On 21 April 2021, the European Commission proposed a new, transformative legal framework to govern the use of artificial intelligence (AI) in the European Union. The proposal adopts a risk-based approach whereby the uses of artificial intelligence are categorised and restricted according to whether they pose an unacceptable, high, or low risk to human safety and fundamental rights. The policy is widely considered to be one of the first of its kind in the world which would, if passed, have profound and far-reaching consequences for organisations that develop or use technologies incorporating artificial intelligence.

Continue Reading The European Union Proposes New Legal Framework for Artificial Intelligence

On 13 April 2021, the European Data Protection Board (“EDPB“) adopted two opinions  (“Opinions“) concerning draft UK adequacy decisions published by the European Commission which would permit the free flow of personal data from the European Economic Area (“EEA“) to the UK in the post-Brexit world. The Opinions largely support the draft UK adequacy decisions and represent a positive step towards adoption of formal UK adequacy decisions. Nonetheless, organisations which transfer personal data from the EEA to the UK should continue to monitor the developments and keep planning for the possibility that the adequacy decisions, if adopted, could
Continue Reading European Data Protection Board Issues Opinions on European Commission’s Draft UK Adequacy Decisions

A decision issued on 15 March 2021 by the Bavarian Data Protection Authority (“BayLDA”, publication pending) is the first German enforcement action in connection with last year’s decision of the Court of Justice of the European Union (“CJEU”, “CJEU’s Decision”) on the validity of the European Commission’s Standard Contractual Clauses (“SCCs”) and the EU-US Privacy Shield (C-311/18, more information available in our client alert). In the CJEU Decision, the court held that a transfer of personal data from the EU to third countries outside the European Economic Area (“EEA”) under the EU Standard Contractual Clauses will be permissible
Continue Reading German Data Protection Authority Decides on Supplementary Measures for International Data Transfers