German Federal Supreme Court issued cookie decision in Planet 49 case

On May 28, 2020, the German Federal Supreme Court handed down its decision in the Planet 49 case regarding the consent requirements for the use of cookies. The decision follows the Court of Justice of the European Union’s preliminary ruling of September 10, 2019. The decision has not yet been published, but the court has issued a press release.

The court decided that the use of pre-ticked boxes was not a valid form of obtaining consent for cookies before May 24, 2018 and remains an invalid way of obtaining consent under the GDPR. The court’s decision applies the German provisions on cookies in the German Telemedia Act which it interprets in light of the EU Directive on Privacy and Electronic Communications (“ePrivacy Directive”). Continue Reading

Updated EDPB Guidelines on consent and implications for cookies

On May 4, 2020, the European Data Protection Board (“EDPB”) updated its guidelines on consent under the GDPR.  An initial version of these guidelines was adopted by the Article 29 Working Party prior to the GDPR coming into effect, and was endorsed by the EDPB on May 25, 2018.

Continue Reading

AB 2811: The Future of Automatic Renewals in California

On May 5th, 2020, the California Assembly Committee on Privacy and Consumer Protection held a hearing and considered AB 2811, a bill that would amend existing California law governing automatic renewals.  As currently drafted, AB 2811 would:

  • require businesses to provide 3-7 days’ notice explaining how to cancel an automatic renewal offer or continuous service offer if the consumer accepted (1) a free gift or trial that lasts for a predetermined period of time as part of an automatic renewal or continuous service offer, or (2) the consumer accepted an automatic renewal or continuous service offer at a discounted price, and the applicability of that price was limited to a predetermined amount of time; and
  • require businesses that permit consumers to accept automatic renewal or continuous service offers online to immediately terminate that service online.

Continue Reading

Democrats Introduce COVID-19 Privacy Bill That Differs in Key Respects From Republicans’ Proposal

House and Senate Democrats recently unveiled proposed legislation—tentatively titled the “Public Health Emergency Privacy Act”—that would regulate the collection and use of health and location information in connection with efforts to track and limit the spread of COVID-19.

Below we describe the proposed Public Health Emergency Privacy Act and how it differs with a separate Republican proposal, the “COVID-19 Consumer Data Protection Act,” which we previously analyzed on this blog:

  • The Public Health Emergency Privacy Act would regulate any person (including government entities other than public health authorities) that collects, processes, or transfers certain covered data or develops or operates a website, web application, mobile application, mobile operating system feature, or smart device application to track, screen, monitor, contact trace, mitigate, or otherwise respond to COVID-19. The bill distinguishes between covered entities and service providers for some of these purposes.
  • The bill would regulate “emergency health data,” which is defined as any data linked or reasonably linkable to an individual or device that “concerns the public COVID-19 health emergency.” Like the Republican proposal, this includes health information, geolocation information, and proximity data.  In addition, the bill identifies as examples of emergency health data certain additional categories of regulated data, including whether an individual has been tested for or “an estimate of the likelihood that a particular individual may contract” the disease or disorder; genetic data, biological samples, and biometrics; demographic data; contact information; and any other data collected from a personal device.
  • Like the Republican proposal, many of the bill’s key requirements are consistent with existing federal or state privacy requirements or norms, including obligations to post a clear and conspicuous privacy policy and to maintain reasonable data security policies and practices.
  • Like the Republican proposal, this bill would generally require affirmative express consent to collect, use, or disclose covered data. There also would be a requirement to provide individuals “effective mechanisms” to revoke consent and to correct any inaccurate emergency health data.  However, the proposal would also prohibit certain collection, use and disclosure of emergency health data, even with consent.  For example, the proposal would prohibit use of emergency health data for commercial advertising, e-commerce recommendations, or for use as training data for advertising or e-commerce algorithms.
  • Other notable examples of prohibited uses of emergency health data include: (1) uses of emergency health data to solicit or contract for employment, insurance, housing or education opportunities; or (2) to limit the availability of any goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation, except where authorized by the government for a public health purpose. Relatedly, the bill obligates covered organizations to adopt reasonable safeguards to prevent “unlawful discrimination” on the basis of emergency health data.
  • The proposal would appear to limit disclosures of emergency health data, even with consent, to government entities except where the disclosure is to a public health authority and made “solely for good faith public health purposes and in direct response to exigent circumstances.” There also is an exception for disclosures pursuant to appropriate legal process.
  • The bill would require the destruction of emergency health data after the later of 60 days after termination of the public health emergency declaration by the Secretary of Health and Human Services (“HHS”) or by state officials. Otherwise, the bill requires destruction 60 days after the collection of such data.
  • Like the Republican proposal, the proposed legislation would include a public reporting obligation. Under the Democratic proposal, the reporting obligation would require reporting every 90 days of the aggregated number of individuals whose emergency health data is collected, used, and processed for COVID-19 purposes.

The Democratic bill specifically exempts public health or scientific research by certain eligible researchers from its privacy requirements.  The privacy regulations in the proposal do not apply to entities regulated by HIPAA, but the Secretary of HHS is tasked with promulgating guidance on the applicability of similar requirements to covered entities and business associates.

Like the Republican proposal, the Federal Trade Commission could enforce violations under Section 5 of the FTC Act, and state attorneys general would have the right to enforce the bill’s obligations, including to obtain civil penalties.  However, there is also a private right of action, which requires proof of a concrete and particularized injury in fact.  Statutory damages are available from $100 to $1,000 per violation, and increased to between $500 to $5,000 for reckless or willful violations.  The bill would expressly invalidate pre-dispute arbitration agreements or class action waiver provisions.

This Democratic bill comes in addition to a separate proposal from House and Senate Democrats, entitled the “Emergency Limitation Periods Extension for Workers Act.”  That proposal would extend the statute of limitations period under a number of federal statutes, including the Fair Labor Standards Act and the Occupational Safety and Health Act, by 90 days after the termination of the public health emergency.

ICO Issues COVID-19 Guidance for Employers

On May 11, 2020, the UK Information Commissioner’s Office (“ICO”) published guidance on how employers should handle data in the event they choose to test their employees for COVID-19.

The guidance provides a clear reminder that employers must comply with both the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA”), and that health data, in particular, attracts additional protections. Continue Reading

Italian Supervisory Authority Publishes FAQs on Data Protection and COVID-19

On May 6, 2020, the Italian Supervisory Authority (“Garante”) published a list of frequently asked questions (“FAQs”) and answers on data protection and COVID-19 (see here, in English).

The FAQs build on and expand guidance previously issued by the Garante (see our blog post here), and take into account recent measures adopted by Italian authorities, such as the Protocol on Fighting COVID-19 in the Workplace that the Italian government signed with several trade unions on March 14, 2020 (see our blog post here), which was slightly amended on April 24, 2020 (see here).

Among other topics, the FAQs cover: (1) data processing by private employers in the context of the COVID-19 health emergency; and (2) data processing in clinical trials and medical research in the context of the COVID-19 health emergency. Continue Reading

FTC to Consider Changes to the Health Breach Notification Rule

On May 8, 2020, the Federal Trade Commission (“FTC”) issued a notice soliciting public comment regarding whether changes should be made to its Health Breach Notification Rule (the “Rule”).  The request for comment is part of a periodic review process “to ensure that [FTC rules] are keeping pace with changes in the economy, technology, and business models.”

The Rule, which first went into effect in 2009, applies only to vendors of personal health records (“PHRs”) and other related entities that are not subject to the Health Insurance Portability and Accountability Act (“HIPAA”).  A PHR is an electronic record of individually identifiable health information “that can be drawn from multiple sources and is managed, shared, and controlled by or primarily for the individual.”  See 16 C.F.R. § 318.2(d).  Under the Rule, PHR vendors and related entities must notify individuals, the FTC, and possibly the media within 60 days after discovering a breach of unsecured personally identifiable health information, or within 10 days if more than 500 individuals are affected by the breach. Continue Reading

Hungarian Government Suspends GDPR Data Subjects Rights

On May 4, 2020, the Hungarian Government issued a Decree that suspends, during the COVID-19 created state of emergency, the one-month deadline that controllers have under the GDPR to reply to data subject rights requests. The Decree also allows public entities to refuse or suspend freedom of information (“FOIA”) requests in certain situations. The Decree has been heavily criticized by civil society groups and prompted the scrutiny by the European Data Protection Board (“EDPB”).

According to the Decree, the normal one-month deadline to reply to data subject rights requests will start running once the state of emergency ends, for which there is no fixed date yet. This means that during the state of emergency, controllers are able to rely on this Decree to refuse to answer requests relating to access, correction and erasure of data, as well as requests objecting to the processing of personal data. The Decree also provides that, during the state of emergency, the right of information under Articles 13 and 14 GDPR can be satisfied through electronic means. This suggests that controllers can meet their transparency obligations by publishing on a website a privacy notice, even where they collect data offline.

The Decree also gives Hungarian public authorities the ability to extend from 45 days to 90 days the period to respond to a FOIA request or to reject FOIA requests where there is a risk that the request could jeopardize the public authorities’ tasks related to the COVID-19 situation. The public authorities must inform the requestor within 15 days of receipt of the FOIA request about the extension or rejection of the request.

On May 8, 2020, the EDPB announced that it had contacted the Hungarian Supervisory Authority about the above-mentioned Decree, but that it required further information to form a view. This was one of the topics discussed by the EDPB at their plenary session of May 14, 2020, and there are likely to be further developments related to this story.

CCPA 2.0 And Where We Go From Here

 On May 4th, 2020, Californians for Consumer Privacy confirmed that they had submitted hundreds of thousands more signatures than required to qualify for a ballot initiative. It is still yet unknown whether the Attorney General will qualify the ballot for the November 2020 election, let alone whether it would pass. If the initiative passes, it will be noteworthy for a number of reasons. Continue Reading

China Issued the Commercial Encryption Product Certification Catalogue and Certification

On May 11, 2020, the State Cryptography Administration (“SCA”) and the State Administration for Market Regulation jointly issued the Commercial Encryption Product Certification Catalogue (First Batch) (“Product Catalogue”) and the Commercial Encryption Product Certification Measures (“Certification Measures”) (the announcement is available here), taking effect immediately.


Prior to the adoption of the Encryption Law (see our post on the Encryption Law here), manufacturers of commercial encryption products were required to apply to the SCA for the “Commercial Encryption Products Type and Model Certificate.”  The Encryption Law removed this approval requirement by establishing a voluntary certification scheme, which encourages manufacturers to voluntarily apply to qualified agencies for the testing and certification of their commercial encryption products.  The release of the Product Catalogue and the Certification Measures marks a critical step forward in implementing such a voluntary certification scheme under the Encryption Law. Continue Reading