Data Protection

AI and data governance

Brexit | Cloud computing | Court decision | Data protection | EU | Regulatory action | Services | Technology | UK | US

Data export: EU provides more clarity after Schrems II
ByRob Bratby 17 November 202017 November 2020

In documents published last week, the EU provided some welcome clarity on how organisations should address the invalidation of Privacy Shield as a basis for exporting personal data from the EU. On 10 November 2020, the European Data Protection Board (EDPB) adopted recommendations on ‘supplemental measures’, which can be considered to ensure compliance with the…

Read More Data export: EU provides more clarity after Schrems II
Cloud computing | Court decision | Data protection | EU | Regulatory action | Services | UK | US

EDPB guidance on ‘supplemental measures’ for data export
ByRob Bratby 17 November 202024 November 2020

On 10 November, the European Data Protection Board adopted a recommendation on supplemental measures which might be used to ensure compliance with the EU level of protection of personal data when exported to third countries with an insufficient level of protection. The recommendation both sets out a process to be followed by data exporters and,…

Read More EDPB guidance on ‘supplemental measures’ for data export
Cloud computing | Data protection | EU | Regulatory action | Services | Technology | UK

European Data Protection Board releases updated data controller / date processor guidance for comment
ByRob Bratby 28 September 202012 November 2025

Are you sure you are a data processor? Introduction On 7 September 2020, the European Data Protection Board (EDPB), successor to the ‘article 29 working party’, released updated guidance on the concepts of ‘data controller’ and ‘data processor’ under European Privacy law (i.e. General Data Protection Regulation or GDPR). Whilst this has already been subject…

Read More European Data Protection Board releases updated data controller / date processor guidance for comment
Cloud computing | Court decision | Data protection | EU | Regulatory action | UK | US

EU and US start work on enhanced Privacy Shield: Mr Schrems to be persuaded…
ByRob Bratby 11 August 202012 August 2020

On 10 August 2020, Following the European Court’s Schrems II judgment invalidating the US Privacy Shield (and calling into question the legal basis for other transatlantic data transfers), the EU Commission and US Department of commerce issued a short, joint statement: “The U.S. Department of Commerce and the European Commission have initiated discussions to evaluate…

Read More EU and US start work on enhanced Privacy Shield: Mr Schrems to be persuaded…
Cloud computing | Court decision | Data protection | EU | Regulatory action | US

Exporting data from the EU after Schrems II: what to do now
ByRob Bratby 31 July 2020

As previously discussed, the European Court of Justice’s recent Schrems II decision both (i) invalidated the US privacy shield; and (ii) threw into question alternative justifications for the export of personal data from the EU to the US. Whilst there is yet to be a substantive response from the European Commission, initial reactions from the…

Read More Exporting data from the EU after Schrems II: what to do now
Cloud computing | Court decision | Data protection | EU | US

European Court invalidates US Privacy Shield and questions blanket use of Standard Contractual Clauses
ByRob Bratby 17 July 202021 July 2020

Schrems II disrupts data export from EU: on 16 July 2020, the European Court of Justice decided, overturning the 2016 Privacy Shield Decision of the European Commission, that the US Privacy Shield did not, and does not, provide an adequate level of protection for the transfer of personal data from the EU to the US.

Read More European Court invalidates US Privacy Shield and questions blanket use of Standard Contractual Clauses
ASEAN | Brexit | China | Cloud computing | Commercial activity | Corporate governance | Court decision | Data protection | EU | Foreign direct investment | Government policy | M&A | Media | Outsourcing | Payment | Regulatory action | Technology | Telecoms | UK | US

Goodbye from Watching the Connectives
ByRob Bratby 30 March 201716 April 2020

To all my readers, thank you and goodbye. This blog is now an ex-blog.

Read More Goodbye from Watching the Connectives
Cloud computing | Data protection | Government policy | Outsourcing | Regulatory action

UK’s Financial Conduct Authority issues guidance on cloud
ByRob Bratby 26 July 2016

On 7 July 2016, the UK’s Financial Conduct Authority (FCA) issued finalised guidance for authorised UK financial institutions use of cloud services. In a marked contrast to some other jurisdictions’ approach, this guidance is issued against a policy backdrop of FCA’s ‘Project Innovate’ which is a initiative to foster innovation and competition. The FCA say:

Read More UK’s Financial Conduct Authority issues guidance on cloud
Brexit | Cloud computing | Data protection | EU | Government policy | Regulatory action | Services | UK

European Network and Information Security Directive adopted to address cyber-threats
ByRob Bratby 25 July 2016

On 6 July 2016, the European Union (which for now includes the UK) adopted the Network and Information Security (or NIS) Directive. This imposes obligations on three sets of stakeholders:

Read More European Network and Information Security Directive adopted to address cyber-threats
Broadband | Data protection | Fixed | Government policy | Mobile | Regulatory action | Telecoms | UK | WiMax

UK Government publishes Digital Economy Bill draft
ByRob Bratby 5 July 2016

The UK Government today published its first draft of the Digital Economy Bill. As expected, it contains provisions addressing (text taken from Government explanatory fact sheet):

Read More UK Government publishes Digital Economy Bill draft