Cyber and Information Law Newsletter: Issue 1 - General Information

Published 30 April 2019

Japan granted an Adequacy Decision 

On 23 January 2019, the European Commission adopted its adequacy decision on Japan, meaning that companies can now freely transfer personal data from the EU to Japan and vice versa. The European Commission’s press release can be accessed here.

Author

Michael McMillen

Spotlight on the Irish Data Protection Commission’s “One-Stop-Shop” 

Nearly one year since the GDPR came into force, statistics are starting to trickle in as to the effects of the regulation, and the impact felt by data protection authorities across Europe. One such area is the “one-stop-shop” arrangements, which have been introduced by the GDPR.

Under the GDPR, the supervisory authority in the Member State where a company has its “main establishment” holds primary responsibility for dealing with data protection matters, such as complaints raised by data subjects, even where these are cross-border in nature.

As is well known, Ireland is an attractive corporate destination, meaning a large number of US multinationals have their main establishment in Ireland. These include Apple, Facebook, Microsoft, Twitter, Dropbox and LinkedIn. However, it is worth noting that the French data protection authority, CNIL, recently found that Google did not have a “main establishment” in the EU and that, therefore, CNIL had authority to investigate the complaints, rather than exclusively the Irish Data Protection Commission, despite the fact that at the time in question Google’s main office was in Ireland. This decision was based on the fact that key decisions were not in fact being taken by the Irish entity, but were instead being taken by Google in the US, which opened Google to enforcement by any supervisory authority in the EU. This led CNIL to take its own action and demonstrates that the concept of “main establishment” may be construed narrowly.

During the seven months from 25 May to 31 December 2018, the Irish Data Protection Commission dealt with 136 one-stop-shop complaints; it was notified of 38 personal-data breaches, concerning 11 tech multinationals, with a number of statutory investigations ongoing.  They are also acting as lead reviewer on a number of binding corporate rule applications.

Organisations with international operations should ensure they are aware of who the relevant lead supervisory authority is. In particular from a UK perspective, this will need to be kept under review in the light of the ongoing Brexit negotiations.