holds by embedding social media plug-ins in website you may become a joint data controller with the social media provider

Posted on by Federica Romanelli
  On July 29, 2019, the Court of Justice of the European Union (ECJ) published its judgement in case C-40/17, holding – like Advocate General Bobek (see here) suggested – that an organization who embeds a Facebook “Like” button on its website may be considered a data controller. In this case, a German fashion online retailer embedded a Facebook’s ‘Like’ button in its website. As a result, when users landed on the retailer’s website, information about those users’ Read more [...]

CNIL adopts new guidance on cookies

Posted on by Federica Romanelli
On July 4, 2019, the Commission Nationale de l’informatique et des Libertés (CNIL), the French Data Protection Authority (DPA) adopted new guidelines on cookies and other tracking devices (“Guidelines”). According to the press release, the scrolling down or swiping through a website or application is no longer viewed as a valid expression of consent to the implementation of cookies; tracking services will have to prove that they have obtained consent. The CNIL adopted the Read more [...]

Update: oral hearing before the ECJ on Model Clauses preliminary ruling

Posted on by Federica Romanelli
On July 9, 2019, the European Court of Justice (CJEU) heard oral arguments on a landmark case concerning Facebook's transfer of personal data from the EU to the US on the basis of the currently utilized “standard contractual clauses” (SCCs) mechanism. The CJEU's decision -- will have tangible consequences for businesses performing data transfers from the EU to the US -- is expected in December 2019. Background By way of background. In 2013 Mr. Schrems demanded the suspension of data flow Read more [...]

Important question about the GDPR one –stop shop mechanism referred to the ECJ

Posted on by Federica Romanelli
On May 8, 2019, the Brussel’s Court of Appeal referred certain questions to the Court of Justice of the European Union (CJEU) to ensure that the Belgian Data Protection Authority (DPA) can pursue the case against Facebook also after the GDPR entered into force. In particular, the questions is whether the one-stop shop mechanism (which allows for a new cooperation mechanism between EU DPAs) also allows a DPA to initiate a proceeding before an EU court if it is not the lead supervisory authority.[1]  Read Read more [...]

EU Parliament adopts regulation on platform-to-business trading practices

Posted on by Federica Romanelli
On April 17, 2019, the EU Parliament adopted the proposed EU Regulation on platform-to-business trading practices. The text adopted by the European Parliament still has to be formally approved by the Council of the European Union. Once approved, the Regulation will enter into force 12 months after its publication in the Official Journal. According to the online platforms factsheet, 1 million businesses are selling goods and services via online platforms. The Regulation aims at resolving Read more [...]