A new paper from global law multinational DLA Piper lays out the case for a risk-based approach to GDPR international data transfers, arguing that the status quo is too onerous and that data exporters are suffering.
The GDPR fine was sparked by a round of media reports in early 2021 documenting how the personal data of over 530 million Facebook users was left open to data scraping for an extended period thanks to faults in certain tools.
Though the fine is not one of the largest issued by CNIL (or for general GDPR violations across the bloc), the case is noteworthy in that Discord is mostly being taken to task for not providing default or built-in security options rather than the fallout of a specific data breach.
The fourth draft data protection bill looks to be no less contentious, as it adds vital protections but also exempts the country's government from all of its terms and appears to give tech platforms a fairly free hand in sending citizen data overseas.
Losing Ireland "main establishment" status means that any national DPA in the EU could bring direct GDPR action against Twitter on behalf of its citizens without the standard collaborative process that ultimately funnels everything through the Irish DPC.
When the California Privacy Rights Act (CPRA) takes effect and replaces the California Consumer Privacy Act (CCPA) on January 1, 2023, businesses will have new privacy obligations with respect to personal information of employees, applicants for employment, independent contractors, owners, directors, officers, and their beneficiaries and emergency contacts who are California residents.
The case began with a probe opened by an assortment of state attorneys general in 2018 in response to consumer complaints. The investigation found that Google had been misleading about its use of location tracking dating back to at least 2014.
Data protection laws have become a point of growing concern for US businesses. With the enactment of the CPRA just around the corner, enterprise organizations must take action now to prepare themselves for the coming surge of employee DSARs.
Both countries, while accepting the EU standard contractual clauses as a compliance transfer mechanism still requires the clauses to be amended to reflect their own legal requirements. The big difference is that the Swiss requirements are very simple.
Instead of introducing an entirely new regime, the UK Government should explore the use of privacy enhancing technology to enable organisations to share and analyse personal data in a privacy-preserving manner, to create opportunities and unlock the power of data using innovative and trustworthy applications.