Data Protection, Technology & Cyber Bulletin January 2023

• Jurisdiction: European Union,Ireland
• Law Firm: Matheson
• Subject Matter: Privacy, Data Protection
• Author: Ms Deirdre Crowley, Michael Byrne, Davinia Brennan, Rory O'Keeffe, Samuel Elliott, Thomas Condon, Billy Casserly, Kevin Seery, Rhona Barry and Ciara McGarvey
• Published date: 09 March 2023

Brought to you by Matheson's Digital Economy Group ("DEG"), this latest edition focuses on trends in relation to data breach notifications as well as highlighting the key enforcement themes coming out of Data Protection Commission ("DPC") regulatory inquiries. It also looks at a recent significant judgement by the Court of Justice of the European Union ("CJEU") with regards to the 'Right to be Forgotten' and highlights the major changes in Irish media regulation. Looking ahead then, this update takes a closer look at what is on the horizon for NFTs in 2023 and outline the top three key trends to look out for in the AI space this year. Outlined below is a summary of the key insights included in this bulletin. To read more about the trends and developments you can access the full Bulletin here.

Data Breach Notifications – Capsule Update

2022 was a record year for GDPR fines across Europe, with reported fines exceeding €1.6bn. That said, there is evidence of data breach reporting numbers levelling off. Deirdre Crowley, Partner, examines why and shares predictions on data breach reporting for the year ahead.

Read the full update here

GDPR Regulatory Inquiries – Key Enforcement Trends

Targeted behavioural advertising, processing children's data, use of AI technologies and effective data governance are key legal issues attracting supervisory authorities attention across the EEA, the UK, Norway, Iceland and Liechtenstein. Deirdre Crowley, Partner, assesses key enforcement trends and offers predictions for 2023.

Read the full update here

Recent Judgement: Right to be Forgotten

In the recent case of TU, RE v Google, the CJEU ruled that data subjects may seek removal of manifestly inaccurate material from search engine results in accordance with the established 'right to be forgotten' arising under the General Data Protection Regulation ("GDPR"). The CJEU first recognised the right of data subjects to seek the removal of outdated, irrelevant or no-longer-relevant information from search results in the Google Spain case in 2014. The right was subsequently codified in Article 17 of the GPDR4. Michael Byrne, Partner, explores the implications of this significant judgment by the CJEU.

Read the full update here

Major Changes to Irish Media Regulation

The Online Safety and Media Regulation Act 2022 (the "OSMR Act") was signed into law on 10 December 2022 by President Michael D. Higgins. The OSMR Act has been described as a crucial piece of legislation which aims to...