January

The European Commission unveiled two draft Commission Implementing Decisions that propose amendments to whether a third country provides adequate safeguards to protect personal data.

Countries deemed to be adequate to protect consumer are added to the Commission's "white list," thus data transfers can be made from the EEA to that country without requiring further safeguards. The Commission 's move to amend the decisions follows the ruling of the Schrems case, where activist Max Schrems has argued that the EU 's "Privacy Shield" does not safely protect Europeans from U.S. mass surveillance.

Citizens in France can now take class action when their data protection has been violated.

The new Act allows for class actions for discriminations, health, environment and data protection. The Act has a limited list of organizations that will be able to take actions on behalf of individuals, provided that individuals suffer damage as a consequence of a data protection breach. Under the Act, businesses will now be scrutinized on their data protection activities and then sued before courts, especially by consumer associations and trade unions.

Overall, the new Act will include entail a significant increase in reputational risk for companies.

Hungary's Authority for Data Protection and Freedom of Information issued new guidance on the lawful use of employee photos.

An employee photo can only be taken or processed lawfully if there is a specific underlying purpose, for example, as needed for a workplace ID card. For group or event photos, it may not be necessary to obtain consent for the publication of photos on a website if the photos are taken of employees who attend an open, work-related event and the "image is not unique".

Employers should investigate whether a photo qualifies as a "crowd shot". If not, then consent from the relevant person must be obtained before publishing.