Spain remains an active enforcer of the GDPR

Spain has one of the strongest traditions amongst EU countries as an enforcer. The number of fines has always been high, but now after the GDPR we are seeing many more as our correspondents point out. Recently, the regulator fined Vodafone a whopping €8 million. In this case, an interesting factor was the use of a sub-processor in a third country outside the European Economic Area. Vodafone has been a repeat offender which no doubt was a contributing factor in setting the fine. It is hoped that the EU DPAs can soon agree a formula for setting fines within the European Data Protection Board. This would increase transparency and harmonisation. There are still differing views amongst EU DPAs on what is an appropriate level of fine. The One-Stop-Shop is in operation but may need some tweaks to work better.

The new Saudi Arabia data protection law is comprehensive and requires compliance by March 2023. All businesses operating in Saudi Arabia, or processing the data of Saudi residents abroad, will now need to start assessing their activities and make changes to align with the law, our correspondents advise.

After drafts, analysed here in recent years, China’s data protection law is now a reality. There is a huge impact globally as the law affects about 18% of the world’s population and trade between China and the rest of the world often involves personal data. Compliance is required by 1 November. There are also developments in Pakistan and Sri Lanka – both countries have data protection bills in the pipeline, Professor Greenleaf’s provides expert analysis.

A new opinion on the Swiss data protection law foresees risks for Swiss-EU data adequacy with a potential Swiss-US executive agreement covering the US Cloud Act.

There are legislative developments in the most heavily populated Canadian provinces, Quebec and Ontario. Quebec has recently adopted a strong data protection law, whereas the attempts for data protection reform at the federal level have not progressed.

Laura Linkomies
Editor, Privacy Laws & Business

October 2021