Adam Finlay

Jan 10, 2025 | mondaq.com | Adam Finlay |Darragh Murphy |Josh Hogan |Clare Gillett

On 4 December 2024, the ESAs published a Statement on theApplicability of DORA informing entities that there will be notransitional period and to be prepared for DORA by 17 January2025. The Digital Operational Resilience Act(“DORA”) together with the technicalstandards and guidelines adopted under it will apply from 17January 2025.

Nov 25, 2024 | mondaq.com | Josh Hogan |Darragh Murphy |Clare Gillett |Adam Finlay

In-scope firms (such as investment firms, insurance undertakings, management companies, credit institutions, crypto-asset service providers, payment institutions and electronic money institutions) must comply with the Digital Operational Resilience Act ("DORA") by 17 January 2025. As well as imposing requirements on financial entities, DORA also imposes requirements on ICT third-party service providers.

Jan 29, 2024 | lexology.com | Adam Finlay |Paul Lavery

Data Protection Day presents an opportunity to reflect on the current state of play and to consider what’s approaching. In this context, the European Commission’s press release on 26 January and the EDPB’s recently published report on the Designation and Position of Data Protection Officers provide useful indicators.

Nov 22, 2023 | lexology.com | Catherine Walsh |Adam Finlay

On 14 November 2023, the European Data Protection Board (EDPB) published proposed Guidelines on the Technical Scope of Article 5(3) of the ePrivacy Directive for public consultation. These include some potentially contentious interpretations and will be of particular interest to anyone who uses established or new tracking techniques, especially for adtech purposes. The EDPB cites Article 70(1)(e) of the GDPR as its basis for adopting these Guidelines.

Apr 20, 2023 | lexology.com | Adam Finlay

Article 15(1)(c) of the General Data Protection Regulation (“GDPR”) provides a right for the data subject to access information about “the recipients or categories of recipient to whom the personal data have been or will be disclosed”. A recent decision from the Court of Justice of the European Union (“CJEU”) has shed further light on what is expected of data controllers when supplying this information upon receipt of an access request.