Header graphic for print

HL Chronicle of Data Protection

Privacy & Information Security News & Trends

Posted in International/EU Privacy

AG Says ePrivacy Applies to Government Access to Communications Data

On January 15, the Court of Justice of the European Union’s (CJEU) Advocate General (AG) Manuel Campos Sánchez-Bordona delivered his Opinion on four references for preliminary rulings on the topic of retention of and access to communications data.

Of the four references, two originated from France, one from Belgium, and one from the Investigatory Powers Tribunal (IPT) in the United Kingdom. The latter arose from a challenge by Privacy International to the UK Security and Intelligence Agencies’ (SIAs) powers under the Telecommunications Act 2014 and the Data Retention and Investigatory Powers Act 2014. SIAs have the power to compel providers of electronic communications services, such as internet service providers, to retain and hand over bulk communications data. Communications data does not include the content of communications but does reveal traffic and location data, as well as information on users’ social, business and financial activities, communications, and travel. Continue Reading

Posted in International/EU Privacy

Whistleblowing Schemes: New Guidelines Issued by the CNIL

The French Data Protection Authority (CNIL) published new Guidelines (French only) on December 10, 2019 applicable to whistleblowing schemes, following a public consultation process. The Guidelines replace the former Single Authorization AU-004, which has not applied since arrival of the General Data Protection Regulation (GDPR). The CNIL has also published a useful Frequently Asked Questions webpage regarding the Guidelines. Continue Reading

Posted in Consumer Privacy

Washington State to Try Again for a Comprehensive Privacy Law

Washington State is already shaping up as a center of state privacy legislation for 2020.

Last year, SB 5376 (also known as the Washington Privacy Act, or WPA) gained significant traction in the legislature, passing the state Senate almost unanimously but ultimately failing in the House due to discussions around facial recognition and compliance challenges. State Senator Reuven Carlyle (D), chair of the state’s Senate Energy, Climate & Technology Committee, has now released a revised draft of the WPA for 2020. If enacted as drafted, this new version of the WPA would come into effect on July 31, 2021. Continue Reading

Posted in News & Events

Webinar Invitation — New TRACED Act and Robocall Year in Review: What you need to know

Mark Brennan

Arpan Sura

Kathryn Marshall Ali







It was a very busy year on the robocall front and, on 30 December 2019, President Trump signed into law the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act (S. 151), which the House and Senate passed by wide, bipartisan margins earlier this year. Continue Reading

Posted in International/EU Privacy

Should I Be Worried About the GDPR? – EDPB’S Guidelines on the GDPR’S Territorial Scope

Does the GDPR really apply to my company? From a data protection standpoint, this is the first thing that comes to mind within non-EU companies. In many cases, the GDPR seems like an issue of the Old Continent, so some assume it should not affect non-EU companies. In others, companies apply the GDPR to all their processing activities just to avoid the possibility of being addressed by EU authorities. Neither approach is per se correct. Continue Reading

Posted in International/EU Privacy

Recent Developments on Cookies – a Pan-European Overview

The legal requirements for the use of cookies have been subject to discussion over the last few years, with little to no enforcement and guidance from European data protection authorities (DPAs). That has changed recently.

In the last few months, there have been interesting developments concerning the use of cookies. Upon investigating 175 websites, the Dutch DPA concluded that half of those websites did not comply with cookie requirements. The Bavarian DPA (Germany) initiated a similar investigation and the Spanish DPA (AEPD) has issued two fines for not complying with cookie requirements. In addition to these investigations and fines, various DPAs have published guidelines with very different interpretations. Cookie compliance seems to have become a high priority for DPAs.

We recently published Getting Cookie Consent Right, describing how various approaches to cookie consent fare against the European Court of Justices’ (CJEU) Planet49 decision. In this blog post, we further help navigate through the EU cookie landscape by focusing on how European DPAs are approaching cookie consent and transparency in light of the Planet49 decision. Continue Reading

Posted in Consumer Privacy

Now Available: CCPA Update (Webinar Materials)

Mark Brennan

Tim Tobin








With the California Consumer Privacy Act’s (CCPA) effective date fast approaching on January 1, 2020 and the California Attorney General’s CCPA rule-making still pending, covered businesses have important decisions to make in the very near future. In this webinar discussion from November 14, Hogan Lovells Privacy and Cybersecurity partners Mark Brennan and Tim Tobin discussed how the CCPA changes enacted over the past year and the proposed regulations may impact your compliance efforts.

The webinar can be viewed on demand here, and the slides can be downloaded here.

Posted in International/EU Privacy

Getting Cookie Consent Right

One could be forgiven for thinking that knowing how to comply with a legal obligation that has been in place for nearly a decade would be clear cut. However, widespread practice tells us that this is far from the truth. In November 2009, as part of wider reforms to the European telecommunications regulatory framework, the European Union introduced various amendments to the existing Directive 2002/58/EC (‘e-Privacy Directive’), including to the provisions regulating the use of cookies. Continue Reading

Posted in International/EU Privacy

Russia Update: Law Increasing Fines for Violation of Data Protection Laws Comes Into Force

Update: On 3 December 2019 the law imposing multi-million Ruble (RUB) fines for infringing Russian data localization and information security laws has come into force. We have retained below our earlier update about the law for informational purposes and to provide context. Since the law has already come into force, new fines may be imposed on companies based on results of the Russian DPA’s (Roskomnadzor) inspections in 2020. Roskomnadzor has already identified the entities it plans to inspect in 2020 but may initiate unplanned inspections as well based, for example, on data subject complaints or its online monitoring of company activity.

On 21 November 2019 a bill imposing multi-million Ruble (RUB) fines for infringing Russian data localization and information security laws passed the last hearing at the State Duma. This likely means that the bill will become the law soon, once it passes the higher chamber of Russia’s Parliament and is singed by the Russian President. The process may take about two weeks. Continue Reading

Posted in International/EU Privacy

Hogan Lovells Calls for an Alternative Approach to Regulating Privacy in the Digital Economy

Hogan Lovells has published a study evaluating the ongoing legislative proposal for a new ePrivacy Regulation, a law aimed at updating the current ePrivacy framework in the EU.

After nearly three years of debates and negotiations, the European Union is nowhere near agreeing on a position for how to achieve the right balance between the need for technological innovation, public security, and the protection of privacy in the context of the digital economy. According to Hogan Lovells, this is due to the structure and legislative approach of the proposed ePrivacy Regulation, which, rather than complementing the GDPR as originally intended, is in some fundamental respects in conflict with it. Continue Reading