Escolar Documentos
Profissional Documentos
Cultura Documentos
25 June 2019
Kinstellar Team
1 Introduction
Introduction
1
Context
1 2 3
GDPR reshaped One year into its Many GDPR aspects
the role of data applicability, sector and practices are
protection regulations are being inspired by
adopted, supervisory competition law
authorities are
Emerges into a top tier reorganising and are
legal field. closing the first Competition law may be
cases under the a useful source
GDPR for preparing for
enforcement actions as
(1) there are a number
of similarities in the
Not all DPAs publish
regulations and
their enforcement
(2) data protection
actions and companies
matters can often have
look for guidance on
a competition law
how to structure their
perspective
priorities.
Key facts
Our Story
Almaty (Kazakhstan)
11 Sofia (Bulgaria)
Tashkent (Uzbekistan)
Belgrade (Serbia)
offices Bucharest (Romania)
Budapest (Hungary)
Istanbul (Turkey)
Bratislava (Slovakia) Kyiv (Ukraine)
200+ Prague (the Czech Republic)
lawyers
8,000+
clients
2
GDPR reception in CEE
Kinstellar GDPR audit findings
GDPR as a one-off exercise / Insufficient procedures Vague privacy notices Missing data processing
no framework established (personal data breaches Over reliance on consent agreements
Lack of resources and data or DPIAs) increasing risk of withdrawal Use of vague / template
protection roles added to “day Access controls limited of consent wording
job” to formal organisational
Failure to identify personal measures with limited IT
data processing activities controls
Insufficient data deletion /
retention practices
Supervisory authorities
in numbers
Enforcement Actions
Authorities focus on handling complaints and face significant workload resulting in delays.
INVESTIGATIONS INVESTIGATIONS
46 37
EXAMINATIONS EXAMINATIONS
102 (17 ex officio, 85 upon 31
complaint)
Fines
Authorities shied away from imposing large or many fines (so far).
ROMANIA BULGARIA
3
Role of data
in competition law Facebook falsely claimed to be unable to establish
reliable automated matching between Facebook
proceedings: users' accounts and WhatsApp users' accounts
Facebook/
WhatsApp case
(2017 )
Fine of €110 million imposed on Facebook
Role of data
D a t a c o l l e c t e d o n F a c e b o o k ’s o t h e r s e r v i c e s s u c h a s
in competition law WhatsApp or Instagram and on third party websites using
Facebook Application Programming Interface (such as
proceedings: “like” or “share” buttons) are combined and assigned to a
user profile
Facebook
Bundeskartellamt Users’ consent with such extensive data collection and
combination was not considered given freely
case (2019)
F a c e b o o k ’s c o n d u c t c o u l d h a v e b e e n i n v e s t i g a t e d b o t h
under the GDPR as well as under competition law
Check credentials of investigators Expect requests for copying and EU-specific concept of privileged
Who to contact? explanations documents
Can they wait? Arrange for shadowing ̶ Documents produced by
Co-operation obligation broad but external counsel
not unlimited ̶ Documents produced
Procedural rights of audited exclusively for the purpose of
company seeking external legal advice
̶ Internal notes summarising
the content produced by
external lawyers
Will not apply to business secrets
or advice of internal lawyers
Repurposing competition documents and procedures
www.kinstellar.com
Thank you!
With offices in 11 jurisdictions and over 250 local and international lawyers, we deliver consistent, joined-up legal advice and assistance across diverse regional markets – together with the know-how
and experience to champion your interests while minimising exposure to risk.