The European Data Protection Board (“EDPB”) has issued a note on how to approach overseas personal data transfers with the United Kingdom in case there would be a no-deal Brexit. No- Deal Brexit First of all what is understood under a no-deal Brexit? We explained that in our earlier post: what “a hard Brexit” actually meant. … More No-deal Brexit and Data Transfers. The EDPB issues a note of guidance.
Territorial scope of GDPR. Representative or DPO? We help answering that question for many of our clients. It is an important one because of the considerable fines that maybe imposed if a company gets it wrong. Article 3 of GDPR sets out the territorial scope of the Regulation: If the processing of personal data takes … More Territorial scope of GDPR – Representative or DPO?
In November 2018 Spanish Parliament adopted the new data protection act with a 93% positive vote. It adapts the Spanish legal framework to the General Data Protection Regulation and develops its topics. The Spanish Data Protection Agency issued a press release on the contents of the new Act. It further regulates issues like the rights … More The new Spanish Data Protection Act 2018
Almost 60,000 Data Breaches Reported since GDPR Implementation in May 2018 In the Netherlands 15,400 data breaches have been reported up to 29 January 2019; in Germany – 12,600; in the UK 10,600; and in Spain 670(!). To date, 91 reported fines have been imposed under the new GDPR regime. The highest GDPR fine imposed to date is €50 million, by … More Almost 60,000 Data Breaches since May 2018
Background The UK triggered Article 50 of the Treaty of the European Union on 29 March 2017. As set out under that treaty, the UK has two years to negotiate a Withdrawal Agreement and framework for a future relationship with the EU before the point of the UK’s exit from the EU at 11pm GMT … More Brexit – what does “hard Brexit” actually mean?
Do I need a representative? For many companies outside of the European Union it is not clear whether they need to appoint a representative for data protection purposes. You will NOT need to fulfill this requirement when: processing which is occasional, and does not include, on a large scale, processing of special categories of data as referred … More Art. 27 GDPR – Representatives of companies not established in the Union
Article 37 of the General Data Protection Regulation entails: If your company processes special (i.e. health data, religious data, racial data, criminal offences, etc) categories of information on a large scale you must appoint one and communicate the details of that Officer to the authorities. Article 37 of the General Regulation of Data Protection lays … More The Data Protection Officer (“DPO”). Do you need one?
GDPR Email Tsunami The wave of emails we have seen just before and after the coming into force of GDPR was exaggerated and not necessary. Consent for email marketing is already a requirement under European e-privacy law, which allows this type of marketing on an opt-out basis for existing customers. ePrivacy Directive Nowadays everybody seems … More Not even an email to ask consent…
Although multiple EU Member States are apparently not ready to enforce the GDPR. There are 2 days left though… Therefore many watchdogs lack powers because their governments have yet to update their laws to include the Europe-wide rules, a process that could take several months after GDPR takes effect on May 25. If you have … More GDPR – 2 days left
If you have any questions or doubts regarding your international set up and would like to discuss, we would be delighted to take a look and give our opinion. Do contact us without any obligation.
The General Data Protection Regulation (“GDPR”) establishes in its article 28 the rules around the “Processor”. The Processor processes Personal Data on behalf of the Controller. The Controller has a duty of diligence when selecting the Processor and has to be able to prove it has been diligent in its choosing. It should, logically, only … More The contractual relationship between Processor and Controller
If the General Data Protection Regulation (“GDPR”) is applicable to you, as of 25 May 2018 you will be obliged to inform the relevant authorities within 72 hours as of becoming aware of a data breach that you committed or your data processors on your behalf, unless the personal data breach is unlikely to result … More Data breach – the obligation to inform the authorities
The General Data Protection Regulation is about to come into force on the 28th of May 2018. We are getting a lot of requests for advice and notice that although companies are willing to comply, a lot of new details are generally not known. For example: you become are aware that you had a data breach. … More GDPR, the legal obligation to inform your customer.
Activities of a representative office Many American companies have doubts on whether a Representative office would be a good corporate legal form to start business in Spain. And how to establish it. A representative office is a fixed place of business set up by a foreign company. The Rep Office only pursues marketing or informational … More Establishing a Rep Office in Spain
Abac Capital acquires Heineken´s Beer & Food portfolio in Spain. Beer & Food was the brewer´s on trade division that included brands as Gambrinus, Indalo Tapas, La Chelinda and the Official Irish Pub and has approximately 400 outlets throughout Spain. Although the purchase price hasn´t been revealed it is said that the deal was worth … More Heineken sells Beer & Food, including Cruz Blanca, Gambrinus and the Carl´s Jr franchise
José María Aznar, Spain´s ex president of government is to leave DLA Piper. Aznar who studied law at Madrid´s Complutense university was a senior advisor for Latin America to the firm´s global committee. Big question apparently is whether he will follow his good friend Juan Picón, who left DLA Piper earlier to move to Latham … More Spanish ex president Aznar leaves DLA Piper after exit Juan Picon to Latham Watkins
This is not one of them. Contact us if you had any troubles with your airline on Spanish soil. We can help you with the legal issues even if you would have left the aircraft this way.
Temporary job surge over epiphany and advice on employment contracts … More Epiphany or Three Kings Day celebrations sparks surge in jobs
what will the elections bring and will it bring back the companies that left? … More 21 December 2017 – Regional Elections Catalonia
The GDPR has set a couple of new rules for privacy policies. One of those conditions is a necessary mention that data subjects (the people whose personal data is being processed) can seek support from their local data protection authority when dealing with a data controller or processor who is not being helpful when a … More GDPR – Rules for Privacy Policies
In the last couple of weeks more than 1,400 companies have changed their corporate addresses, leaving Catalonia and registered somewhere else (in Spain). The main driver behind these moves is the fear of future (legal and political) instability that the independence crisis might bring and already brought about. Although economic consequences are not to be … More Update on Catalonia: More than 1,400 companies changed corporate seats. Car maker SEAT might follow suit
Transfers of personal data to third countries outside the EU are only permitted where the conditions laid down in General Data Protection Regulation are met. In contrast to the current regime where sanctions for breaching transfer restrictions are limited, failure to comply with GDPR’s transfer requirements attract the highest category of fines of up to … More International transfers breaches fines
International contracting is often complicated by the fact that one of the parties, or sometimes both parties want to incorporate by all means standard conditions that might not at all be relevant. Almost always parties lose out of sight the balance between the value of the contract, the effort to get something on paper and … More International contracting is often complicated: let logic prevail
The new General Data Protection Regulation (“GDPR”) that will come into force in May 2018 requires companies that the accessibility of the Data Protection Officer (“DPO”) should be effective for Data Subjects and other players. To ensure that the DPO is accessible, the Working Party 29 (the cluster of European data protection authorities) recommends that … More Non EU companies should appoint a DPO in Europe
The Netherlands leads with reporting requirements on data leaks Germany and The Netherlands are the leaders in data protection in Europe. It means they are the front-runners in terms of reporting requirements on data leaks, Privacy Impact Assessments (an instrument for determining privacy risks of data processing in advance – PIA), the societal debate and … More Germany and The Netherlands, leaders in data protection in Europe
On the 3rd of October 2017 Oryzon announced it would relocate its management and administrative staff to Madrid (Statement). The reasons given are the optimisation of its operations and relations with investors. Although it does not mention the recent occurrences as a reason for the move, it does come straight after the referendum and the … More Independence, (legal) insecurity: Oryzon Genomics to leave Catalonia and move corporate HQ to Madrid
Applicable law and jurisdiction in Spanish contracts … More Choosing the applicable law international (Spanish) contracts
Time to move company address? The route Catalonia is about to take will lead to further uncertainty in the coming years. will Spain let this occur, if not what can it do? Will the European Union let Catalonia in whilst Spain has a veto? There are many, many questions unanswered and lots of possible scenarios … More Catalan independence – the uncertainty is the most worrying for companies
Principle: If a company in a certain member state renders services to another company in another member state, instead of the receiving company paying VAT on the received services, it has to withhold the VAT and pay it in its own country. The invoice it receives from the company that rendered the services should mention … More Reverse charge mechanism for VAT within Europe
The fact that our lawyers understand various languages has shown once again its value in a transaction where Flemish and Spanish lawyers were seeking for a efficient solution. The mere fact that their correspondence had to be translated every time, brought much delay into the case and took out the momentum. B.A.S. is able to … More The added value of understanding multiple languages with legal services
A wide variety of contracts, including franchising, distribution, agency, lease, sale, employment, executive, free lance, real estate, rental, shareholder and consultancy agreements have been drafted and reviewed by our lawyers over time. B.A.S. adds value in your contractual stages as it quickly grasps your needs, understands perfectly your language and works efficiently to getting … More In need of a Spanish or international contract?
Background It could happen to anyone a leak, a hack or a loss in their personal data storage system which imposes a risk to the rights and freedoms of natural persons. But how to react to a breach? Although probably everybody advocates transparency in data processing, the majority of reactions to such a breach is to … More The use of Data Breach and other Data Protection Policies
Now that the Spanish Constitutional Court has prohibited the referendum of October 1st, 2017, many companies in Catalonia are planning to move elsewhere in Spain in order to prevent getting mixed up in legal limbo. That the Catalonian government is serious on breaking with Spain can easily be deducted from the actual question subject of … More “Independent” Catalonia – moving your company to Madrid or elsewhere.
Do you have any doubts about the Spanish data protection regime and or the GDPR? Do you need your company to be compliant? We can help, we have experience in data protection for health care, insurance and other international industries. Do contact us if you would like more information on the subject. Business Advice Spain … More New (European) data protection legislation – GDPR
Do you need a In need of an N.I.E. or a C.I.F.? We can help you, easily. Obtaining a (tax) identification number (N.I.E. is for physical persons and C.I.F. for companies) is often necessary for all kinds of procedures in Spain. You will need one for example for buying real estate or starting a company. … More In need of an N.I.E. or a C.I.F.? We can help you
If you need an Apostille on your Spanish document, we will be happy to arrange it for you. Do contact us if you would like more information on the subject. Business Advice Spain is highly experienced in international corporate matters. It has helped American companies and their employees for the last 15 years establish themselves in Europe.