United Kingdom Makes Data Protection Plans for ‘No Deal’ Brexit

The Government of the United Kingdom has published guidance discussing the impact on UK data protection law if the UK leaves the EU without a deal on Brexit Day – March 29, 2019. At the outset, the EU’s GDPR will cease to apply in the UK on Brexit Day. Therefore, the UK plans that its EU (Withdrawal) Act of 2018 ...

Names and Email Addresses Constitute a Database Subject to Israeli Data Protection Law

The Privacy Protection Authority (PPA) – Israel's regulatory and enforcement authority for personal data – has published a public statement laying out the PPA’s interpretation of the Israeli Privacy Protection Law regarding email addresses.

The statement discusses whether a list containing merely names and email addresses is considered a "Database" under the Israeli Privacy Protection Law. The PPA's position is ...

Second Circuit Bans a Company’s Marketplace for Resale of Digital Music

The United States Federal Court of Appeals for the Second Circuit affirmed a prior ruling by the district court, holding that ReDigi, an online platform for the resale of lawfully purchased digital music files, infringes copyrighted music.

ReDigi sought to create a technology and marketplace for resale of music files. A ReDigi user seeking to resell music would use the ReDigi ...

GDPR Notice and Consent Compliance Implications on the AdTech Industry and Beyond

The French data protection authority (Commission Nationale de l'informatique et des Libertés – CNIL) recently published a warning it issued to the French AdTech company Vectaury, that collects and processes geolocation data for targeted advertising purposes through an SDK that is integrated into third party mobile applications.

The CNIL’s warning to Vectaury reveals detailed information about the EU privacy regulators’ ...

Draft Guidelines on the Extra-Territorial Scope of the GDPR

The European Data Protection Board (EDPB) – the panel of EU privacy regulators – has published long-awaited guidance on the territorial scope of the General Data Protection Regulation (GDPR). The draft guidelines explain that according to Article 3 of the GDPR, the GDPR’s applicability is triggered into effect on one of two criteria – the “establishment” criterion and the “targeting” ...

New York Attorney General Imposes Unprecedented Fine for COPPA Violations

The Attorney General (AG) for the State of New York imposed the largest-ever penalty for violations of the U.S. federal Children’s Online Privacy Protection Act (COPPA) – 4.95 million dollars – in a settlement reached with Oath, Inc., the successor of AOL. 
The AG alleged that AOL knowingly provided online advertising services to a website directed to children under the ...

Israeli Privacy Authority Publishes Draft Guidelines on the Use of Drones and Smart City Guidance

The Israeli Privacy Protection Authority (PPA) – Israel's regulatory and enforcement authority for personal data – has published draft guidelines on the use of drones and guidance for municipalities on privacy aspects of smart cities.
The draft guidelines, which do not apply to drones that collect information "for personal use that is not for business purposes", establish the following principles:  ...

US Securities Commission Requires ICO Companies to Register Tokens as Securities

The United States Securities and Exchange Commission (SEC) has settled charges against two companies for not registering their Initial Coin Offerings (ICO) of digital tokens as securities pursuant to the federal securities laws. 

These settlements are part of the first enforcement proceedings brought by the SEC that impose civil penalties on companies solely for ICO securities registration violations. Previous cases ...