Data & Privacy Matters: Legal Updates - November 2024

They discuss developments in Europe as the new Commission is approved and the EDPB publishes a report on the EU-US Data Privacy Framework which highlights recent developments and areas for improvement. We also hear about Kenya and the EU's discussions about data transfer adequacy.

They then turn to the ICO, where there has been a huge amount of action – from a new report on genomics, a code of conduct for Private Investigators, guidance for pension providers regarding supporting customer decision making, a Privacy Enhancing Technologies cost benefit tool, guidance on data sharing to prevent scams and fraud and last, but not least, recommendations for AI tools used in recruitment.

The episode then stays with AI to discuss the recently published first draft of the General-Purpose AI Code of Practice under the EU AI Act, before covering UK and EU legislative updates and then rounding up with some key enforcement action from the past month.

Sources of the news discussed:

New European Commission:

• What the new European Commission could mean for digital regulation | IAPP

EDPB

• Report on EU-US Data Privacy Framework: EDPB Report on the first review of the European Commission Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework | European Data Protection Board
• Kenyan data adequacy: EU Commission and Kenya close to agreeing a mutual adequacy agreement

ICO news:

• Genomic report: “Privacy must still come first.” – we're calling for collaboration with developers as report reveals future innovations and data protection concerns in genomics | ICO
• Data protection code for UK Private Investigators: The Association of British Investigators Limited UK GDPR Code of Conduct for Investigative & Litigation Support Services | ICO
• Pensions statement: Joint statement from the FCA, ICO and TPR for retail investment firms and pension providers | ICO
• Privacy Enhancing Technology tool: Using Privacy Enhancing Technologies (PETs) to unlock value from data responsibly | ICO
• Tackling scams and fraud: Data protection is not an excuse when tackling scams and fraud | ICO
• AI Recruitment Tool providers: ICO intervention into AI recruitment tools leads to better data protection for job seekers | ICO

AI:

• General-Purpose AI Code of Practice: First Draft of the General-Purpose AI Code of Practice published, written by independent experts | Shaping Europe’s digital future

General news:

• Data (Use and Access) Bill: Data (Use and Access) Bill [HL] - Parliamentary Bills - UK Parliament
• Trump presidency: A view from DC: What does a second Trump presidency mean for privacy, AI governance? | IAPP / What the US election results may mean for digital policy | IAPP
• New UK online safety law: Crackdown on intimate image abuse as government strengthens online safety laws - GOV.UK
• EU Cyber Resilience Act: Regulation - 2024/2847 - EN - EUR-Lex

Case law:

• Savva v Leather Inside Out: Savva v Leather Inside Out & Ors [2024] EWHC 2867 (KB) (18 November 2024)

Enforcement including fines:

• ICO seeks permission to appeal Curry's case: Information Commissioner seeks permission to appeal DSG Retail Ltd ruling | ICO
• University of Agder fine: Norwegian SA issues administrative fine to the University of Agder | European Data Protection Board
• Eidskog Muncipality fine: Norwegian SA issues administrative fine to Eidskog Municipality | European Data Protection Board
• Remote clairvoyance service provider fines: - The French SA fines COSMOSPACE EUR 250,000 and TELEMAQUE EUR 150,000 | European Data Protection Board