Debevoise Data Blog

JULY 20, 2021

Here are our highlights: European Commission adopts new Standard Contractual Clauses What happened : As reported in our blog post , the European Commission adopted its new Standard Contractual Clauses (“SCCs”) for the cross-border transfer of personal data from the EEA to “third countries”.

Data protection 52

Data protection e-filing Compliance e-records 52

Centerbase

MARCH 31, 2025

Managing a law firm requires more than overseeing cases and delegating tasksit demands a strategic approach that balances client expectations, regulatory compliance, and operational efficiency. This includes financial management, client communication, human resources, compliance, marketing, and technology integration.

Law firm 52

Law firm Time-tracking Law Law 52

Debevoise Data Blog

JUNE 8, 2023

Third country data transfers : Businesses that transfer personal data outside of the EEA may want to review their transfer mechanisms in light of new guidance on the EU and South East Asia SCCs, and the DPC’s record-breaking €1.2 billion fine against Meta. These developments, and more, covered below. (1)

Data protection 52

Data protection Compliance e-records Dispute resolution 52

Debevoise Data Blog

NOVEMBER 21, 2023

Data protection & AI: In particular: (i) the French CNIL published its first set of guidance on GDPR compliance when developing AI tools; and (ii) the UK ICO issued a preliminary enforcement notice against Snap over its AI chatbot, alleging that Snap had not adequately assessed the privacy risks posed to child users of the tool.

Data protection 52

Data protection Compliance Failure-to-appear e-records 52

Debevoise Data Blog

FEBRUARY 27, 2024

GDPR one-stop-shop: Businesses wishing to take advantage of the GDPR one-stop-shop system should take note of a new digest, published by the European Data Protection Board, which analyses the decisions made by so-called Lead Supervisory Authorities in this context.

Data protection 52

Data protection Compliance e-records Court 52

Debevoise Data Blog

NOVEMBER 10, 2020

ICO targets the data broking industry : On 27 October, the ICO demanded that Experian make sweeping changes to data protection practices within its direct marketing business within three months or face further enforcement action. We will continue to report on developments as Experian’s appeal progresses.

Data protection 52

Data protection Intellectual Property e-records Machine learning 52

Debevoise Data Blog

APRIL 26, 2024

Key takeaways from March include: CNIL data security practice guide: The French DPA published an update of its data security practice guide for data protection officers, chief information security officers, computer scientists and legal experts. These developments, and more, are covered below.

Data protection 52

Data protection e-records Compliance Court 52

Debevoise Data Blog

FEBRUARY 20, 2023

When calculating the fine, the CNIL cited the large scale of the data processing and the high proportion of minors (38% were between 13 and 17) as aggravating factors. The fines follow non-compliance notices CNIL served to 60 organisations that did not allow users to refuse cookies as easily as to accept them.

Data protection 52

Data protection Compliance e-records Court 52

Legal IT Group

JUNE 15, 2023

According to the GDPR – General Data Protection Regulation – residents of the European Union (“ EU ”) can send requests regarding their data to all legal and natural persons who process it. If the individual continues to receive emails after the data has been deleted, this will constitute a breach of the GDPR.

e-records 130

e-records Data protection e-filing Compliance 130

Debevoise Data Blog

AUGUST 16, 2023

. : Business may want to revisit their cross-border data transfer arrangements following the new adequacy decision for the EU-U.S. Data Privacy Framework, assess whether they are eligible to self-certify and, if they are, whether it makes sense to. Data Privacy Framework (the “DPF”). Data Privacy Framework (the “DPF”).

Data protection 40

Data protection Analytics Compliance Time-tracking 40

Debevoise Data Blog

JANUARY 25, 2024

Sensitive personal data: The CJEU has clarified that the processing of special category personal data, such as health data, requires a legal basis under both GDPR Art. 6, meaning that businesses may wish to review their records of processing activities to ensure that both are reflected. 9 and GDPR Art.

Data protection 40

Data protection Court e-records Compliance 40

Percipient

APRIL 22, 2023

Or it received a data request from a consumer under the GDPR or California Consumer Privacy Act. If the subpoena issued is in federal litigation, your company is likely responsible for the cost of compliance, especially if it has a connection to the litigation. Who covers the expense in responding to it? Westport Axle Corp.,

e-discovery 97

e-discovery Court e-records Litigator 97

Debevoise Data Blog

APRIL 14, 2023

The PRA strongly criticised Wyelands’ lack of record-keeping policies and procedures to manage the use of WhatsApp communications, which the PRA found had prevented the bank’s Board and Risk function from effectively scrutinising transactions, as well as hindering the PRA’s supervision and investigation activities.

e-records 52

e-records Compliance e-filing Data protection 52

Debevoise Data Blog

NOVEMBER 29, 2023

The specific detail of these requirements is yet to be agreed but could include heightened data governance standards, monitoring and record-keeping rules, heightened standards for cybersecurity and transparency, as well as human oversight obligations. To subscribe to the Data Blog, please click here. Limited risk systems.

Compliance 52

Compliance Data protection e-records Law 52

Debevoise Data Blog

OCTOBER 10, 2023

If privacy is dealt with as an afterthought, it may be difficult to retrofit controls that are sufficient to mitigate privacy-related risk and ensure compliance. Consider whether any personal data you intend to use for Generative AI training, testing or prompting is subject to GDPR (or equivalent protections). What can you do?

Data protection 52

Data protection e-records Compliance Law 52

MatterSuite

OCTOBER 27, 2023

E-discovery solutions , a significant part of legal tech, were estimated to be a multi-billion-dollar industry. The global e-discovery market size was projected to reach $17.32 Data Security: Ensuring the confidentiality and security of sensitive legal information is paramount. This enhances trust in legal documentation.

Legal tech 52

Legal tech Legal tech e-discovery Machine learning 52

Legal Tech Blog

DECEMBER 8, 2022

While these are necessary to help reduce complacency towards internal data protection compliance and ensure organisations actively work to reduce their exposure, it isn’t always easy for companies to align. In the case of e-discovery , for example, artificial intelligence is already being leveraged to great effect.

e-discovery 52

e-discovery Machine learning Compliance Due diligence 52

Debevoise Data Blog

OCTOBER 11, 2021

The PIPL has been referred to as China’s version of Europe’s General Data Protection Regulation (“GDPR”), given that the PIPL in substance mimics many of GDPR’s restrictions on the usage and collection of personal information. The sheer amount of serial change to Chinese law adds to compliance challenges.

Law 52

Law Law e-records Compliance 52

Ikigai Law

AUGUST 7, 2023

Reporting entities must follow several compliance and reporting obligations under the anti-money laundering law. Main Course : Deep dive stories on card network portability, and impact of the data protection bill on fintechs. The data law is nearly here! The data law doesn’t tell processors what to do.

Data protection 52

Data protection Law Law e-records 52

Clio

OCTOBER 8, 2024

With a record 2,500 in-person and 1,500 virtual attendees, Jack highlighted Clio’s growth alongside AI’s transformative role in the legal profession, as outlined in the latest Legal Trends Report. Gavin shared tactical steps to protect sensitive information and emphasized the ethical considerations involved in data protection.

Time-tracking 59

Time-tracking Judge Law firm Data protection 59

Debevoise Data Blog

JULY 31, 2023

Data Privacy Framework (the “DPF”). The decision enables businesses in Europe to transfer personal data to DPF-certified U.S. businesses without having to implement additional data protection safeguards. Once certified, compliance with the Principles can be enforced under U.S. billion fine for Meta in May 2023).

Data protection 52

Data protection Dispute resolution e-filing e-records 52

Berkley Technology Law Journal

NOVEMBER 18, 2022

Legislation empowers the European Commission to designate certain tech companies as gatekeepers and impose obligations on them in relation to data, advertising, e-commerce, interoperability, and the commercial relationships between the service providers customers and end users. One idea is the idea of data portability.

Law 100

Law Law Data protection Court 100

Berkley Technology Law Journal

NOVEMBER 18, 2022

Legislation empowers the European Commission to designate certain tech companies as gatekeepers and impose obligations on them in relation to data, advertising, e-commerce, interoperability, and the commercial relationships between the service providers customers and end users. One idea is the idea of data portability.

Law 100

Law Law Data protection Court 100

Debevoise Data Blog

JANUARY 14, 2022

Companies developing Federal Trade Commission (“FTC”) compliance programs, or under investigation by the FTC’s Bureau of Consumer Protection, should be aware of significant developments impacting the Commission’s regulatory authority and enforcement priorities.

Compliance 52

Compliance Court Litigator Litigation 52

Debevoise Data Blog

JANUARY 16, 2025

Department of Justice (DOJ) issued the Final Rule on Preventing Access to Sensitive Data, creating a comprehensive export control regime to restrict the transfer of bulk sensitive personal and government-related data to foreign adversaries deemed threats to U.S. Engaging in data-mapping exercises may alleviate this burden.

Compliance 52

Compliance Due diligence e-records Time-tracking 52