FIRST PRIVACY is a consultancy that specializes in supporting multinational companies with international and multijurisdictional data protection, data ethics, compliance, information security, and privacy risk prevention. The firm advises on the complexities of data handling across borders.

FIRST PRIVACY

FIRST PRIVACY is a consultancy that specializes in supporting multinational companies with expertise in international and multijurisdictional data protection schemes, compliance, information security, and privacy risk prevention. Self-described as experts, they provide consulting services related to data protection and privacy laws.

Legal Services

DSN GROUP

Privacy Blog

FIRST PRIVACY | 390 followers on LinkedIn. member of DSN GROUP | FIRST PRIVACY is member of the DSN GROUP – a leading provider of services for the management and assessment of corporate data protection. 

We are dedicated to provide our services internationally by covering markets within and beyond Europe. 

We are responsible for more than 200 companies&#39;​ data protection, among them globally operating companies in different fields, such as Astrazeneca, Cochlear, Shire, ArcelorMittal, AB InBev, Vapiano, Conergy, Nordex, DelMonte, Bureau Veritas, Germanischer Lloyd.

Senior Privacy Counsel at FIRST PRIVACY GmbH

Michelle Bausenwein

Privacy Counsel at FIRST PRIVACY GmbH

Tania Vanessa Eslava Suárez

Managing Director at FIRST PRIVACY GmbH / Lawyer at datenschutz nord GmbH

Peter Suhren

Senior Privacy Counsel at FIRST PRIVACY

Marina Anagnostaki

🚨 The Norwegian Data Protection Authority (DPA) has fined the University of Agder (UiA) EUR 12,700 for a data breach that occurred when documents containing personal information about employees, students, and external individuals were found in open Microsoft Teams folders accessible to employees without a legitimate need. The issue had persisted since UiA adopted Microsoft Teams in 2018, affecting approximately 16,000 individuals. This case showcases the technical and organizational measures that all companies should implement for personal data, including: -Restricting access to personal data to only those who need it. -Providing staff with proper training on data privacy and security protocols. -Establishing logging systems to detect and address data breaches. Proper data handling practices are critical for maintaining trust and avoiding costly violations. Read the full news (in Norwegian) here: https://lnkd.in/e5U_hmp5 #DataProtection #GDPR #PrivacyBreach #UiA #CyberSecurity

🚨 The Spanish Data Protection Authority (AEPD) has fined LOCAL VERTICALS, S.L. EUR 10,000 for a mistake in the link to its privacy policy during user registration process. An individual filed a complaint after being unable to access the privacy policy on the company's website. Instead of leading to the required information, the link directed users to a third-party site unrelated to the actual data controller, making it impossible for users to understand how their personal data would be processed. Have you reviewed the privacy information of your webpage, and all the relevant links? Read the full decision, in Spanish, here: https://lnkd.in/emF34sFJ #DataProtection #GDPR #PrivacyPolicy #Transparency #AEPD

🔍 Online Proctoring: GDPR vs. U.S. Privacy Laws 🔍 In her second article on online proctoring, our colleague Marina Anagnostaki explores the contrasting privacy approaches under GDPR in Europe and U.S. regulations regarding the monitoring of students during online exams. -GDPR (EU): Demands strict consent for AI profiling in exams, with clear safeguards against automated decisions that impact students. -U.S. Laws: While FERPA and COPPA cover data consent and security, state laws (like California’s and Virginia’s) add layers of protection, emphasizing transparency and the right to opt out of certain data use. Regardless of the jurisdiction, some best practices include obtaining informed and explicit consent, gathering only what is essential for monitoring, and clearly explaining AI’s role. Read Marina's article here: https://lnkd.in/eua4aaRS #Privacy #OnlineProctoring #StudentData

🔐 Navigating Employee Email Privacy: Takeaways from Italy’s €80,000 Fine As reported by our colleague Giulia Provini , Italy’s Data Protection Authority recently fined a company €80,000 for mishandling a former employee’s email data, spotlighting GDPR’s rules on transparency, retention, and lawful monitoring. The lessons: 1️⃣ Data Retention: Only retain employee data as long as necessary. Extended retention without a legitimate purpose can lead to fines. 2️⃣ Transparency: Employees should know when, why, and how their data may be monitored. Clear privacy policies build trust and compliance. 3️⃣ Lawful Monitoring: Monitoring requires a clear legal basis and proper notifications to respect employee rights. 💡 With FIRST PRIVACY’s guidance, companies can craft compliant, transparent data policies that prioritize both privacy and organizational needs. Read Giulia's full article: https://lnkd.in/dQYStXsq #GDPR #DataPrivacy #EmployeeRights #Compliance

🔍 GDPR Fines Are a Matter of Discretion, Not Obligation In 2019, the Bremen State Commissioner for Data Protection made waves by suggesting that every data breach resulting in a supervisory action must lead to a fine under GDPR. Fast forward to 26 September 2024, as our managing director Peter Suhren reports, the European Court of Justice (ECJ) ruled that DPAs indeed have discretion in deciding on sanctions. They underscored that imposing fines should consider the specific circumstances of each case, ensuring fairness and proportionality in data protection. 🚨 This decision is a significant moment, reinforcing that authorities are not bound to a “fine-every-case” rule but rather have the responsibility to assess context and fairness. Read Peter's full article here: https://lnkd.in/e5Za-Cqe

Online education is here to stay and the supervision of exams to prevent cheating and ensure academic integrity has become a data protection issue. In her latest blog post, our dear Marina Anagnostaki explores the approaches that Germany and France have taken to tackle this issue. 🔹 Germany: With strict guidelines, particularly in Bavaria, the focus is on minimizing AI surveillance and favoring human oversight. Room surveillance is highly restricted, and biometric verification is generally avoided. 🔹 France: The CNIL emphasizes transparency and provides strict safeguards on biometric data. Automated tools are permitted with human oversight, ensuring any AI-flagged issues are verified before action. 🌐 Both countries require alternative, face-to-face options and stress transparency, allowing students to make informed choices. With GDPR principles at their core, these frameworks show a shared commitment to proportionality and privacy in online assessments. Read Marina's full article here: https://lnkd.in/e9239eXb

🚨 ICO Launches Data Protection Audit Framework As reported by our colleague Francesca Romana Di Costanzo , the UK Data Protection Commissioner (ICO) has introduced a new Data Protection Audit Framework designed to help organizations assess and track their data protection compliance. This online toolkit is useful for both consensual and compulsory audits, ensuring alignment with GDPR expectations. The toolkits are geared toward professionals such as Data Protection Officers (DPOs), senior management, IT security personnel, and internal auditors in large public, private, and third-sector organizations. The framework provides checklists and guidelines covering essential topics such as accountability, data processing activities, data sharing, and data retention. It also includes specific guidance on AI and the processing of minors' data. 🔎 Find the full article by Francesca here: #DataProtection #GDPR #Compliance #Privacy #DataSecurity #ICO #AuditFramework #DPO #CyberSecurity

🌍 Email Marketing: Staying Compliant Globally 🌍 Email marketing is key for international growth, but compliance with global data protection laws is key. In her latest blog post, our colleague Marina Anagnostaki explains what multinational companies should keep in mind before clicking "send". 🔑 Best Practices: -Consent First: Use double opt-in for explicit consent, ensuring recipients agree to receive emails. -Clear Opt-out: Always include an easy, free unsubscribe option. -Transparency: Clearly identify your business and make it obvious it’s a marketing email. Read Marina's full blog post here: https://lnkd.in/drZ4feWs #EmailMarketing #GDPR #Compliance #DigitalMarketing #DataProtection

Today in our #HealthFriday 🩺, we explore a recent blog post from the Spanish Data Protection Authority (AEPD) that delves into the balance between the right to data protection and the essential concept of vital interests. Data protection, while important, is not an absolute right, and personal data may be processed if it’s necessary to protect an individual’s life. However, this legal basis is to be used sparingly, strictly limited to situations where other legal grounds aren’t viable. For instance, in emergency medical scenarios, where an individual is unconscious and cannot give consent, the GDPR allows healthcare providers to process essential health data, provided that not doing so could threaten someone’s life. Nonetheless, such processing must be executed with diligence and is typically reserved for exceptional cases, like natural disasters or epidemic control, where public interest and individual safety align. Learn more about this legal basis for processing personal data here: https://lnkd.in/gxgZwrnX #DataProtection #GDPR #AEPD #PrivacyRights #VitalInterests #HealthcareData #EmergencyPreparedness #HealthData

🚨 The Spanish Data Protection Authority (AEPD) has fined Santander Consumer Finance, S.A. EUR 50,000 for violating the principle of lawfulness under the GDPR. The fine followed a complaint by an individual who received advertising materials despite having explicitly exercised their right to object to the use of their personal data for marketing purposes. Although Santander initially confirmed that the individual's request had been processed, the person later received promotional material about a pre-approved loan. The incident was attributed to human error, where an employee failed to update the system correctly. This case serves as a reminder for companies to prioritize diligence and precision in managing personal data and respecting individuals’ rights. Failure to do so, even unintentionally, can lead to significant financial penalties and reputational damage. Read the full decision (in Spanish) here: https://lnkd.in/edp93fbt #DataProtection #GDPR #AEPD #SantanderConsumerFinance #MarketingCompliance

FIRS

COM:FIRST-PRIVACY

FIRST PRIVACY