumer champions will play out. Will it be in court or in smoke-filled rooms? Consumer advocates will not concede without a struggle, as witnessed by the ongoing class actions mounted against British Airways, Oracle and Salesforce.

view full newsletter