IAPP-2020年全球数据立法预测报告（英文）-2020.3-18页_2mb

2020 Global Legislative Predictions Summary

Core Content

The 2020 Global Legislative Predictions report outlines the anticipated developments in privacy and data protection laws across various countries. It highlights the trend of increased regulatory focus and enforcement, with many nations aiming to align their legal frameworks with international standards, particularly the EU General Data Protection Regulation (GDPR). The report includes contributions from privacy professionals in different regions, emphasizing the importance of data protection in the context of technological advancements and evolving digital practices.

Main Countries and Their Predictions

Argentina

• Personal Data Protection Bill (PDPB): Expected to be approved in 2020, based on GDPR principles.
• Key Provisions:
  • Obligation for public authorities and large-scale data processors to appoint Data Protection Officers (DPOs).
  • New principles such as accountability and data minimization.
  • Extraterritorial applicability of the law.
• Impact: A significant step forward in Argentina's data protection landscape.

Belgium

• Belgian Data Protection Authority (DPA): Will finalize its five-year strategy, focusing on sectors like telecommunications, media, and public services.
• Enforcement: Increased enforcement is anticipated, with possible stricter sanctions and more attention to procedural compliance.
• NIS Directive: Stakeholders await royal decrees to formally designate operators of essential services.

Brazil

• LGPD (General Data Protection Law): Approved in 2018, expected to be implemented in August 2020.
• Challenges:
  • Delays in implementation due to lobbying efforts.
  • Ongoing discussions about law amendments, particularly regarding penalties and automated decision-making.
• Recommendation: Companies should not delay starting adequacy programs and should prepare for the law's enforcement.

Canada

• PIPEDA Revisions: The federal government is moving towards aligning PIPEDA with GDPR, including data portability, right to erasure, and stronger enforcement powers.
• Privacy Act Modernization: Efforts to update the outdated federal Privacy Act are ongoing.
• Political Uncertainty: A minority Liberal government may lead to shifts in privacy reform priorities, with the New Democratic Party (NDP) likely to influence future changes.

Chile

• Constitutional Discussions: 2020 is expected to focus on constitutional debates and social security reforms.
• Privacy Initiatives: Potential progress on updating the computer-related crime law and sectoral norms for incident reporting in the banking and financial services industry.
• Cybersecurity Bill: Postponed from 2019, unlikely to be discussed in 2020.

China

• Personal Information Protection Law: Expected to be revised and submitted to the National People's Congress for review in 2020.
• Critical Information Infrastructure (CII) Regulations: Updates on draft regulations are anticipated.
• MLPS 2.0 and Cryptography Law: Implementation of MLPS 2.0 and enforcement of the Cryptography Law will continue in early 2020.
• Standards: The Personal Information Security Specification is expected to be finalized in 2020.

Colombia

• Data Protection and Privacy Convergence: The Superintendent of Industry and Commerce is a key player in aligning with EU standards.
• EU-Colombia Data Flow: Colombia aims to establish a modern partnership with the EU to facilitate data flows while maintaining adequate protection.
• Accountability Principle: Organizations must demonstrate compliance with data protection standards for transfers to third parties.

Cyprus

• Schengen Accession: Evaluation of personal data protection infrastructure will continue in 2020.
• Schengen Information System (SIS): Coordination with EU standards and implementation of best practices is a priority.
• Whistleblower Protection: Synchronization with the new EU Directive on whistleblower protection is expected.
• Telecom Surveillance Law: Amendments to enable surveillance of private communications for security and crime prevention are anticipated.

Czech Republic

• GDPR Implementation: Continued focus on aligning sectoral laws with GDPR.
• Bank ID and E-Health: Draft laws for bank ID and e-health are under consideration, with expected implementation in 2021 and 2020 respectively.
• Civil Code Amendment: Draft amendment to allow payment with personal data for digital content is under review, though criticized by the DPA.

Denmark

• GDPR Enforcement: The DPA is expected to issue its first administrative sanctions and fines under the GDPR in 2020.
• Safety Package: Reintroduced in January 2020, focusing on increased public space video surveillance.
• ePrivacy Directive: Ambiguities remain, and similar legal cases may continue until the ePrivacy Regulation is finalized.

France

• CNIL Enforcement: Increased scrutiny and enforcement of GDPR compliance, particularly in video surveillance and facial recognition.
• Voter Data Protection: Action plan to protect voter data during municipal elections.
• Data Mining for Tax Fraud: New measures to collect and use social media data for detecting tax fraud, with CNIL cautioning about privacy and freedom of expression concerns.

Germany

• Second EU Data Protection Act: Full impact expected in 2020, aligning over 153 laws with GDPR.
• DPO Threshold: Raised from 10 to 20 employees involved in data processing.
• New Derogations: For processing special categories of data based on public interest.
• Digital Healthcare Act: Expected to enter into force in 2020, promoting health apps and secure data networks.
• IT-Security Law 2.0: Uncertain adoption in 2020, but expected to expand critical infrastructure sectors and enhance the role of the Federal Office for Information Security.

Greece

• HDPA Expansion: Doubling the number of investigators to focus on high-risk sectors.
• Regulatory Strategy: Drafting a new strategy for 2020–2025, with public consultations planned.
• Legal Discrepancies: HDPA may issue an opinion on Law no. 4624/2019, highlighting discrepancies with GDPR.

India

• Personal Data Protection Bill (PDPB): Expected to be passed in 2020 after scrutiny by a joint select committee.
• Key Features:
  • Based on a "Fourth Way" approach to privacy.
  • Includes data localization and broad exemptions for state security.
• Public Debate: Expected to continue around balancing privacy rights with state interests.
• DNA Technology Regulation: Expected to be passed in 2020.
• Facial Recognition System: May require separate legislation.

Ireland

• Schrems II Case: Anticipated ruling in 2020 on the validity of Standard Contractual Clauses (SCCs).
• Regulatory Strategy: Drafting a new strategy for 2020–2025, with public consultations ongoing.
• Enforcement: First administrative sanctions and fines under GDPR expected early in 2020.
• Election Impact: Possible ministerial changes and new roles for data protection and business ministers.

Israel

• GDPR-like Law: Not expected in 2020, but efforts to strengthen the Privacy Authority and amend the Privacy Law continue.
• Credit Data Law: Already in effect, impacting financial privacy.
• Health Data Research: Draft regulations for secondary use of health data are under discussion.
• Cyber Protection Bill: Expected to be enacted in 2020, granting the National Cyber Security Directorate access to private company data.

Key Information

• Global Trend: Most countries are increasing regulatory focus and enforcement efforts in 2020.
• GDPR Influence: Many nations are drawing inspiration from GDPR, either by adopting similar laws or aligning existing ones.
• Technological Challenges: Facial recognition, data localization, and the use of personal data for payment are key issues.
• Enforcement and Sanctions: Increased scrutiny and potential for higher fines are anticipated, especially in GDPR-compliant jurisdictions.
• Public Consultation: A common theme is the use of public consultations to shape new regulations and ensure alignment with international standards.
• Political Uncertainty: In some countries, such as Canada and India, political dynamics may influence the pace and direction of data protection reforms.