Phil Lee’s Post

On 12 October data transfers from the UK to the US will become simpler, at least from a data compliance perspective. That is when the new 'data bridge' between the UK and US will open. In legal terms, the UK government has decided that the USA provides adequate protection for personal data if two conditions are met. First, the personal data is transferred to an organisation that has joined the UK extension of the EU-US Data Privacy Framework. Second, the EU-US Data Privacy Framework Principles apply to the personal data. A list of organisations that have joined the UK extension, and an explanation of the framework principles is available at: https://lnkd.in/ezkaFhxd

If you’re tired of using standard contractual clauses to legitimize your European personal data transfers to the US—and we bet you are—the European government has approved a practical alternative. The European Commission recently adopted an adequacy decision for the new EU-US Data Privacy Framework (DPF), aiming to bolster the uninterrupted flow of more than $7 trillion in annual transatlantic trade and investments. Amy Lewis, Matt Meinel, and Michael Snodgrass discuss how BRG’s team of privacy professionals can assist with evaluating whether your company should certify to the DPF. Read the alert. #dataprivacy #personaldata #datatransfer #investment

Curious about the new EU-U.S. Data Privacy Framework? Not sure whether to certify to the DPF or even how? Check out our recent article summarizing the Framework and the practical steps needed to get certified. If you'd like help understanding how the DPF may apply to your business or how to get your company certified, please reach out!

🧐 🍁 A few takeaways from the recent amendments to Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (PPIPS), courtesy of the Rulefinder Data Privacy crew 🎁: 📌 Companies doing business in Quebec now need to: - establish and implement data protection governance policies and practices - conduct privacy impact assessments for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information 📌 In addition, anyone collecting personal information: - using technology allowing an individual to be identified, located or profiled must first inform the individual: ❶ of the use of such technology ❷ of the means available to activate the functions that allow an individual to be identified, located or profiled   - through technological means must: ➤ publish on the relevant enterprise’s website, and disseminate to concerned persons by appropriate means, a confidentiality policy drafted in clear and simple language   📌 The Quebec government has been empowered to make regulations to determine the criteria and terms applicable to the anonymisation of personal information.   📌 The relevant regulator has since issued new guidance for complying with the amended privacy act, covering topics such as the applicability of the law, the role of a privacy officer and alternatives to consent.   But if you’re a Rulefinder Data Privacy subscriber, you know all this already!   Not subscribed yet? Get in touch. We’d love to tell you how Rulefinder Data Privacy is different from other privacy info out there.   #CanadaPrivacy #QuebecPrivacy #DPrules

Data Privacy Week - 22nd January 2024 to 26th January 2024. Why is #data privacy week celebrated? It is an extension of Data Protection Day in Europe, which commemorates the January 28, 1981 signing of Convention 108, the first international treaty to address data privacy. A treaty titled “The Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data ” was formed by the Council of Europe. This was the first-ever international treaty that dealt with data privacy and its protection. The treaty safeguarded the rights to privacy of #users, maintaining the ever-growing digital flow of #personaldata across borders. It laid the groundwork for subsequent efforts to safeguard individuals' personal data. #dataprivacy #personaldataprotection #datalaws

🧐 🍁 A few takeaways from the recent amendments to Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (PPIPS), courtesy of the Rulefinder Data Privacy crew 🎁: 📌 Companies doing business in Quebec now need to: - establish and implement data protection governance policies and practices - conduct privacy impact assessments for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information 📌 In addition, anyone collecting personal information: - using technology allowing an individual to be identified, located or profiled must first inform the individual: ❶ of the use of such technology ❷ of the means available to activate the functions that allow an individual to be identified, located or profiled - through technological means must: ➤ publish on the relevant enterprise’s website, and disseminate to concerned persons by appropriate means, a confidentiality policy drafted in clear and simple language 📌 The Quebec government has been empowered to make regulations to determine the criteria and terms applicable to the anonymisation of personal information. 📌 The relevant regulator has since issued new guidance for complying with the amended privacy act, covering topics such as the applicability of the law, the role of a privacy officer and alternatives to consent. But if you’re a Rulefinder Data Privacy subscriber, you know all this already! Not subscribed yet? Get in touch. We’d love to tell you how Rulefinder Data Privacy is different from other privacy info out there. #CanadaPrivacy #QuebecPrivacy #DPrules

Data Privacy Day, celebrated each year on January 28, began as a day to commemorate the 1981 signing of Convention 108, the first legally binding international treaty dealing with privacy and data protection. Since that time, privacy has grown in importance in Canada and around the world, and many countries now celebrate a full Data Privacy Week. Data Privacy Week 2024, taking place from January 22 to 26, will focus on the theme of “take control of your data” as declared by the Office of the Privacy Commissioner of Canada. In recognition #DPW2024, McMillan LLP’s Privacy and Data Protection Team will provide a series of best practices to help you stay ahead. In our first post, learn more how organizations can take control of their data: https://bit.ly/3Hu57DW #privacylaw #dataprotection

Reminder to join us tomorrow for a great conversation on the new Data Privacy Framework. The European Commission recently issued its draft adequacy decision on the EU-US Data Privacy Framework (EU-US DPF) following the invalidation of the Privacy Shield. The EU-US DPF aims to ensure that further safeguards are in place for the transfer of personal data of EU citizens out of Europe. Organizations looking to certify with the EU-US DPF will need to consider new and additional items covered in the Commission’s draft adequacy decision. These include ensuring that your privacy program encompasses a broader scope of personal data, amending privacy notices to an EU level of transparency, and ensuring your vendor contracts include new provisions of the EU-US DPF. Speakers include Ahmad Javaid (Chief Executive Officer, Cytellite), Nino Tlapak (DORDA Attorneys), Paul Lanois (Fieldfisher), Odia Kagan (Partner, Fox Rothschild), Kevin M. Clark (Discovery Counsel and Vice President of Analytics and Review Operations, HaystackID) and Julia Wernicke (Head of Data Protection & DPO, Berlin-Chemie Menarini)

The European Commission took a leap into transatlantic data transfers by introducing the E.U.-U.S. Data Privacy Framework. This development would raise the bar for U.S. data protection, matching the standards set by the E.U. and paving the way for certified companies to securely transmit personal data across the Atlantic. The big question: Will U.S. companies align with the strict, European-style data integrity and purpose-limitation regulations? Find out the answer from ALM: https://hubs.la/Q01YTdFH0 #DataPrivacy #LevelLegal

As you may have seen, we're hosting a webinar at Digiphile on 29 January on 2023's Privacy Bonanza, and taking a look at some of the key trends emerging from CJEU and regulatory decisions over that period. But just how significant was 2023 in terms of CJEU decisions on data protection issues? The graph below*, showing CJEU data protection decisions between 1995 and 2024, speaks for itself... Interested to learn more? Then sign up for our webinar here: https://lnkd.in/eB5WFtpv * Graph based on research undertaken on the CJEU's InfoCuria Case Law search form at https://lnkd.in/e4UA39A3, using the settings "subject matter: data protection", "case status: cases closed", "period or date: date of delivery" and using the "from/to" dates for each year below. Marco Piana, Michael Brown, Isabelle Lee, Al Lee