Judit Garrido-Fontova and Alex Dittel give an update on recent developments in privacy law as part of Kemp Little’s DPO service, including:

1. Update on UK adequacy for international data transfers: UK Government’s Explanatory framework for adequacy discussions (Link). Elgizouli v Secretary of the State for the Home Department [2020] UKSC 10 (Link). The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. (Link).
2. Controller Processor model clauses for commissioned data processing within EEA from Baden-Wurttemberg in Germany. Link.
3. Atkinson v Equifax “’loss of control” representative action withdrawn. Link.
4. WM Morrison Supermarkets plc has won its Supreme Court appeal on its vicarious liability for a data breach. Link.
5. Surveillance Camera Commissioner (SCC) and the Information Commissioner’s Office (ICO) issued a Data Protection Impact Assessments template for surveillance camera systems. Link.
6. Coronavirus update. Commission recommendation on a common toolbox for the use of technology and data to combat and exit from the COVID-19 crisis. Link. Dutch regulator’s Privacy & Corona Blog. Link. Tech Crunch reports on the Apple and Google tracing tool. Link.
7. Agencia Española de Protección de Datos (AEPD) has published a report on data processing activities in relation to the COVID-19 pandemic. Link.
8. Information Commissioner’s Office (ICO) and the Office of the Australian Information Commissioner (OAIC) sign a memorandum of understanding on future cooperation. Link.
9. Compensation for breach of confidentiality and data protection in Reid v Price [2020] EWHC 594 (QB). Link.
10. Dawson-Damer v Taylor Wessing LLP [2020] EWCA Civ 352. Link.
11. ICO, Blog: Don’t get caught out when it comes to pupil photos. Link.
12. The hotel chain Marriott International announced another data breach on 31 March 2020. Link.
13. The Financial Conduct Authority announced a data breach on 25 February 2020. Link.
14. First ever EDPS reprimand issued to an EU institution: The European Data Protection Supervisor (EDPS) closes its investigation into European Parliament’s 2019 election activities. Link.
15. Issues with video conferencing software resulted in CCPA class action. Link.
16. Agencia Española de Protección de Datos (AEPD) has issued some recommendations to protect personal data in teleworking situations. Link.
17. A damming report by the Irish Data Protection Commission about the state of cookies compliance. Link.
18. First ever conviction under the Freedom of Information Act for deleting the council’s audio recording. Link
19. The Belgian Gegevensbeschermingsautoriteit (GVA) updated its guidance on cookies. Link.
20. First ever binding corporate rules (BCRs) approved under the GDPR by the Agencia Española de Protección de Datos (AEPD). Link.
21. Amsterdam’s use of number plate parking system held to be compatible with the European Convention on Human Rights (ECHR). Link.