Photo of Ana Bruder

Ana Hadnes Bruder is an associate in the Litigation & Dispute Resolution and Intellectual Property practices of the Frankfurt office.

Ana is a registered lawyer in Germany, Brazil and Portugal and has nearly 10 years of international experience as legal counsel. Before joining Mayer Brown, Ana gained experience representing foreign clients in judicial proceedings in Brazil and also worked as in-house counsel for a leading French company in the tourism sector in Paris, where she worked with litigation, intellectual property, internal compliance and expansion projects in Europe and Brazil. Other than German and her mother language Portuguese, she speaks English, French, Italian and Spanish.

Ana represents clients in litigation and arbitration procedures involving commercial, intellectual property, liability and antitrust matters. In the field of intellectual property, Ana provides guidance in the field of data protection and advises clients regarding trademark and patent infringement proceedings, acquisition and licensing of IP rights, research and development and cooperation agreements, including any antitrust aspects involved.

On 21 April 2021, the European Commission proposed a new, transformative legal framework to govern the use of artificial intelligence (AI) in the European Union. The proposal adopts a risk-based approach whereby the uses of artificial intelligence are categorised and restricted according to whether they pose an unacceptable, high, or low risk to human safety and fundamental rights. The policy is widely considered to be one of the first of its kind in the world which would, if passed, have profound and far-reaching consequences for organisations that develop or use technologies incorporating artificial intelligence.

Continue Reading The European Union Proposes New Legal Framework for Artificial Intelligence

On 13 April 2021, the European Data Protection Board (“EDPB“) adopted two opinions  (“Opinions“) concerning draft UK adequacy decisions published by the European Commission which would permit the free flow of personal data from the European Economic Area (“EEA“) to the UK in the post-Brexit world. The Opinions largely support the draft UK adequacy decisions and represent a positive step towards adoption of formal UK adequacy decisions. Nonetheless, organisations which transfer personal data from the EEA to the UK should continue to monitor the developments and keep planning for the possibility that the adequacy decisions, if adopted, could
Continue Reading European Data Protection Board Issues Opinions on European Commission’s Draft UK Adequacy Decisions

A decision issued on 15 March 2021 by the Bavarian Data Protection Authority (“BayLDA”, publication pending) is the first German enforcement action in connection with last year’s decision of the Court of Justice of the European Union (“CJEU”, “CJEU’s Decision”) on the validity of the European Commission’s Standard Contractual Clauses (“SCCs”) and the EU-US Privacy Shield (C-311/18, more information available in our client alert). In the CJEU Decision, the court held that a transfer of personal data from the EU to third countries outside the European Economic Area (“EEA”) under the EU Standard Contractual Clauses will be permissible
Continue Reading German Data Protection Authority Decides on Supplementary Measures for International Data Transfers

The Spanish Data Protection Authority (“Agencia Espanola Proteccion Datos – AEPD”) has recently issued its highest fine to date, totaling €8.15 million for several breaches of GDPR and national legislation by a multinational telecommunication company and its service providers. Notably, €2 million of this fine was attributable to its service provider conducting an international transfer of personal data to a country that did not comply with the European data protection requirements.
Continue Reading Spanish Data Protection Authority Issues Highest GDPR Fine to Date

Since enacted in August 2018, the entry into force of the Brazilian Data Protection Law (No. 13,709 – “LGPD”) has been subject to several changes. First it was supposed to be effective as of February 2020; then August 2020; and more recently 3 May 2021 (Provisional Measure No. 959/2020 dated 29 April 2020). The future of the LGPD remains uncertain, since this Provisional Measure needs to be rejected, approved or changed by the National Congress, or else it will expire on 27 August 2020.
Continue Reading Sanction Provisions in Brazil’s Data Protection Law Will Take Effect on 1 August 2021

There is a lot of uncertainty as to when the Brazilian Data Protection Law (No. 13,709 – “LGPD”) will come into force. Such uncertainly has been significantly increased due to the current scenario of Covid-19. However, data protection compliance projects should not be postponed or implemented superficially, especially considering (i) their direct impact in a company’s reputation towards its employees, suppliers, partners and customers and (ii) their relevance in business relations outside of Brazil, since several countries
Continue Reading The Impact of Covid-19 on Data Protection in Brazil

Foi publicada hoje a Medida Provisória 869/2018, emitida ontem pelo Presidente Michel Temer. A Medida Provisória cria a Autoridade Nacional de Proteção de Dados e aumenta o prazo de vacatio legis para a entrada em vigor da Lei Geral de Proteção de Dados (“LGPD”) de 18 para 24 meses após a sua publicação, ocorrida em 15 de agosto de 2018 (alteração do artigo 65 da LGPD pela Medida Provisória 869/2018).
Continue Reading Presentes de Natal tardios: uma Autoridade Nacional de Proteção de Dados e mais tempo para se adequar à LGPD

Breaking news: the Brazilian President Michel Temer issued yesterday and had published today the so-called “Provisory Measure” No. 869/2018 (Medida Provisória, a norm issued by the President alone, usually reserved for urgent and relevant matters) to amend the New Brazilian Data Privacy Law (Lei Geral de Proteção de Dados, “LGPD”). With this measure, the President created a National Data Protection Authority and determined that the LGPD shall
Continue Reading Late Christmas Gifts from Brazil’s President: A National Data Protection Authority and 6 Additional Months to Get Compliant with Brazil’s Privacy Law

The year 2018 is coming to a close. Among other things, it has brought us a new FIFA world champion, royal weddings and some other joyful things like the EU General Data Protection Regulation (GDPR). The latter could arguably cool one’s Holiday spirit—at least in some cases. For example, reportedly, the annual wish list campaign of the City of Roth, Germany, was intitally cancelled due
Continue Reading Corporate Holiday Cards: The GDPR Nightmare Before Christmas?

On 21 November 2018, the data protection authority of Baden-Württemberg, Germany (the “authority”) imposed a fine of EUR 20,000 against a German social media provider (the “company”) for failing to encrypt user passwords. The authority’s decision marks the first time that a fine was imposed on a company for violating the European General Data Protection Regulation
Continue Reading Data Protection Authority Imposes First GDPR Non-Compliance Fine in Germany