1In October 2019, the California Attorney General issued Proposed Regulations under the California Consumer Privacy Act of 2018 ('CCPA') intended to provide practical guidance to consumers and businesses. The California Governor, signed, in October 2019, a series of bills which amended the CCPA. The Californians for Consumer Privacy, Board Chair, Alastair Mactaggart, announced in September 2019 that he filed an initiative on the November 2020 ballot for the California Privacy Rights and Enforcement Act.

CCPA

7In Nigeria, the National Information Technology Development Agency issued the Nigeria Data Protection Regulation 2019. In Uganda, the Data Protection and Privacy Act, 2019 entered into force. The President of the Republic of Kenya, signed, on 8 November 2019, the Data Protection Bill 2019 into law. In October 2019, the O�cial Gazette of the Togolese Republic published Law No. 2019-014 Relating to the Protection of Personal Data.

6In Thailand, in May 2019, the Personal Data Protection Act and the Cybersecurity Act entered into force. In Indonesia, in October 2019, Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions, revoking Government Regulation No. 82 of 2012 became e�ective. In India, the Rajya Sabha, Council of States passed the Aadaar and Other Laws (Amendment) Bill, 2019 and the Personal Data Protection Bill, 2019 was listed on the parliamentary agenda. New Zealand Parliament passed the Privacy Bill at second reading.

APAC

AFRICA8

In Brazil, the President promulgated, in July 2019, Law No. 13.853 of 8 July 2019, Amending Law No. 13.709 of 14 August 2018 ('LGPD'), to Provide for the Protection of Personal Data and for the Creation of the National Data Protection Authority, and Other Provisions. In October, a bill seeking to amend the entry into force of the LGPD to 15 August 2022 was introduced to the Chamber of Deputies.

LATIN AMERICA

9In Dubai, the Dubai International Financial Centre announced that it had launched a public consultation on a draft data protection law to replace the Data Protection Law DIFC Law No.1 of 2007. In February 2019, the Dubai Health Authority enacted Federal Law No.2 of 2019 regulating the collection, processing and transfer of electronic health data. In Bahrain, on 1 August 2019, Law No. (30) of the Year 2018 Issuing a Law on the Protection of Personal Data entered into force.

MIDDLE EAST

10On 30 September 2019, the Data Protection Law, 2017 (Law 33 of 2017) entered into e�ect in the Cayman Islands. In Barbados, the House of Assembly passed, in August 2019, the bill for the Data Protection Act, 2019, following its approval by the Senate. In July 2019, the Jamaica Information Service announced that the Minister of Science, Energy and Technology had provided an update on the bill for the Data Protection Act, 2017 ('the Bill') and that the Bill is before Parliament.

CARIBBEAN

3Data protection authorities across Europe have issued guidance on preparing for Brexit, whether it be in relation to deal or no-deal, focusing on issues including international data transfers, European representatives and EU regulatory oversight. The European Commission published, in September 2019, a Brexit preparedness checklist for companies doing business in the EU. In July 2019, the European Data Protection Supervisor published its Information Note on International Data Transfers after Brexit.

BREXIT 4All Member States apart from Slovenia have adopted national legislation implementing the GDPR. The Information Commissioner in Slovenia released, on 9 September 2019, its opinion on the draft Personal Data Protection Act. A number of enforcement actions have been issued since the introduction of the GDPR by data protection authorities in the EU including in relation to violations of Articles 6, 12, 13, 25 and 32 of the GDPR.

GDPR

5On 18 May 2018, the Council of Europe adopted the Protocol (CETS No. 223) ('the Protocol') amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) ('Convention 108'). Following its introduction, over 20 countries have signed the Protocol.

PROTOCOL AMENDING CONVENTION 108

2In July 2019, the French data protection authority adopted new guidelines on cookies and other online trackers as part of its 2019-2020 action plan on targeted advertising. The UK Information Commissioner's O�ce also released its new guidance on the use of cookies, as did the Spanish Data Protection Authority in November 2019.

COOKIES

DATA PRIVACY IN 201910 MOMENTS THAT SHAPED THE YEAR

Find more information and sign up for a free trial at dataguidance.com

1

2

3 45

67

910

8