Skip to main content
Menu Icon

InfoBytes Blog

Financial Services Law Insights and Observations


Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.

  • U.S. messaging service fined €5.5 million for GDPR violations

    Privacy, Cyber Risk & Data Security

    On January 19, the Irish Data Protection Commission (DPC) announced the conclusion of an inquiry into the data processing practices of a U.S.-based messaging service’s Ireland operations and fined the messaging service €5.5 million. The investigation was part of a broader GDPR compliance inquiry prompted by a May 25, 2018 complaint from a German data subject.

    The DPC noted that in advance of the date on which the GDPR became effective (May 25, 2018), the U.S. company updated its terms of service and notified users that, to continue accessing the messaging service, they would need to accept the updated terms by clicking “agree and continue.” The complainant asserted that, in doing so, the messaging service forced users to consent to the processing of their personal data for service improvement and security. 

    The company claimed that when a user accepted the updated terms of service, the user entered into a contract with the company. The company therefore maintained that “the processing of users’ data in connection with the delivery of its service was necessary for the performance of that contract, to include the provision of service improvement and security features, so that such processing operations were lawful by reference to Article 6(1)(b) of the GDPR (the ‘contract’ legal basis for processing).” The complainant argued that, contrary to the company’s stated intention, the company was “seeking to rely on consent to provide a lawful basis for its processing of users’ data.”

    The DPC issued a draft decision that was submitted to its EU peer regulators (Concerned Supervisory Authorities or “CSAs”). The DPC concluded that the company was in breach of its GDPR transparency obligations under Articles 12 and 13(1)(c), and stated that users had “insufficient clarity as to what processing operations were being carried out on their personal data.” With respect to whether the company was obliged to rely on consent as its legal basis in connection with the delivery of the service (including for service improvement and security purposes), the DPC disagreed with the complainant’s “forced consent” argument, finding that the company was not required to rely on user consent as providing a lawful basis for its processing of their personal data.

    Noting that DPC had previously imposed a €225 million fine against the company last September for breaching its transparency obligations to users about how their information was being disclosed over the same time period (covered by InfoBytes here), the DPC did not propose an additional fine. Six of the 47 CSAs, however, objected to the DPC’s conclusion as to the “forced consent” aspect of its decision, arguing that the company “should not be permitted to rely on the contract legal basis on the basis that the delivery of service improvement and security could not be said to be necessary to perform the core elements of what was said to be a much more limited form of contract.”

    The dispute was referred to the European Data Protection Board (EDPB), which issued a final decision on January 12, where it found that, “as a matter of principle, [the company] was not entitled to rely on the contract legal basis as providing a lawful basis for its processing of personal data for the purposes of service improvement and security,” and that in doing so, the company contravened Article 6(1) of the GDPR.

    The DPC handed down a €5.5 million administrative fine and ordered the company to bring its processing operations into compliance with the GDPR within a six-month period. Separately, the EDPB instructed the DPC “to conduct a fresh investigation” that would span all of the company’s processing operations to determine whether the company is in compliance with relevant GDPR obligations regarding the processing of personal data for behavioral advertising, marketing purposes, the provisions of metrics to third parties, and the exchange of data with affiliated companies for the purpose of service improvements.

    The DPC challenged the EDPB’s decision, stating that the board “does not have a general supervision role akin to national courts in respect of national independent authorities, and it is not open to the EDPB to instruct and direct an authority to engage in open-ended and speculative investigation.” The DPC suggested that it is considering bringing an action before the Court of Justice of the European Union to “seek the setting aside of the EDPB’s direction.”

    Privacy, Cyber Risk & Data Security Of Interest to Non-US Persons Ireland Enforcement Consumer Protection EU GDPR

  • OFAC sanctions Ireland-based criminal organization and members

    Financial Crimes

    On April 11, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Order 13581 against an Ireland-based crime group, which OFAC considers “a murderous organization involved in the international trafficking of drugs and firearms,” seven of its key members, and three companies controlled or owned by key members of the organization. According to OFAC, the sanctions were the result of a collaborated effort between OFAC, the Drug Enforcement Administration, the U.S. Department of State, U.S. Customs and Border Protection, Ireland’s national police force (An Garda Síochána), the United Kingdom’s National Crime Agency, and the European Union Agency for Law Enforcement Cooperation. As a result of the sanctions, all assets belonging to the designated persons that are in the U.S. or in the possession or control of U.S. persons must be blocked and reported to OFAC. U.S. persons are generally prohibited from engaging in dealings involving any property or interests in property of the blocked or designated persons.

    Financial Crimes OFAC Department of Treasury Of Interest to Non-US Persons OFAC Sanctions OFAC Designations SDN List Ireland

  • Irish DPC releases annual report

    Privacy, Cyber Risk & Data Security

    On February 24, the Irish Data Protection Commission (DPC) released their 2021 Annual Report. According to the report, the EU’s General Data Protection Regulations (GDPR) enforcement efforts have gained “significant momentum” by, among other things: (i) “resolving thousands of complaints”; (ii) “processing thousands more data breach notifications”; (iii) “imposing fines and corrective measures”; (iv) “auditing the gamut of Irish political parties”; and (v) “settling its enforcement action in relation to certain processing elements of the Public Services Card on terms protective of the data rights of citizens generally.” Among other things, the report discussed new data regulation regimes, such as the Digital Markets Act, the E-Privacy Regulation, and the Artificial Intelligence Act, “which demonstrate that the GDPR was never going to resolve all data issues in one single legislative instrument.” The report also outlined the DPC’s regulatory strategy for the next five years, which it released in December and includes placing a focus on mounting “targeted actions aimed at ensuring children and more vulnerable internet users are protected in personal data terms—without shutting off their access.”

    Privacy/Cyber Risk & Data Security GDPR Ireland Of Interest to Non-US Persons

Upcoming Events