March 10, 2021
02/25/2021 – Court of Justice of the European Union | Failure to transpose a directive | Spain
The Court of Justice of the European Union declared that Spain failed to adopt national measures necessary to ensure the transposition of the Directive on the protection of personal data for the purposes of the prevention and detection of criminal offences.
In light of the seriousness and duration of the infringement, Spain is ordered to pay a financial penalty of € 15 million and, should the infringement persists, a daily penalty payment of € 89 000.
For further information: Press Release | Judgment of the Court – Case C-658/19
02/22/2021 – European Data Protection Supervisor | Opinion | Brexit agreements
The European Data Protection Supervisor published its Opinion on the conclusion of the EU-UK Trade and Cooperation Agreement and the EU and UK exchange of classified information agreement.
For further information: EDPS Opinion 3/2021
02/19/2021 – European Commission | Adequacy decisions | Brexit
The European Commission published two draft adequacy decisions for transfers of personal data to the UK: one under the GDPR and the other one in relation to the Law Enforcement Directive.
In order to adopt the final adequacy decisions, the European Commission must now obtain the opinion of the European Data Protection Board and request the green light from a committee composed of Member States’ representatives. The European Commission recalled that the conditional interim regime, under which data transfers can continue according to the EU-UK Trade and Cooperation Agreement, expires on 30 June 2021.
For further information: Press Release | Draft adequacy decision under GDPR | Draft adequacy decision for the Law Enforcement Directive
02/11/2021 – European Union Agency for Cybersecurity | Report | Autonomous Driving
The European Union Agency for Cybersecurity (ENISA) issued a report, with the Joint Research Centre, on cybersecurity risks related to Artificial Intelligence in autonomous vehicles.
For further information: Press Release
02/10/2021 – Council of the European Union | Legislative procedure | e-Privacy Regulation proposal
Member States agreed on a proposal of e-Privacy Regulation and on a negotiating mandate.
This agreement allows the Portuguese presidency to start talks with the European Parliament on the final text.
For further information: Press Release | e-Privacy Regulation proposal adopted by the Council of the EU
02/10/2021 – European Data Protection Supervisor | Opinions | Digital Services Act and Digital Markets Act
The European Data Protection Supervisor issued two Opinions on both proposals Digital Services Act (DSA) and Digital Markets Act (DMA).
For further information: Press Release| EDPS Opinion 1/2021 on the DSA | EDPS Opinion 2/2021 on the DMA
02/09/2021 – European Union Agency for Cybersecurity | Reports | Cryptography
The European Union Agency for Cybersecurity (ENISA) released two reports on cryptography.
The first report is on the progress of post-quantum cryptography standardization, and the other report on exploring the technologies under the hood of crypto-assets.
For further information: Press Release
02/08/2021 – European Commission | Article | Covid-19
The European Commission published an article on how Covid-19 tracing and warning apps can help break the chain of infections, nationally and across borders.
For further information: European Commission website
02/04/2021 – European Commission | Infringement procedures | European Electronic Communications Code
The European Commission announced that it has opened infringement procedures against 24 Member States for not transposing the Directive establishing the European Electronic Communications Code, which deadline was 21 December 2020.
For further information: Press Release
02/04/2021 – European Parliament |Draft Motion for a resolution | Irish Supervisory Authority
The EU Committee on Civil Liberties, Justice and Home Affairs (LIBE) published a draft motion for a resolution, calling the European Commission to start infringement procedures against the Irish Supervisory Authority for failing to properly enforce the GDPR.
For further information: Draft motion for a resolution from the LIBE Committee
01/29/2021 – Belgium Supervisory Authority | Covid-19 vaccination
The Belgium Supervisory Authority published on its website a Q&A page on the processing of personal data relating to vaccinations as part of the fight against the Covid-19 pandemic.
For further information: APD website (in French)
02/12/2021 – Danish Supervisory Authority | Guide | Cookies
The Danish Supervisory Authority published a guide on cookies rules specifying the obligations imposed on websites.
For further information: Datatilsynet website (in Danish) |Datatilsynet guide (in Danish)
02/24/2021 – French Supervisory Authority | Article | Health data breach
Following the publication of several articles mentioning a massive leakage of health data (impacting nearly 500.000 individuals), the French Supervisory Authority (CNIL) published an article relating to data controllers’ obligations in case of data breach and the CNIL’s functions regarding cybersecurity matters.
For further information: CNIL website (in French)
02/12/2021 – French Supervisory Authority | Guide | Compliance assistance
The French Supervisory Authority published a guide to assist organizations and outline its action, method and limits.
For further information: CNIL website (in French) | CNIL guide (in French)
02/04/2021 – French Supervisory Authority | Article | Cookies
The French Supervisory Authority reminded that the deadline for compliance of websites and mobile apps with the new rules on cookies is 31 March 2021.
For further information: CNIL website (in French)
02/23/2021 – Berlin Regional Court | Decision | GDPR fine dismissed
The Berlin Regional Court struck down a € 14.5 million fine issued by the Berlin data protection authority against Deutsche Wohnen SE for alleged lack of corporate responsibility for a potential GDPR infringement. The Berlin Prosecuter has filed an appeal.
For further information: Press realease by the data protection authority (in German)
02/10/2021 – German Supervisory Authority | Statement | e-Privacy Regulation proposal
Considering the publication of the e-Privacy Regulation proposal by the Council of the European Union, the German federal Supervisory Authority (BfDI) criticized a serious interference in the fundamental rights of European citizens.
In particular, the BfDI criticized the authorization of cookie walls and the removal of certain safeguards provided under the GDPR.
For further information: Press Release (in German)
02/10/2021 – German Federal Government | Draft bill | Telecommunications Telemedia Data Protection Act
The German Federal Government published a draft bill of a new Telecommunications Telemedia Data Protection Act (TTDSG).
The draft bill is intended to consolidate existing legal provisions regarding data protection and telecommunications secrecy and transpose EU law into German law – including the ePrivacy Directive and corresponding definitions contained in the European Electronic Communications Code (EECC).
For further information: Announcement including draft bill (in German)
01/14/2021 – German Constitutional Court | Decision | Requirement for referral to Court of Justice of the European Union
The German Constitutional Court decided that a local court must seek a preliminary ruling from the Court of Justice of the European Union before dismissing a claim for monetary compensation for an allegedly minor GDPR violation.
For further information: Full decision (in German)
02/25/2021 – Irish Supervisory Authority | Annual Report
The Irish Supervisory Authority published its 2020 Annual Report and specified, in particular, that it intends to continue as a leader in the GDPR full implementation.
For further information: DPC website | DPC 2020 Annual Report
02/10/2021 – Irish Supervisory Authority | Article | Access request
The Irish Supervisory Authority published an article aiming to explain the difference between discovery and access requests, following the decision of the High Court Dudgeon v. Supermacs Ireland Ltd. issued in November 2020.
For further information: DPC website
02/19/2021 – Italian Supervisory Authority | Sanction | Biometric data
The Italian Supervisory Authority announced that it has fined a health facility €30,000 for collecting its employees’ fingerprints to access the premises without legal basis.
For further information: Garante website (in Italian)
02/19/2021 – Italian Supervisory Authority | Sanctions | Health data breaches
The Italian Supervisory Authority issued sanctions against three health facilities amounting from €10,000 to €50,000 for having accidentally communicated health data to the wrong patients.
For further information: Garante website (in Italian)
02/17/2021 – Italian Supervisory Authority | Q&A | Covid-19 vaccination
The Italian Supervisory Authority published a Q&A on the processing of employee’s personal data related to Covid-19 vaccinations which can be implemented by an employer.
For further information: Garante website (in Italian) | Q&A page (in Italian)
02/17/2021 – Italian Competition Authority | Sanction | Unfair practice
The Italian Competition Authority issued a fine of € 7 million against a social network, for failing to comply with the order, issued in November 2018, requiring to cease unfair practices.
For further information: Press release
02/03/2021 – Italian Supervisory Authority | TikTok response
The Italian Supervisory Authority published TikTok’s response to the request for information regarding the processing of children’s data.
TikTok indicated that it will implement measures to ban access to users under 13 and will consider deploying AI-based systems for age verification purposes. An information campaign will also be launched by TikTok to raise parents’ and children’s awareness.
For further information: Press release
02/09/2021 – Dutch Supervisory Authority | Sanction | Data Security
The Dutch Supervisory Authority imposed a fine of €440,000 against a hospital for failing to secure medical records in an appropriate manner.
For further information: AP website (in Dutch) | AP decision (in Dutch)
01/24/2021 – Norwegian Supervisory Authority | Intention to fine | Invalid consent
The Norwegian Supervisory Authority (Datatilsynet) announced its intention to fine of NOK 100 million (approx. € 10 million) an online dating app.
It is a draft decision and Datatilsynet will take into account the company’s comments.
For further information: EDPB website | Datatilsynet website | Datatilsynet advance notification of an administrative fine
02/19/2021 – Polish Supervisory Authority | Sanction | Security
The Polish Supervisory Authority published its decision, dated 11 February 2021, to impose a fine of PLN 100,000 (approx. €22,000) against the National School of Judiciary and Public Prosecution for failing to take appropriate technical and organizational measures.
For further information: UODO website | UODO decision (in Polish)
02/09/2021 – Polish Supervisory Authority | Sanction | Non-compliance with an order
The Polish Supervisory Authority published its decision, dated 15 January 2021, to impose a fine of PLN 85,000 (approx. €19,000) for failing to comply with its order requiring to notify a data breach to the impacted individuals.
For further information: UODO website | UODO decision (in Polish)
02/11/2021 – Spanish Supervisory Authority | Sanction | Right to erasure
The Spanish Supervisory Authority (AEPD) imposed a sanction of €200,000 against a telecommunication operator which continued to contact an individual despite that he exercised his right to erasure.
The AEPD had already issued two sanctions against this company for the same infringement.
For further information: AEPD Resolution No. PS-00430-2020 (in Spanish)
02/10/2021 – Spanish Supervisory Authority | Sanction | Direct marketing
The Spanish Supervisory Authority imposed a sanction of €40,000 against a company making direct marketing calls to individuals who registered their phone numbers in the national “opposition” registry, called “Robinson List”.
The sanction was reduced to €24,000 taking into account the immediate payment of the fine.
For further information: AEPD Resolution No. PS-00026-2021 (in Spanish)
02/10/2021 – Swedish Supervisory Authority | Sanction | Illegal processing
The Swedish Supervisory Authority imposed a sanction of SEK 2,500,000 (approx. €250,000) against the Swedish Police Authority for using, without any prior authorization, an AI-based facial recognition application.
For further information: IMY website | IMY decision (in Swedish)
02/17/2021 – UK Supervisory Authority | Toolkit | Data analytics
The UK Supervisory Authority issued a toolkit for organizations considering using data analytics on personal data.
The toolkit takes organizations through some of the key data protection points they need to consider from the outset of any project involving data analytics and personal data.
For further information: ICO website | ICO toolkit
02/09/2021 – UK Supervisory Authority | Sanction | Nuisance calls
The UK Supervisory Authority issued two fines totaling £270,000 to two firms (amounting £150,000 and £120,000) for making unlawful marketing calls to phone numbers registered with the Telephone Preference Service (TPS).
For further information: ICO website; ICO decision (for the £150,000 fine); ICO decision (for the £120,000 fine)
01/28/2021 – UK Supervisory Authority | Sanction | Direct marketing
The UK Supervisory Authority issued a fine of £10,000 against a company that sent a total of 491,995 direct marketing messages relating to face masks, while the recipients had not given their consent.
For further information: ICO website | ICO’s monetary penalty notice
02/04/2021 – Interactive Advertising Bureau Europe | Guide | Third-party cookies
Interactive Advertising Bureau Europe (IAB) updated its guide to the post third-party cookie era.
For further information: IAB Europe Guide
This newsletter has been prepared by the EU Privacy team of Gibson Dunn. For further information, you may contact us by email:
© 2021 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.