IAPP’s Post

𝗪𝗵𝗮𝘁 𝘀𝗲𝘁𝘀 𝗮𝗽𝗮𝗿𝘁? - 𝗗𝗮𝘁𝗮 𝗟𝗮𝘄 & 𝗣𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗗𝗮𝘁𝗮 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗗𝗲𝗰𝗿𝗲𝗲 With the new Data Law coming into effect on July 1, 2025, we’re entering a transformative era that redefines how we handle data, including personal data. One key aspect is the interplay between the Personal Data Protection Decree (PDPD or Decree 13) and this new Data Law. Both aim to enhance data protection and data management, but understanding their roles and how they complement each other will be crucial for compliance and best practices. To prepare for these changes, let's engage with Data Protectify in discussion about the implications for businesses and individuals alike. We hope you enjoy reading! #DataPrivacy #PDPD #DataLaw #DataProtection

“Data protection is a human rights matter”, “It is not true that consent is always required”, “Transborder data flow - this issue is complex”, “a new information management and technology strategy for the NHS”… Plus ça change plus c'est la même chose. For those who think data protection law sprang out of nowhere in 2018, the then Data Protection Registrar’s Annual Report of 1993 should be essential reading. The Information Commissioner's Office has just disclosed this, and the following year’s report, in response to an FOI request. Although they’re from what is effectively a pre-internet era, they show that many of the fundamental issues, and concerns, haven’t changed. And yes, I am about to make a request of my own for all the reports they hold that aren’t already available. https://lnkd.in/eV_b9eB6

The Personal Data Protection Commission (PDPC) published five decisions between January and March 2024 after concluding the following investigations:   (a)       One investigation relating to the Consent and Purpose Limitation Obligations under the Personal Data Protection Act 2012 (PDPA); (b)       Two investigations relating to the Protection Obligation under the PDPA; (c)       One investigation relating to the Consent and Notification Obligations under the PDPA; and (d)       One investigation relating to a breach of the Do-Not-Call (DNC) provisions under the PDPA.   In this update, our Head of Intellectual Property, Technology & Data Chung Nian Lam and Partner Kylie Peh outline some decisions of interest relating to the enforcement of the Consent, Notification, and Purpose Limitation Obligations, as well as the DNC provision, under the PDPA.   Click on the link below to read the full update.

The EU top data protection authority issues guidelines on when companies don't need your consent to process your data (so-called "legitimate interest"). In theory, data can only be processed without consent if it is necessary to pursue a legitimate interest (unless other rights or freedoms prevail over said interest). In practice, it will be easy for companies to prove that their business model / the technology they use require big data processing thus avoiding consent. Indeed, the European Data Proection Board lowers the bar in the necessity test: "if there are reasonable, JUST AS EFFECTIVE, but less intrusive alternatives for achieving the interests pursued, the processing MAY not be considered to be necessary" Consultation closes on 20th November. Make your voices heard: https://lnkd.in/eug3eEth

This title really stood out to me: The right of defence may override the right to data protection. Interestingly, you do not see many cases that focus directly on this – but it is in effect a case that looks at data subject’s rights vs the company’s rights to mount a legal defence and specifically whether the data subject’s consent is required. This has been a much debated topic over the years, but you do not often see it being argued in court. With this in mind, it is good to see an actual judgement on this topic.

💫 Recent Editorial - 16 April 2024 💫 👉New data law, a barrier to journalistic free speech Why in the News? The government is currently working on establishing regulations and guidelines to implement the Digital Personal Data Protection (DPDP) Act of 2023, the country's first comprehensive data protection law. The process is expected to be completed after the general election. Visit https://lnkd.in/giukcHi3 to read full article

Here's a great short summary of some key topics for those wondering how UK law in tech & data may change following the Labour victory at the polls.

Curious about how the new Data (Use and Access) Bill could impact your organisation? Join us on 12 November 2024 for a practical, breakdown of exactly what you need to know. We'll be diving into: - How different is the bill from the previous government’s Data Protection and Digital Information Bill? - What practical effect will it have on data protection compliance in the UK? - How do I prepare for the changes? - When is it likely to become law? - What effect will it have on the free flow of data from the EU to the UK? By the end, you’ll have a clear understanding of what’s coming and how to get ready. We'll also have time to answer your questions. Date: 12 November 2024 Register here: https://lnkd.in/e2wcZ5ev

Digital Personal Data Protection Act 2023 (#DPDPA 2023) lays down the legal bases for processing digital #personalinformation. #Consent is the bedrock for processing data, and the #legislation also provides a few exemptions to consent, allowing certain legitimate use cases of data. The list of exemptions predominantly squares down towards vital interests like #medicalemergencies, fulfilling legal obligations, performing public tasks, etc., with less room for legitimate interest under the grounds of fair and reasonable purpose. #dataprivacy #dpdp #datasecurity

For those wondering what the new government intends for data protection (surely that’s everyone?!) here’s a short summary