Alston & Bird Privacy, Cyber & Data Strategy Blog

GDPR

Alston & Bird Issues Data Protection Paper on Accurate Retrieval of Personal Data under the GDPR

By

Today Alston & Bird’s Peter Swire and DeBrae Kennedy-Mayo, with support from Senzing, Inc., are publishing a White Paper titled The Importance of Accurate Retrieval of Data Subjects’ Personal Data in Complying with GDPR Individual Rights Requirements. The General Data Protection Regulation, which enters into effect on May 25, 2018, goes considerably beyond existing law in […]

Belgian Privacy Commission Issues DPIA “Black” and “White List” Recommendation

By

On February 28, 2018, the Belgian Privacy Commission issued a recommendation on the position it takes with regard to data protection impact assessments (or “DPIAs”) as foreseen in the GDPR. A DPIA under the GDPR is similar in scope and impact to its predecessor, the PIA (or “privacy impact assessment”) and requires businesses to assess […]

Privacy Commissioner of Hong Kong Issues a GDPR Guidance Document

By

On April 3, the Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD) announced the publication of the “European Union General Data Protection Regulation (GDPR) 2016” guidance document.  The PCPD explains that the publication was issued to raise awareness among organizations and businesses in Hong Kong of the possible impact of the new […]

Council of the European Union publishes new draft ePrivacy Regulation

By

The Council of the European Union published a new draft of the ePrivacy Regulation (link here) for discussion purposes on 22 March. This draft aims to facilitate discussions as we are moving towards the final version of the ePrivacy Regulation. As such, the changes outlined below are not final, but rather indicative of the direction […]

German DPAs Publish Model GDPR Processing Records – Translations Provided

By

In just under 100 days, the EU General Data Protection Regulation (GDPR) enters into force. One of the major changes the GDPR introduces is a duty for in-scope controllers and processors to maintain written records of their processing activities.  Under Article 30 GDPR, companies will need to inventory all “processing activities under [their] responsibility” and […]