The Court of Justice of the EU has clarified whether the right of access from Article 15(3) GDPR also gives a right to a copy of the documents in which the personal data are recorded. This is only the case if that copy is necessary for an understandable and verifiable right of access by the data subject.
gdpr
Update on the use of cookies
The rules for being allowed to store and retrieve cookies are laid down in European and national laws and regulations. The rules specifically for cookies are based on the European ePrivacy Directive, which has been implemented in the Netherlands in the Dutch Telecommunications Act (art. 11.7a). The rules concerning the processing of personal data –
How should online search engine operators deal with requests for removal of links to (allegedly) inaccurate or fake third-party content?
Online search engine operators (‘search engines’) are often faced with individuals (applicants) requesting that an online negative publication or review about them no longer be indexed (linked) in the engine operator’s search results. In doing so, it is often argued that that negative publication or review would contain inaccurate or false information. For example, a
Annual Review of Privacy 2022
2022 was a year in which the (European) legislator, judges and regulators made plenty of noise in the field of privacy law. Numerous legislative initiatives at both the European and national levels saw the light of day, and more than once did the Dutch Data Protection Authority advise the Dutch legislator to pay more attention
GDPR & international transfer: deadline December 27, 2022
Last year, on June 4, 2021, the European Commission published a new model contract (in English: “Standard Contractual Clauses” or abbreviated “SCCs”) for the transfer of personal data to countries outside the European Economic Area (“EEA“). The old model contracts were no longer to be used for new transfers of personal data as of September
Proposed guidelines for the imposition of fines
The European Data Protection Board (‘EDPB’), composed of representatives of the EU national data protection authorities has drafted new guidelines with respect to the calculation of fines in case of non-compliance of the General Data Protection Regulation (‘GDPR’). These Guidelines complement the previously adopted Guidelines on the application and setting of administrative fines dating from 2016, which focus on the circumstances in which to impose a fine. This post outlines the main elements of the proposed guidelines and sets out the differences with the current national guidelines.
annual update data privacy
The General Data Protection Regulation celebrated its third anniversary in 2021. Privacy is a subject that is now on the agenda of most organisations. Moreover, the developments in this area of law are moving fast. The European and national legislators are not sitting still, and the same can be said of the supervisory authorities. Also,
new EU Standard Contractual Clauses for transfers of personal data to third countries
On 4 June 2021, the European Commission published a new model contract for the transfer of personal data to countries outside the European Economic Area (EEA). This article discusses the consequences of this for daily practice. In a nutshell The new model contract can be used for the concerned international transfers as from 27 June
the right to be forgotten of search results
The right to be forgotten was introduced in the Google/Costeja judgement of 13 May 2014. In response, Google created a request form for individuals to request the removal of specific search results that appear when their name is searched on in Google’s search engine. Since then, nearly one million removal requests have already been submitted
transfer of personal data after Brexit (part 2)
Earlier we wrote about the consequences for the transfer of personal data to (organisations in) the UK in the event of a no-deal-Brexit. It is now known that a deal has been concluded between the EU and the UK. Below we will explain what has been agreed on the transfer of personal data since 1
transfer of personal data after Brexit
The United Kingdom (‘UK’) left the European Union (‘EU’) on 31 January 2020. There is a transition period until 31 December 2020. Until then the UK will continue to comply with all EU laws and legislation. What will happen after this period is still not clear yet. Deal or no deal? It is however certain
use of corona rapid tests in an employment context (part 3)
Last weekend a Dutch newspaper reported that many companies are losing sleep over the lockdown and the lack of testing capacity. Not surprisingly more and more organisations are considering to take the testing of employees into their own hands. Especially the use of corona rapid tests is often mentioned. But is the use of those
use of corona rapid tests in an employment context (part 2)
Earlier we wrote about the use of corona rapid tests in an employment context. Due to a lack of testing capacity, people sometimes have to stay at home for several days at a time. As a result, organisations are struggling with a lack of employees in the workplace. This has particularly serious consequences for sectors
use of corona rapid tests in an employment context (part 1)
Testing. Testing. Testing. This is the current motto of the Dutch government. Even in case of mild complaints. Unfortunately, there appears to be a great lack of testing capacity at the moment. As a result, people have to stay at home for several days at a time. As a result, organisations are struggling with a
Dutch Data Protection Authority imposes hefty fine on Tennis Union
The Dutch Data Protection Authority (‘DPA’) imposed an administrative fine of € 525,000 on the Dutch Tennis Union for selling the personal data of its members to two sponsors. These sponsors approached part of these members with (tennis related) offers. Below we will discuss several interesting points from the DPA’s decision. (Co-)controllership The Tennis Union
