PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

Schrems II: Reflections on the Decision and Next Steps

Schrems II - US Surveillance Law

Professor Paul Schwartz and I recently edited the Schrems II decision for our Information Privacy Law casebook.  Schrems II is short for Facebook Ireland Ltd. v. Maximillian Schrems — the second challenge by Maximillian Schrems to the transfer of data between the EU and US.  In Schrems I, the European Court of Justice (CJEU) invalidated the Safe […]

Read More…

Why I Love the GDPR: 10 Reasons

GDPR Love 01

I have a confession to make, one that is difficult to fess up to on the US side of the pond: I love the GDPR. There, I said it. . . In the United States, a common refrain about GDPR is that it is unreasonable, unworkable, an insane piece of legislation that doesn’t understand how […]

Read More…

GDPR Cartoon: Lawful Processing

Cartoon GDPR Lawful Processing

This cartoon focuses on the lawful processing requirement.  Under the EU’s General Data Protection Regulation G(DPR), the collection and processing of personal data must be for “specified, explicit and legitimate purposes.”   This is in contrast to the United States where the processing of personal information is permitted unless a law forbids it. Under the GDPR, […]

Read More…

Key EDPB (European Data Protection Board) Documents for GDPR

EU Article 29 Working Party GDPR Guidance

The EDPB (European Data Protection Board) was created by the EU Data Protection Directive in 1996.  Its purpose is to provide advice, opinions, and guidance about data protection.  The EDPB (European Data Protection Board) is composed of a representative from each EU member state. Below are some of the most important guidelines to be issued […]

Read More…

Key WP29 Documents for GDPR

EU Article 29 Working Party GDPR Guidance

The Article 29 Working Party was created by the EU Data Protection Directive in 1996.  Its purpose is to provide advice, opinions, and guidance about data protection.  The Article 29 Working Party is composed of a representative from each EU member state.  The General Data Protection Regulation (GDPR) will replace the Working Party with the […]

Read More…

Cartoon on GDPR Vendor Management

Cartoon GDPR Vendor Management TeachPrivacy GDPR Training

  This cartoon depicts the challenges of complying with GDPR’s requirements for vendor management.   Under the GDPR, there are serious responsibilities when using a vendor to process personal data.  Broadly, there are three things that data controllers must do: 1. Data controllers must perform due diligence in selecting vendors and that are complaint with GDPR. […]

Read More…

The Hidden Force That Will Drive GDPR Privacy Compliance

GDPR Compliance

  The clock is ticking on getting ready to comply with the EU General Data Protection Regulation (GDPR). EU regulators will start enforcing it on May 25, 2018. GDPR is less than a year away, and it’s quite a challenge to get ready for. Becoming compliant is not something that can be achieved overnight, or in a […]

Read More…

Preparing for GDPR: A Year to Batten Down the Hatches

GDPR Cartoon by Daniel J Solove

The General Data Protection Regulation (GDPR) will go into effect on May 25, 2018.  The GDPR strengthens privacy protections in the EU and includes a number of additional rights and responsibilities. […]

Read More…

The U.S. Congress Is Not the Leader in Privacy or Data Security Law

Capitol Sinking 01

A common myth is that the U.S. Congress is a leader in creating privacy and data security law.  But this has not been true for quite some time.  Congress isn’t leading, and even the policies and practices of US companies are increasingly built around the law of the European Union (EU) or the states. In […]

Read More…

Congress’s Attempt to Repeal the FCC Internet Privacy Rules: The Void Will Be Filled

FCC Privacy Rules Repealed

Recently, Congress voted to overturn new FCC rules that regulated the privacy of broadband Internet Service Providers (ISPs).  The rules implemented the Communications Act, 47 U.S.C. § 222 to ISPs, requiring opt in for sharing sensitive customer data, opt out for sharing non-sensitive customer data, as well as transparency requirements.  Sensitive data includes precise geo-location, children’s […]

Read More…