Data Protection in the News - September 2020

Expert commentary from Tim Lennard with a roundup of recent data privacy stories
​from around the globe

August has been awash with commentary about the impact of the July Schrems II case decision that struck down the US Privacy Shield Framework as invalid.

The consensus is that there are no easy answers. The EU and US Dept of Commerce have announced that they are looking into a potential resolution, but informed commentators are betting against any likely fix from governmental agencies. The path to legality of transfers from the EU to the US is ill-defined and pushed back onto individual organisations to navigate through their process and contractual frameworks to try to stay legal. DPAs are not yet aligned on the topic, but the German DPA has issued guidance to organizations.
 
Meanwhile, Herr Schrems has launched further action against 101 EU companies that forward data to Facebook and Google, and class actions have been filed in the UK and Netherlands against Marriott, Salesforce and Oracle, the latter related to use of third-party cookies without appropriate consent.
 
While reported security incidents and breaches in the UK have significantly reduced in April-June 2020 compared with the previous year, our suspicion is that this is more to do with the influence of COVID on work practices, resourcing and commercial priorities, than anything else.
 
If anything, the temperature in the global data privacy kitchen continues to rise, with legislation developments in China, Hong Kong, Canada, California and Brazil, to name but a few.

view full newsletter