Data Protection and Security in M&A

After almost two years of the GDPR, the fines from the regulators are starting to pile up. Buying or merging with a company that lacks proper cybersecurity, or one that is not in compliance with the GDPR, becomes a considerable risk. For instance, Marriott was fined £99 million by the Information Commissioner's Office (ICO), which is the UK regulator, after hackers stole the guest records of the Starwood Hotels & Resorts Worldwide that it had acquired. A study by Merrill Corporation has shown that over half (55%) of practitioners surveyed across EMEA said they had worked on M&A transactions that had not progressed because of concerns around a target company's data protection and compliance with GDPR. Therefore, non - compliance with GDPR can become a serious issue for the seller.

Read more
Data protection for connected devices

In a recent article in Data Protection for Practitioners, Yves Gogniat looks at IoT, wearables, smart devices and other connected devices. Under the title "Can I collect personal data through connected devices without consent?", he explores the questions to what extent the consent of the data subject is necessary for the use of connected devices and how to deal with connected devices that do not have their own interface.

The article is available here.

Read more
Update on the total revision of the Data Protection Act

The National Council's State Policy Committee (SPK-NR) has concluded its deliberations on the bill for the total revision of the Data Protection Act(17.059). However, the bill was only narrowly adopted, by the casting vote of the president, after nine votes to nine with seven abstentions. It shows that there is still no agreement among the various interest groups and that the revision of the law will therefore take longer than originally planned. In addition, the Commission decided that the new law should only come into force after a transitional period of two years. This would mean that we will probably not have a new data protection law until around 2022/2023.

Read more
The ECJ has ruled on the legality of Facebook's "Like" button

Fashion ID operates the website of the Düsseldorf fashion house Peek & Cloppenburg and had integrated Facebook's "Like" button on the website. The Consumer Advice Centre NRW considered this to be a breach of data protection, as the integration automatically resulted in the transfer of data to Facebook. In the opinion of the consumer advice centre, the necessary consent for the transfer of data to Facebook was therefore lacking. The case is still being decided under the old data protection law, but since the term "controller" is very similar in both laws, the ruling will also be relevant under the GDPR.

The ECJ has ruled that Facebook's "Like" button was not implemented in a data protection-compliant manner and that the website operator bears joint responsibility for such plugins.

Read more
GDPR fine for a Dutch hospital due to insufficient TOMs

A Dutch hospital was fined because several unauthorised hospital employees accessed the electronic patient file of a prominent person (brief information in English as well as original report in Dutch).

Such incidents are unfortunately not isolated cases. In Switzerland, for example, the attempted sale of Michael Schumacher's patient file caused a stir, and in Germany, the Tugce case revealed that despite internal guidelines, an above-average number of hospital staff read Ms Tugce's patient file.

Read more
First decisions on influencer advertising in Switzerland

Influencer marketing has recently gained popularity. In contrast to other countries - such as Germany - there have not yet been any decisions on influencer advertising in Switzerland. The question of when a post is considered surreptitious advertising and thus violates competition law has not yet been clarified in Switzerland.

The Foundation for Consumer Protection had now filed complaints with the Fairness Commission against several (prominent) influencers in order to create legal clarity in Switzerland as well.

Read more