Last Month in Privacy: August 2021

China: NPC passes PIPL

We saw another comprehensive data protection law being adopted, and this time, in China, with its Personal Information Protection Law.

The passing of the PIPL follows the adoption of the Data Security Law, and imposes obligations on data controllers, such as the appointment of personal information protection officers, and includes provisions on conducting personal information protection impact assessments, as well as restrictions on international data transfers. The PIPL will enter into effect on 1 November.

You can find out more about how to comply with the PIPL here.

Brazil: ANPD addresses LGPD enforcements following entry into effect on 1 August 2021

In Brazil, the LGPD's provisions relating to fines came into force on 1 August, following the commencement of all other articles in September 2020.

The Brazilian data protection authority released a series of FAQs related to the commencement of the application of sanctions and fines under the LGPD, and address several topics, such as:

• the types of sanctions, fines, or penalties that can be applied by ANPD;
• that the ANPD will not apply sanctions related to incidents that occurred before 1 August 2021, but that it can apply to continuing offences initiated before 1 August 2021; and
• how the fines will be calculated.

Read more here.

UK: ICO launches public consultation on draft IDTA, TRA tool, and international transfer guidance

In the UK, the ICO launched a public consultation on its proposals for a draft international data transfer agreement as well as transfer risk assessments.

The ICO outlined that the IDTA is a contract that organisations can use when transferring data to countries not covered by adequacy decisions and that it will replace the current SCCs to take into account the CJEU's decision in Schrems II. The draft IDTA includes guidance on how to complete the IDTA, frequently asked questions, and guidance templates. The TRA tool provides three steps on how to carry out the TRA in a structured manner, which are accompanied by guidance and decision trees.

Comments can be submitted until 7 October 2021.

Read more here.