2023 Year in Review: The State and Impact of the GDPR

Overview of 2023 Year in Review: The State and Impact of the GDPR

Panelists introduce the GDPR and the background to its establishment, covering its far-reaching scope and exceptions. They describe 2023 developments including the E.U.'s move toward a centralized enforcement model, the criteria for penalties, and notable fines such as the record penalty against Meta, closing with expectations for the future and best practices.

What you’ll learn in 2023 Year in Review: The State and Impact of the GDPR

• Explain the GDPR's scope and exceptions
• Describe the 2023 shift toward centralized enforcement
• Identify the criteria for GDPR penalties
• Review landmark 2023 fines and best practices

Curriculum

1. 1. Overview of the General Data Protection Regulation (GDPR)

   The regulation, its background, scope, and exceptions.

   Locked

2. 2. How 2023 was Significant for the GDPR

   The move toward a more centralized enforcement model.

   Video coming soon

3. 3. GDPR Fines in 2023

   Penalty criteria and notable fines including the Meta penalty.

   Video coming soon

4. 4. Key Takeaways and What Lies Ahead

   Expectations for the future of GDPR and best practices.

   Video coming soon

Your instructors

Daniel B. Garrie

Founder, Law & Forensics; Neutral at JAMS; Faculty at Harvard

Law & Forensics LLC · JAMS · Harvard · Rutgers Law School · Journal of Law & Cyber Warfare

Daniel B. Garrie is the founder and executive managing partner of Law & Forensics LLC, a boutique cybersecurity and forensic engineering firm he co-founded in 2008. He serves as a neutral, arbitrator, and forensic special master at JAMS, focusing on cybersecurity, cryptocurrency, and complex technology disputes, and holds faculty appointments at Harvard and Rutgers Law School. A patented software inventor and prolific author, he is editor-in-chief of the Journal of Law & Cyber Warfare and a widely cited authority on computer forensics, eDiscovery, and cyber litigation.

K Royal

Global Chief Privacy Officer and Deputy General Counsel, Crawford & Company

Crawford & Company

K Royal is Global Chief Privacy Officer and Deputy General Counsel at Crawford & Company, where she is tasked with developing and implementing the company's privacy policies, designed to protect both client and company data. She has more than 25 years of experience in the legal and health-related fields. She holds a J.D. from the Sandra Day O'Connor College of Law at Arizona State University and a Ph.D., and is certified as a Fellow of Information Privacy (FIP), in Privacy Management (CIPM) and in US and EU privacy law (CIPP/US, CIPP/E), plus Certified Data Privacy Solutions Engineer (CDPSE) through ISACA. She co-hosts the Serious Privacy podcast. At Legal Cyber Academy she teaches on the New York DFS cybersecurity regulations and the GDPR.

Jarno Vanto

Partner, King & Spalding LLP

King & Spalding

Jarno Vanto is a partner in King & Spalding's Data, Privacy and Security practice in New York. He counsels multinational clients on privacy and cybersecurity regulatory compliance and investigations, AI governance, international transfers of personal data, and complex cross-border technology and data transactions, including data and software licensing, under regimes such as the EU General Data Protection Regulation, the California Consumer Privacy Act and the EU AI Act. He holds an LL.M. from New York University School of Law and a master of laws from the University of Turku, is admitted in New York, and holds the CIPP/US and CIPP/E certifications. He has been named to the 2026 Lawdragon 500 Leading Global Cyber Lawyers and to Cybersecurity Docket's Incident Response Elite. At Legal Cyber Academy, Jarno Vanto teaches on the state and impact of the GDPR.

Noshin Khan

Ethics and Compliance, NMC Healthcare

OneTrust

Noshin Khan works in ethics and compliance at NMC Healthcare in Abu Dhabi. She was previously Senior Compliance Counsel in the Ethics Center of Excellence at OneTrust, where her work focused on European and Middle Eastern regulation, including the European Whistleblower Protection Directive, the EU Artificial Intelligence Act, the Corporate Sustainability Due Diligence Directive, and France's Sapin II and duty of vigilance law. Before OneTrust she was a global compliance manager at Forensic Risk Alliance. She holds the CCEP-I and LPEC certifications, the CIPP/E, CIPM and FIP credentials from the IAPP, and a certificate in the ethics of AI from the London School of Economics and Political Science. At Legal Cyber Academy she teaches on the state and impact of the GDPR.