Two leading trends in data protection

This edition’s front page reflects two leading trends.

The combination of data protection, competition and consumer law

When last July Giovanni Buttarelli announced at PL&B’s conference that he was leaving to meet European Commissioner for Competition policy, Margrethe Vestager, it was little noticed. But in his statement last month to PL&B’s Roundtable with him and his senior staff at his office in Brussels on 9 March, it was clear that this trend is becoming increasingly significant (pp.1,4-6). The German federal competition authority, the Bundeskartellamt, has opened an antitrust investigation into Facebook’s activities over alleged unfair user terms. Buttarelli commented on this trend (p.4) “Consumer law and data protection law should not exist in silos,” France’s and Germany’s competition policy agencies are cooperating with the active involvement of the CNIL and Buttarelli attended a meeting on 8 March in Paris organised by the CNIL on this subject. Further evidence of the increasing synergy between these three types of law comes from Germany where consumer protection associations are now empowered to file privacy cases in court on behalf of individuals (p.15). A new law is expected to be adopted in France this year on similar lines.

From Safe Harbor to Privacy Shield

While the Safe Harbor is clearly no longer safe (pp.1-3) as a legal mechanism for transferring personal data from the European Economic Area to the US, its planned replacement, the EU-US Privacy Shield is not yet accepted as it is going through a multi-stage approval process (p.5). Even within the EU Art. 29 DP Working Party, which is discussing the new instrument next week, views are likely to differ. Usually, they reach their Opinions by consensus but this may be one of the occasions when a vote will be necessary. Alternatively, they may unite on a strong data protection rights platform knowing that the Art. 31 Committee, representing the EU Member States, is likely to be more pragmatic in wanting to provide in the Privacy Shield a legal method for international transfers which combines company assurances with the US FTC’s formidable enforcement sanctions (p.6).

Elizabeth Denham, UK Information Commissioner Designate

On 22 March, PL&B was probably the first to announce the appointment of Elizabeth Denham as UK Information Commissioner Designate. She is near the end of a distinguished six year term as Information and Privacy Commissioner for British Columbia, Canada and spoke at PL&B’s Annual International Conferences in 2014 and 2015.  This is the first time I can recall that a Commissioner has been appointed from a different country. Christopher Graham, outgoing Information Commissioner, whose term of office ends on 28th June, described her as an “inspired choice.” I agree.

In Privacy Laws & Business UK Report November 2015 pp.14-16, we reported on “Duty to document: FOI lessons from Canada”, my article on Elizabeth Denham’s decision in a complex Freedom of Information case with useful lessons for other jurisdictions. Contact for a copy of this article.

If you want PL&B Reports to cover specific subjects, or want to offer to write about your experience, or be interviewed, e-mail Editor, Laura Linkomies


Stewart Dresner, Publisher

International Report 140

Lead story:

German DPA takes action against Safe Harbor firms

Hamburg’s DPA is investigating and prepared to issue fines.  By Sascha Kuhn.

Contents also include:

  • EDPS nurtures consumer and DP/competition law cooperation
  • Comment: Safe Harbor no longer safe
  • Belgian DPA vs Facebook update
  • Data portability in the EU and the Philippines
  • UN privacy rapporteur sets high standards, but lacks resources
  • Limits of US Judicial Redress Act
  • Taiwan implements its DP law
  • Germany criminalises trading ‘stolen’ data via the Internet
  • Your money or your life? Modi’s enactment of India’s ID law
  • GDPR’s extra-territoriality means trouble for cloud computing
  • The changing landscape for data processors under GDPR
  • EU-US Privacy Shield: Conflicts
  • US FTC, Canada sign MoU
  • Online reputation: Call for essays
  • Merck’s and Capgemini’s BCRs
  • German consumer law creates new DP rights
  • CNIL fines Google over ‘Right to be Forgotten’
  • Morocco hosting DPA conference
  • EU-US Privacy Shield: Europeans’ complaints will take priority
  • European Data Protection Board
  • Survey: Cloud accountability
  • Next UK Information Commissioner