//by Jonas Puchelt and Sandra Brechtel The Regional Court Bonn reduced fines of EUR 9.55 million imposed by the German SA on the telecommunications company 1&1 to “only” EUR 900,000.00. Is the reduction of the fines by more than 90%…
ECJ: no unlimited access to communication data for security and intelligence agencies
The ECJ held that the access for security and intelligence agencies to communication data shall be restricted according to the principle of proportionality. That derives from the fact that an unlimited access to communication data by security and intelligence agencies…
Schrems II: approval of BCR invalid?
The ECJ requires in “Schrems II“ a level of data protection which is “essentially equivalent“ to the level within the EU, when data is being transferred outside the EU. This new requirement is equally applied to BCR1. Since the ECJ…
The long road
By Prof Ulrich Kelber, German Federal Commissioner for Data Protection and Freedom of Information (BfDI)// Recently the General Data Protection Regulation (GDPR) celebrated its second birthday. Nobody expected a wild party even before the Corona pandemic. Instead there were appropriate…
Schrems II: ECJ sets GDPR as a global standard for IT-business
In a landmark decision the ECJ declared the Privacy Shield as invalid. The data transfer from the EU to the US can no longer be based on this Agreement between the EU Commission and the US Government. The court held…
Data: The key role in fighting against the Coronavirus pandemic (Opportunities and risks of the contact tracing Apps)
By Jutta Sonja Oberlin// Recently, developers from all over the world including Google and Apple1 have been working on pseudonymous contact tracing apps. These so-called Corona Apps could play a vital role in the fight against the virus, but they…
Video surveillance: The supervisory authorities’ view and recent case law
By Dr Alexander Golland and Dr. Jan-Peter Ohrtmann// With the growing popularity of smartphones, dashcams and video surveillance for access control, cameras are increasingly becoming a part of daily life. In particular, video surveillance conducted by private companies – to…
GDPR – not fit for corona?
Who of us has expected the coronavirus? In Europe, public life has been reduced to zero, we #stay-at-home, companies are going bankrupt, people are loosing their jobs, hospitals are overloaded and people are dying at the end of the day.…
Junk mail from a dating portal (decision of Austrian DPA)
by Andreas Rohner, Gerald Trieb// The Austrian Data Protection Authority (DPA)1 ruled that the absence of a ”double opt-in” procedure can, in some cases, constitutes a breach of Article 32 GDPR.2 Double opt-in In a ”double opt-in” procedure, a user gives his…
Internal Audit, DPO and the adjustment of Three-Lines-of-Defense-Modell
Internal audit usually follows the Three-Lines-of-Defense-Modell (T-LoD).1 Within this modell the 1LoD is the business line – like sales and marketing. The 2LoD is checking whether the 1LoD adheres to internal policies, external law and adequatly manages the risk. Risk…