Lorenz – Brussels Bishkek Geneva

Data Protection

• Lorenz lawyers have assisted a multi-billion dollar Fortune 500 company and global leader in pressure-sensitive technology with sales in over 90 countries and subsidiaries in several EU Member States in a comprehensive data protection audit covering 16 legal entities in 12 EU Member States and Switzerland with a main focus on HR. Lorenz lawyers assisted the client in performing the audit and has developed a number of different compliance measures. This included the preparation of agreements for international data transfers and other contractual clauses, such as for the outsourcing of certain data processing operations. Lorenz lawyers also assisted the client in the subsequent roll-out of the compliance tools and organised, among others, in-house training for the data protection officers.
• Lorenz lawyers have carried out a full data protection law audit for all the European entities of a leading Asian healthcare company. The audit covered 9 pre-enlargement EU Member States as well as Norway and Switzerland. Lorenz lawyers were responsible for performing the entire audit on behalf of the client. This included meeting and interviewing the relevant personnel of the different departments in each of the legal entities concerned. On the basis of the audit results, Lorenz lawyers developed a tailor-made compliance solution for the client, consisting of a bundle of specific measures, and Lorenz assisted the client in the implementation of these measures. For instance, Lorenz developed and prepared a compliance solution for the company’s intra-group transfers of personal data, including to Japan and the US. Lorenz lawyers has also prepared contractual clauses, including for the outsourcing of certain processing, as well as notices for the information of the individuals concerned and the notifications and authorisation requests to the relevant data protection authorities. Lorenz lawyers advised this client on the data protection law implications connected with the implementation of a whistleblowing scheme, including the appointment of external service providers, and have submitted the required notifications and/or authorisation requests in several Member States and is providing follow-up assistance.
• Lorenz lawyers have been providing advice for a world leading provider of charge and credit cards and travel services on a number of projects related to data protection law. For instance, in the e-HR project, the client wanted to centralise all its HR information in one database located in the US and operated by an American contractor. Although Lorenz lawyers had initially been consulted only on the legal implications of this project under Belgian law, they drew the client’s attention to requirements existing under other national data protection laws. As a consequence, the client adapted its policy EU-wide.
• Lorenz lawyers were responsible for advising a leading US-based multinational company on the notification and/or authorisation requirements under the national data protection laws of 48 different jurisdictions triggered by the collection, processing and transfer of personal data under a so-called “deferred prosecution agreement” between the client and the US Department of Justice.
• Lorenz lawyers advised a US-headquartered global marketer of consumer and commercial products with 35 legal entities in 17 EU Member States in a data protection compliance project for its HR and payroll systems. For this purpose, Lorenz lawyers examined the client’s processing of HR information, including the intra-group transfers of some of the data among certain entities in Europe and to the company’s headquarters in the US. Lorenz lawyers developed several compliance tools, including data transfer agreements and notification and authorisation requests to the national data protection authorities.
• Lorenz lawyers assisted the electronic payment industry in negotiations in order to help them secure the Guidelines for Terminated Merchant Databases approved by the Article 29 Working Party.
• Lorenz lawyers assisted a major US test centre provider on the use of the biometric devices in 9 EU countries.
• Lorenz lawyers advised the European authorities on subcontracting solutions for data processing services, on employee monitoring requirements and on the binding character of Binding Corporate Rules (“BCRs”).
• Lorenz lawyers audited the data processing practices of a GPS hardware vendor and developed an international data privacy program including international data transfers to China, Taiwan and the US.
• Lorenz lawyers assessed the information practices of a large Indian financial services provider and provided strategic advice on international data transfers between the Belgian and the UK entities and the Indian parent company and local data-warehouse service providers.
• Lorenz lawyers advised leading US marketing companies on securing their business models, specifically with regard to the collection and use of click-stream data for direct marketing companies.
• Lorenz lawyers provided specific and detailed advice to direct-marketing companies addressing the legal issues surrounding Pan-European marketing, including issues specific to telemarketing and e-marketing, as well as customer database management in the most legally compliant manner.
• Lorenz lawyers audited the HR and customer information practices of a large tobacco merchant and assisted with the implementation and roll-out of its privacy program in Europe;
• Lorenz lawyers provided strategic advice to a major US pharmaceutical group on data protection issues including employee e-mail monitoring and the transfer of product test information.
• Lorenz lawyers reviewed the HR information practices of the Benelux entities of the largest US health insurance company.
• Lorenz lawyers assisted with the development and roll out of a global data protection compliance programme of the largest US recruitment agent and human resources service provider company.