Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Andre Walter
Datenaustausch in der Praxis
Explore all Energy & Natural Resources CleanTech Nuclear Oil & Gas Renewables Explore all Financial Services Finance Fintech Insurance Explore all Infrastructure Community Infrastructure Construction Construction Services Economic Infrastructure Major Infrastructure Owners & Operators Social Infrastructure Transport Waste Waste management Water & wastewater Explore all Real Estate Garden communities Logistics Residential Explore all Sport & Hospitality Gambling Hotels Sport & Entertainment...
NIS2: EU chases 23 countries on cyber law implementation
Cyber law expert Stuart Davey of Pinsent Masons said the lack of national implementing legislation for NIS2 is hampering business efforts to comply with the new regime. NIS2 builds on the original NIS directive which took effect in the EU in 2018 and imposes cybersecurity risk management and incident reporting obligations on in-scope organisations under a tiered system of regulation.
Dutch PA fines US-based facial recognition company for GDPR breach
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens/AP) has also warned that it is illegal for Dutch organisations to use Clearview AI's services. Clearview AI is a commercial business that offers facial recognition services to intelligence and investigative services. Customers can provide camera images to find out the identity of people shown in the images. For this purpose, Clearview has a database with more than 30 billion photos of people.
DPA issues Uber €290 million fine for GDPR data transfer breach
The Dutch authority deemed the alleged breach as a “serious violation” of the General Data Protection Regulation (GDPR). However, Uber has said it considers the decision and subsequent fine to be “flawed and unjustified” and has vowed to lodge an appeal. According to the DPA, Uber collected the sensitive information of drivers from the EU and retained it on servers in the US.
EU and China to tackle challenges in cross-border transfer of non-personal data
The initiative, known officially as the Cross-border Data Flow Communication Mechanism, is a result of a political agreement reached in 2023 between senior leaders from both sides. It was launched following concerns raised by EU businesses in China regarding cross-border flows of non-personal data. Representatives from the EU and China recently held the inaugural formal meeting of the new mechanism, which is said by the EU to be “the first cooperation structure of its kind between the two sides”.
AI Act written into EU law as compliance clock ticks
Businesses developing and procuring AI tools have been urged to build their understanding of how the new EU AI Act will apply to them, and the risk management obligations they may be subject to, after the legislation was written into EU law on Friday. Frankfurt-based Nils Rauer of Pinsent Masons, an expert in AI regulation, said the EU AI Act is a “highly impactful piece of legislation” that businesses need to respond to now, ahead of core provisions taking effect in the months and years ahead.
AI Act written into EU law as compliance clock ticks
Businesses developing and procuring AI tools have been urged to build their understanding of how the new EU AI Act will apply to them, and the risk management obligations they may be subject to, after the legislation was written into EU law on Friday. Frankfurt-based Nils Rauer of Pinsent Masons, an expert in AI regulation, said the EU AI Act is a “highly impactful piece of legislation” that businesses need to respond to now, ahead of core provisions taking effect in the months and years ahead.
NIS2 cybersecurity standards proposed for digital providers
The NIS2 Directive on measures for a high common level of cybersecurity across the EU (NIS2) directive came into force in the EU on 16 January 2023 and has to be implemented into national laws across the EU by 17 October 2024. It builds on the original NIS directive which took effect in the EU in 2018.
Dutch data protection authority raises expectations for GDPR compliance practices
In these letters, the Dutch DPA has asked the municipality of Eindhoven and the province of South-Holland to improve their compliance framework under the General Data Protection Regulation (GDPR), bringing it up to the so-called 'level 3 maturity', which means having a policy framework in place.
Businesses get fresh guidance on EU-US personal data transfers
The European Data Protection Board (EDPB) clarified the requirement in a new information note (3-page / 185KB PDF) on data transfers to the US under the EU General Data Protection Regulation (GDPR). The transfer of personal data across borders is common in the everyday operations of multinational businesses, but strict rules govern such transfers in many jurisdictions.
Dutch Data Act proposals underline impact on cloud software services
The EU’s Data Act was issued on 13 December 2023 and a recent consultation on a draft execution act shows how it will be embedded into the Dutch legal system. The Data Act has direct effect and does not need implementation in each of the EU member states; however, some Dutch legislation must be amended to ensure provisions are in line with the EU Act, resulting in changes for IT firms.
EU ruling adds complexity and challenges to online advertising
Lauro Fava and Andre Walter of Pinsent Masons were commenting after the Court of Justice of the EU (CJEU) clarified how EU data protection law applies in the context of a mechanism that captures internet users’ preferences for online personalised advertising.
EU Data Act entering into force ‘should spur business action’
Amsterdam and Munich-based data law experts Andre Walter and Stephan Appt of Pinsent Masons said that the new Data Act could require a wide range of businesses across sectors to update terms of use relating to their connected products and amend data sharing and licensing agreements, among other things.
Dutch authority calls for pre-registration of data intermediation services under EU data sharing regime
The Data Governance Act (DGA) became EU law last summer, with the national implementation deadline being 24 September 2023. The Act promotes greater data sharing by businesses and public bodies and the concept of regulated ‘data intermediation service providers’, whereby service providers effectively act to facilitate data sharing between data holders, or data subjects, and data users – including, potentially, through online platforms.
Data processing agreements cannot be retrospectively applied under the GDPR
Andre Walter, who specialises in data protection law at Pinsent Masons, was commenting after the Belgian authority ruled that the absence of a data processing agreement cannot be remedied under the EU General Data Protection Regulation (GDPR) by inserting a data processing agreement into a contract and providing for it to apply retrospectively.
EU Data Governance Act provides framework for data sharing
The Data Governance Act became EU law last summer, but it only began to apply on Sunday 24 September. The Act, proposed by the European Commission in late 2020, is multi-faceted.
GDPR fine imposed on TikTok
The Data Protection Commission (DPC) said that during the period between 31 July 2020 and 31 December 2020, TikTok had breached rules set out in the EU General Data Protection Regulation (GDPR), including principles that govern the processing of personal data and requirements around the disclosure of information to data subjects about that processing.
Existing data transfer mechanisms remain useful and can benefit from EU adequacy decision
The types of businesses that will not be able to rely on the DPF for EU-US data transfers include US financial services institutions and telecommunications companies. Walter said those businesses, and others that choose not to self-certify to the DPF, will need to continue using SCCs or other transfer mechanisms, and conduct TIAs to ensure their arrangements comply with the GDPR.
Privacy Shield 2.0: EU-US Data Privacy Framework adopted
The DPF is a package of measures designed to govern how personal data is protected when transferred from the EU to the US by businesses that self-certify to the framework. Initially at least, self-certification to the DPF privacy principles is only open to organisations regulated by the US Federal Trade Commission and US Department of Transportation. This notably excludes US financial services institutions and telecommunication companies from certifying. Annual re-certification is required.
Preparing for the EU Corporate Sustainability Due Diligence Directive
The Council agreed with the Commission’s scope, but proposed a phased-in approach (129-page / 827 KB PDF), meaning that at an early stage, the new rules would only apply only to "very large companies" that have more than 1000 employees and €300 million net worldwide turnover. Only non-EU companies with €300 million net turnover generated in the EU would have to comply with the new rules at the outset.
US publishes intelligence community safeguards for data transfers from the EU
The EU-US Data Privacy Framework (DPF), colloquially referred to as ‘Privacy Shield 2.0’, has been drawn up by EU and US negotiators as a means by which to help businesses transfer personal data from the EU to the US in a way which meets the requirements of EU data protection law. However, the framework has yet to take effect.
Guide gives clarity on calculation of GDPR fines
Nienke Kingma of Pinsent Masons in Amsterdam, who specialises in data protection law, was commenting after the European Data Protection Board (EDPB) published a new methodology and accompanying guidelines on the calculation of administrative fines under the General Data Protection Regulation (GDPR) (48-page / 787KB PDF). The guidelines sit alongside earlier EDPB guidance on the application and setting of administrative fines.
Risk of data protection mass claims persists for businesses in Europe
On 4 May 2023, the CJEU ruled that the mere infringement of the GDPR is not sufficient to confer a right to compensation but that EU member states are precluded from imposing rules or practices that require claims for compensation based on non-material damage to reach “a certain degree of seriousness”.
CJEU clarifies scope of right to obtain a copy of data under GDPR
This is the case when these documents are indispensable for the data subject to effectively exercise their rights under the GDPR, the CJEU said. In such cases, the data subject has a claim to receive copies of extracts of the relevant documents or even copies of the entire documents. The CJEU also said the information provided must "enable the data subject to ensure that the personal data relating to him or her are correct and that they are processed in a lawful manner".
Updated EU guidance to help organisations respond to DSARs
In finalised new guidance on the right of access (63-page / 1.42MB PSD), the EDPB explained that the right of access under EU GDPR comprises “complete information on all data” and that it “cannot be understood as granting only a summary of the data”.
EDPB says concerns remain with ‘Privacy Shield 2.0’ framework
In an influential, though non-binding, opinion concerning ‘Privacy Shield 2.0’ (54-page / 1.6MB PDF), the European Data Protection Board (EDPB) raised concerns that the proposed framework does not provide for data transferred from the EU to the US to be handled in accordance with data protection standards that are essentially equivalent to those that apply in the EU, as EU law requires.
Privacy Shield 2.0: MEPs advise against adoption
The LIBE Committee has provisionally said that Privacy Shield 2.0 “fails to create actual equivalence in the level of protection” and plans to call on the Commission to “continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence and which would provide the adequate level of protection required by Union data protection law and the Charter [of Fundamental Rights of the European Union] as interpreted by the CJEU”.
Data sharing structures: from theory to practice
Join Pinsent Masons experts for lessons from data sharing, explore what makes a good data sharing operating model, and how to overcome challenges. As a follow-up to the previous session on Data Strategy, this session will share insights and lessons from practical experience on data sharing of personal and non-personal data.
NIS2 cybersecurity directive expands obligations in EU tech sector
Under the original NIS directive, the specific obligations organisations faced depended on whether they were classed as ‘operators of essential services’ or a ‘digital service provider’. Stricter rules have applied to operators of essential services, a term that encompasses organisations that operate critical infrastructure across sectors such as energy, transport, health and digital infrastructure.
CJEU asked to define scope of GDPR ‘legitimate interests’
The Court of Justice of the EU (CJEU) has been asked to rule on whether a purely commercial interest can be regarded as a ‘legitimate interest’ for the purposes of the General Data Protection Regulation (GDPR) and, if so, to outline the circumstances which will determine that.
Privacy Shield 2.0: EU-US data transfers decision drafted
Both the EU GDPR and its UK equivalent impose on the transfer of personal data internationally, outside of the European Economic Area (EEA). The strict conditions under which data transfers are permitted are designed to ensure that personal data that benefits from the protections under the GDPR continues to benefit from an equivalent standard of protection in the jurisdictions to which the data is exported.
EU child protection automatic scan proposals ‘must not come at expense of encryption’
Andre Walter of Pinsent Masons said the plans put forward by the European Commission, which could include obligations on platforms to automatically scan the content of individual messages – known as ‘client-side scanning’ – were well-intentioned but flawed. “Requirements for client-side scanning must not come at the expense of strong end-to-end encryption, which is an essential part of a secure and reliable internet.
Instagram GDPR fine confirms children’s data protection focus
Meta, the company behind Instagram, has said it disagrees with the way the fine was calculated and intends to appeal it. The fine is the biggest that has been issued under the EU General Data Protection Regulation (GDPR). Amazon last year notified US regulators that Luxembourg’s data protection authority had outlined its intention to issue it with a fine of €746m under the GDPR, but a final decision has not yet been made public in that case.
EU court: data attributes revealing sensitive personal data can be ‘special category’ data
The dispute concerns a Lithuanian law on reconciliation of interests that requires persons working in the public service to make public disclosures of private interests. The disclosures are published on a register that is publicly accessible on the internet and are designed to offer transparency over and prevent conflicts of interests and corruption in the public sector. The ethics commission oversees compliance with the law.
EU will Verhaltenskodex zum Schutz von Minderjährigen im Internet einführen
Der Verhaltenskodex ist Bestandteil der neuen Strategie der Kommission für ein besseres Internet für Kinder, die letzte Woche angenommen wurde. Die Strategie umreißt Pläne und Maßnahmen, die dazu beitragen sollen, digitale Dienste altersgerechter und zum Wohle von Kindern zu gestalten. Die neuen Pläne bauen auf der 2012 angenommenen europäischen Strategie für ein besseres Internet für Kinder auf.
New framework for EU-US data flows moves closer
EU and US officials are seeking to develop a new framework to support the free flow of personal data between the EU and US following a ruling by the EU’s highest court in 2020. The Court of Justice of the EU (CJEU) assessed claims that the US did not provide adequate protection to personal data transferred from the EU against intrusions resulting from the surveillance activities practised by US public authorities.
English privacy notice leads to Dutch data protection fine
Chinese social media app TikTok has been fined €750,000 by the Dutch data protection authority, Autoriteit Persoonsgegevens (AP), after its English-language privacy notice was deemed insufficiently clear for children in the Netherlands to understand. The AP ruled that the privacy notice “failed to provide an adequate explanation of how the app collects, processes and uses personal data”, in breach of data protection law.
EU standard contract clauses bolstered for international data flows
The European Commission has published updated standard contractual clauses (SCCs) to support the transfer of personal data outside of the EU by businesses and other organisations. The SCCs can be inserted into commercial contracts.
French GDPR ruling addresses US surveillance powers
Organisations can deploy legal and technical safeguards to meet their obligations under EU data protection law when seeking to prevent US authorities from accessing personal data stored with their outsourcing providers, according to a new summary ruling by the Conseil d’État, the French Council of State.
CJEU ruling on framing and inline linking 'strengthens protection of authors'
The Court of Justice of the European Union (CJEU) ruled that framing or inline linking is an unauthorised use of copyright if it circumvents technical measures the author has taken. Framing and inline linking are ways to link content on different websites. The content appears to the viewer as part of the page they are visiting but it has been embedded there via a link to another site.
Artificial Intelligence: a look under the hood
We are excited to invite you to a special AI event hosted by Pinsent Masons Netherlands and Germany. This interactive technical deep dive will offer a unique glimpse into the inner workings of AI models. How are these models built? This is a perfect opportunity to delve into the technical aspects of AI, including LLM applications, algorithm training, and more.
Binding Corporate Rules: An Attractive Inter-Company Data Transfer Vehicle and More | Lexology
At the doorstep of 2020, advocate general Hendrik Saugmandsgaard Øe (a.g.) rendered his opinion in the so called “Schrems II case” and opined on how European Court of Justice should deal with the GDPR’s regime for international data transfers. See here for a summary on the Schrems II case. In a series of blogs, we further elaborate on the consequences of that opinion and the impact it may have on the current international data transfer practices.
Next Level E-commerce with Responsible AI
On 17 September 2019 Baker McKenzie, together with Accenture Interactive Amsterdam, hosted the third Shopping Tomorrow expert session on "Next Level E-commerce with Responsible AI." About 25 experts from major Dutch and international consumer goods and retail players gathered for a session on customer data usage under the European data protection laws (GDPR), particularly focusing on artificial intelligence in e-commerce.
Interplay of the Clinical Trials Regulation (CTR) and the GDPR | Lexology
European Union
February 14 2019 The European Data Protection Board (EDPB) recently published opinion 3/2019 on the interplay of the Clinical Trials Regulation (CTR) and the General Data Protection Regulation (GDPR). The EDPB advises the European Commission on issues related to the protection of personal data and is composed of all heads of the national EU data protection authorities.
Pinsent Masons advises medtech startup OASYS NOW as it reaches significant milestone
Founded in 2021 by Nima Salami, a Cybersecurity and AI Computer Scientist, and Sara Okhuijsen, a Bioinformatician and Genomic Privacy Researcher, OASYS NOW is an AI-powered health data platform built to help researchers capitalise on the latest breakthroughs in technology and science to improve precision medicine and preventative healthcare.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Andre
Contact Andre, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack