Data Protection in Hannover. Turning rules into processes.

Anyone processing data on your behalf needs an agreement for it, in place before the processing begins. Where it is missing, that is a breach carrying a fine in its own right, whether or not anything has gone wrong.

• Processor agreements, and review of the forms put forward by the provider
• Drawing the line between processing, joint controllership and acting in one own right
• Joint controllership arrangements, for instance for audience measurement on social networks
• Control of sub-processors and supplier audits
• The underlying cloud and SaaS agreements are drafted by our practice area IT Law

As soon as a supplier sits outside the EU, or has access from there, the transfer needs a basis of its own. An adequacy decision can fall away, so a fallback belongs in the contract.

• Reviewing the transfer routes, including remote access from a third country
• EU standard contractual clauses and the transfer impact assessment that goes with them
• Reliance on adequacy decisions, including the Data Privacy Framework
• Binding corporate rules within a group
• The international supply and services agreements behind them are handled by our practice area Commercial Law

Where processing carries a high risk, the GDPR requires an impact assessment before it starts. With AI, the training data, the outputs and the intellectual property have to be assessed separately.

• Risk analysis and data protection impact assessment, including consultation with the authority
• Assessment of AI systems, profiling and automated decisions
• Legal bases for using existing data holdings for new purposes
• Anonymisation and pseudonymisation as a route out of the scope of the rules
• Rights in training data and in outputs are reviewed by our practice area Intellectual Property

The 72 hours run from awareness, not from the end of the investigation. A report that says openly what is still unclear is therefore better than a complete one that comes late.

• Assessing whether the breach is notifiable and preparing the report to the authority
• Informing the individuals concerned where the risk is high, and in what form
• Internal documentation of breaches that are not notifiable as well
• Acting in regulatory and fine proceedings, including the hearing
• Whether the cyber policy covers the loss is checked by our practice area Insurance Law

In the HR function data protection and employment law meet directly. Access requests often arise out of a live conflict, so the answer has to fit the employment position in substance and in tone.

• Recruitment, retention periods and the handling of rejections
• Subject access requests, including the limits where the right is invoked abusively
• Erasure, rectification and objection, including after the employment has ended
• Monitoring at work, works agreements and the limits of surveillance
• The employment law side of these cases is led by our practice area Employment Law