2015

"Russia 's new data localization law, Federal Law No. 242-FZ, an amendment to Russia 's On Personal Data Law goes into effect on September 1, 2015 and it may have wide reaching implications on firms that collect personal information from Russian citizens, even if those companies are not located in Russia. The law requires ""operators"" to collect, store, and process Russian citizens ' personal data using databases located within Russia. Since the law does not explicitly exempt foreign companies from its requirements, companies outside of Russia should assume that Russia 's Roskomnadzor, the state body that oversees Telecommunications, information technology, and mass communication will interpret the law to apply equally to foreign companies that collect, store, and|or process the personal data of Russian citizens."

Brazilian law places non-statutory limitations on an employer 's ability to seek background checks for employment purposes, including criminal record checks, consumer credit checks, or driving record checks. Denial of employment based on information solely contained in a background check, however, is warranted only if that information suggests a candidate 's working capacity, safety, or reliability would be materially impaired. A 2004 ruling by the 2nd Regional Labor Court determined that no worker may be fired solely based on the fact that they have an open file in a Credit Protection Service. Otherwise, an employer could face liability for discrimination. A candidate must expressly consent to undergo a background check. An applicant who refuses to consent to a medical examination however may lawfully be denied employment. The individual right of intimacy guaranteed by the Brazilian Constitution obligates employers to safeguard the confidentiality of all records relating to background checks.

"Schrems will take part in the breakout session, ""Safe Harbor Postmortem: Schrems Reflects,"" during the IAPP Europe Data Protection Congress in Brussels.

He 'll be joined by European Parliament Senior Policy Advisor Ralf Bendrath, American Express Global Privacy Officer Kasey Chappelle, Hogan Lovells Partner Eduardo Ustaran, CIPP|E, and the IAPP 's Omer Tene. It will be very hard to come up with a solution that addresses all problems identified by the Court, given the U.S. position. It also seems questionable if a ""Safe Harbor 2.0"" will have real benefits for U.S. controllers in practice compared to transfer methods under Art 26 of Directive 95|46.

Minding that the two parties have debated for two years to not even get the very weak ""13 recommendations"" program by the European Commission done, it seems a switch to ""alternative"" transfer methods under Art 26 will be more reasonable than hoping for a Safe Harbor 2.0."