Is compensation due to a breach of the GDPR possible? Requesting compensation due to a breach of the data protection regulation is absolutely possible, as indicated in Art. 82 of the GDPR. In fact, citizens are becoming increasingly aware of this right and are requesting it more frequently, at least with regards to enquiries made to the firm. What is the difference between requesting compensation and reporting to the Spanish Data Protection Agency (AEPD)? There’s a big difference. Compensation consists of requesting a restitution due to a breach of the data protection regulation that may have ..read more

AI Act: Agreement of the European Parliament and of the Council  9 December 2023 marked an important date in the world of Artificial Intelligence (AI) with the announcement of an historic agreement between the European Parliament and the Council on the Proposal for a European Artificial Intelligence Regulation (AI Act). This agreement is the result of a legislative process that dated back to early 2020 with the public consultation on the White Paper on AI that laid the foundations for what we will still take time to see completed with current and applicable rules. Who does it affect in th ..read more

Data protection is regulated in the Principality of Andorra by Law 29/2021 and its implementing regulation (Decree 391/2021). The data protection agency has developed a guide to guarantee compliance with the Principality’s legal framework and promote the responsible and secure processing of personal data in the workplace in Andorra. The guide is intended for all players involved in the employment relationship. Apart from safeguarding people’s privacy rights and protecting their data, it also makes several recommendations for fundamental principles such as confidentiality, consent or the notifi ..read more

Some weeks ago, I wrote a post on Linkedin about quite a controversial issue in reference to people’s privacy and security (for example, in the case of a neighbourhood community), such as video surveillance systems, that is, security cameras. Most people are unaware of the requirements for their installation, who can view them, in what cases, how and where they have to be placed… There are two main laws that deal with this issue, so today I will explain the problem of security cameras and their legislation: Security cameras and their legislation: Who can view them? As indicated in the introduc ..read more

The Spanish Data Protection Agency (AEPD) has published an update of the cookies Guide. These new criteria on their use that are included in the new Guide must be implemented no later than 11 January 2024. Therefore, we believe a post is necessary to explain the new features introduced in it. The first thing to bear in mind is that the use of trackers must be transparent, and consent must be free and voluntary, which means that pre-checked boxes are not considered valid consent. This implies that the checkboxes for each cookie must be disabled in the “cookie settings” section. In the Banner wh ..read more

On 13 September, the Government of the Principality of Andorra approved the new catalan Bill in Andorra that will seek to require the accreditation of a minimum level of the language at the time of renewal of the residence permit. It should be remembered that this is not the first time that the debate has been raised regarding the use of Catalan in the Principality, as well as its preservation and promotion, given that Catalan is the official language of the country and an important part of its national identity. Article 2.1 of the Andorran Constitution states that “the official language of th ..read more

July 11 was an historical and very important day for the data protection sector, since the European Commission adopted the adequacy decision that allows data transfer agreement between the United States and Europe. Data transfer agreement between the United States and Europe: what is it and what does it mean? This is a bilateral agreement that allows for the transfer of personal data from Europe to providers or entities located in the United States. This means that, from then on, these data transfers to the US are considered to already have a level of protection comparable to those taking plac ..read more

In this month’s post, we want to focus on a very common practice in email marketing, which is none other than taking advantage of sending commercial emails to public company emails published on their website. We are referring to the classic “info@” or “admin@” emails, very common in business 3organisations or professionals who offer their services to clients. Commercial emails to public company emails: Are these emails considered personal data? The first thing to weigh up is the nature of this type of email and determine whether or not data protection regulations apply. Current law on this mat ..read more

Amidst the public debate on the virtues and risks of tools like the famous ChatGPT, the European Union has debated and approved the first regulations on artificial intelligence and privacy, with the aim of regulating this disruptive technology and its mass use. Among the risks of this new technology are undoubtedly all those related to the privacy of people, since AI feeds on the processing of large amounts of data (also personal) that is obtained from many different sources, such as data published on the social media, posts or any other that may result in data processing, of which the data su ..read more

Since March 13, 2023, Law 2/2023 of 20 February has been in force, better known as the Whistleblower Act, governing the protection of people who report violations of regulations, and the fight against corruption. This regulation transposes Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019, regarding the protection of persons who report breaches of Union Law, into the Spanish legal system. There are multiple analyses to be made of this regulation, so here we will focus specifically, and briefly, on one aspect that is, without a doubt, related to the mechanisms ..read more