Compliance does not end with documentation.

• The new DPIA template
• Digital Omnibus V3 - putting it into practice

• Third-party marketing
• Section 116 of the Electronic Communications Act (direct marketing, unsolicited communication)
• The right of access to data vs. AI

• The GDPR as the foundation for the AI Act - how to build on what you already have
• An overview of the links between the GDPR and the AI Act (DPIA ↔ FRIA, accountability ↔ traceability)
• A practical checklist and template for a combined DPIA/FRIA
• Recommendations for implementing the AI Act effectively in practice

• Proportionality tests - practical case studies
• Data subject rights
• News from decisions

• Risk management - practical examples
• Benefit and loyalty programmes

• New methodologies for processors
• New methodologies for applying legitimate interest
• Meeting information duties and the requirements for them - experience from practice

• Conversion API - how CAPI works from the data protection perspective and the possible risks
• Joint controllership in a group of undertakings: criteria, demonstrating compliance, setting up processes, legal reasoning and case law

• Information duties and how they differ - how much detail to give
• Consents and the duties that follow from them - tracking publication deadlines
• The DPO's control activities - formal requirements
• Connecting cyber security and personal data protection duties
• AI news and the shift in process management

• Information duty under Articles 13 and 14 of the GDPR
• Security of information systems under the GDPR - a practical walkthrough, the processor's contractual duties, DPO checks at both the controller and the processor
• Risk management, records, responsibilities and mitigations

• A camera system inside a camera system
• The DPO's control activity (the DPO does not create, the DPO advises, guides and checks)
• Building a data protection culture in the organisation
• Identifying, analysing and evaluating data protection risks
• Creating and implementing a data protection policy
• Legal bases for competitions and prize draws
• St Nicholas events and data processing

• Cookies - conditions, inspections, guidance, fines in Slovakia and Czechia
• Principles of processing personal data - when, where and how?
• The employer's control mechanism
• Artificial intelligence and data privacy
• Appeals against decisions

• The latest guidance and experience with cookie banners from the perspective of the EDPB working group
• A look back at the Do-not-contact list of the regulatory authority
• What marketing consent must contain
• Processing data from public registers
• Facebook - infringements and fines from supervisory authorities
• Providing a call centre recording under the right of access

• The balancing test as a document demonstrating compliance with the Regulation
• Where else may or must we use a balancing test besides legitimate interest?
• Arguments and techniques for assessing the impact on the rights and freedoms of individuals
• What is new in data protection - selected cases from enforcement and decision-making practice

• Informing employees about internal company rules in the light of current case law
• Is permanent access to documents enough to meet the duty to inform the employee?
• How to inform an employee about the processing conditions in line with both the Labour Code and the GDPR

• Targeted advertising seen from the other side - the impact on rights and freedoms
• Legitimate interest or consent?
• The story of one cookie bar - rethinking direct marketing, cookies and advertising under the new legislation
• TIA - transfer impact assessment for transfers of personal data to third countries

• Cookies - everything you ever wanted to know about them
• Use, settings, the technical and the legal side
• Current legislation, case law and upcoming rules in Slovakia and the EU
• Cookies and the GDPR - how to inform data subjects correctly and which legal basis to use

• Workplace monitoring - the Labour Code provision explained and how it connects to the GDPR
• What it means for the employer, how to prepare, and duties towards employee representatives
• Practical experience from the inspection and decision-making practice of the data protection authority - how to defend yourself effectively and prepare for an inspection

The discussion produced the document Expert opinion on the processing of personal data under the adopted anti-epidemic measures. Our thanks to the authors: Tatiana Valentová, Nada Rostek, Ivan Makatura, Branislav Cigánik, Miroslav Ilavský, and to everyone who took part.

• Discussion on processing personal data under the adopted anti-epidemic measures
• Output: Expert opinion on the processing of personal data under the adopted anti-epidemic measures

• Collective employment relationships
• Trade union membership, exercise of special rights, collective agreements, biometrics
• Demonstrating that the employer meets its duties towards employees from the data protection perspective
• Regulating access to personal data vs. authorising a person under Article 29 of the GDPR

• Archiving in the public interest vs. aligning retention periods under the GDPR
• Selected decisions of supervisory authorities, inspection results and enforcement practice
• The invalidation of the Privacy Shield (Schrems II) - discussion with expert guest Ján Golais (Judicium)
• Applying the archives and records act - how to set a retention period in line with the data minimisation principle

• Data protection by design and by default under Article 25 of the Regulation - implementation and monitoring in practice
• The basic criteria for protection by default and how to tell them apart from protection by design
• The controller's duty to demonstrate the measures and safeguards implemented
• Reviewing the effectiveness of the chosen measures and safeguards

• Collective employment relationships
• May an employer process personal data on trade union membership?
• Selected current issues from the Labour Code

• The balancing test
• Information duty under Articles 13 and 14
• Legal bases and lawfulness of processing

• Providing cloud services from the perspective of the legal aspects of the GDPR