GENERAL DATA PROTECTION REGULATION Archives

Matson’s Daniel K. Inouye was the first Tier III vessel to regularly call at the port, producing 80% less nitrogen oxide emissions than older vessels

First announced in January by C40 Cities, the ports of Shanghai and Los Angeles, and key maritime stakeholders, this green shipping corridor will be a big step toward decarbonising shipping between the busiest ports in China and the United States.

C40 Cities is a network of cities that are working to deliver the urgent action needed to confront the climate crisis and intends to achieve these goals by developing a “Green Shipping Corridor Implementation Plan” by the end of 2022 that will include deliverables, goals and interim milestones, and roles for participants.

The green shipping corridor partnership decarbonisation goals include:

The phasing in of low, ultra-low, and zero-carbon fuelled ships through the 2020s with the world’s first zero-carbon transpacific containerships introduced by 2030 by qualified and willing shipping lines
The development of best management practices to help reduce emissions and improve efficiency for all ships using this international trade corridor
Reducing supply chain emissions from port operations
Improving air quality in the ports of Shanghai, Los Angeles and Long Beach, and adjacent communities.

“This initiative builds on important efforts our port participates in, including the World Ports Climate Action Program, an international commitment to develop projects to address global warming and meet the goals outlined in the Paris Agreement,” Mario Cordero, Port of Long Beach Executive Director, commented.

“It also complements the Clean Air Action Plan and supports our shared goals to reduce carbon emissions and advance technologies, especially for vessels, which are our largest source of emissions.”

“Accelerating efforts to decarbonise the shipping sector is urgent if we are to limit global heating to 1.5 degrees Celsius,” C40 Executive Director Mark Watts said. “By convening a powerful coalition that includes the San Pedro Bay ports complex, the Port of Shanghai and key maritime industry stakeholders, we hope to be an important catalyst in decarbonizing supply chains of all kinds around the world, while also creating a replicable model for other port cities to follow.”

Berge Bulk and Kongsberg Maritime set up a joint development initiative to advance marine decarbonisation technologies.
The goal is to identify and test emerging decarbonisation technologies and advance the integration of emerging and existing technologies into deployable marine solutions.

SINGAPORE, June 7, 2022 /PRNewswire/ — Singapore-based dry bulk owner Berge Bulk and marine technology leader Kongsberg Maritime (KM) today announced the signing of a memorandum of understanding to jointly develop and advance the deployment of decarbonisation technologies onboard dry bulk cargo vessels.

As a leader in international deep-sea dry bulk shipping, Berge Bulk has embarked on an ambitious environmental programme that has produced ships like Berge Logan, the most energy-efficient bulk carrier in the world. Continuing this programme, Berge Bulk aims to be carbon-neutral by 2025 at the latest and to have a zero-carbon ocean-going dry bulk carrier by 2030. Such an ambitious programme will require significant technical expertise and innovative talent to achieve and present numerous technical, commercial and regulatory challenges. KM is Berge Bulk’s latest technology partner to step up to the challenge.

“We’re proud to have been chosen by Berge Bulk to accelerate its journey towards carbon-neutral operations,” adds James Poulton, Senior Vice President, Kongsberg Maritime. “Together, we’ll be laying down a positive marker for maritime sustainability that will inspire a literal sea change for bulk carriers and beyond.”

There are two elements of the joint development project. The first element will be to evaluate and test emerging decarbonisation technologies for use in the maritime sector. The second element will be to integrate both emerging and existing technologies into deployable systems that can be installed on Berge Bulk’s fleet of over 80 dry bulk vessels.

“Berge Bulk is actively engaged in identifying new emerging technology trends to help us reach our zero-carbon goals,” adds James Marshall, CEO of Berge Bulk. “However, there are plenty of existing technologies that we can and should be leveraging today to reduce our vessel emissions now.”

Adapting existing technologies to maritime applications is no small challenge. A large proportion of decarbonisation solutions were initially developed for shore-based applications, requiring significant technical adaptations to meet the unique demands of the marine environment. KM’s extensive experience developing technology solutions for marine applications is critical to the success of these projects and the broader acceptance of these technologies by the maritime sector. Together, the two companies hope to expand the array of clean technology options available to shipowners who want to reduce their emissions today.

About Berge Bulk

Berge Bulk is one of the world’s leading independent dry bulk owners with an outstanding reputation for the safe, efficient, and sustainable delivery of commodities around the world. Berge Bulk is a young and dynamic company with a strong commitment to innovative growth and development. It has committed to be carbon neutral by 2025 at the latest.

Berge Bulk owns and manages a fleet of over 80 vessels, equating to more than 14 million DWT. The fleet ranges from handy-size to cape-size to some of the largest vessels ever built, serving the world’s major miners, steel mills and charterers. For more information, visit www.bergebulk.com.

About Kongsberg Maritime

Kongsberg Maritime is a global marine technology company providing innovative and reliable ‘Full Picture’ technology solutions for all marine industry sectors including merchant, offshore, cruise, subsea and naval. Headquartered in Kongsberg, Norway, Kongsberg Maritime has manufacturing, sales and service facilities in 34 countries.

Kongsberg Maritime solutions cover all aspects of marine automation, safety, manoeuvring, navigation, and dynamic positioning as well as energy management, deck handling and propulsion systems, and ship design services. Subsea solutions include single and multibeam echo sounders, sonars, AUV and USV, underwater navigation and communication systems.

Training courses at locations globally, LNG solutions, information management, position reference systems and technology for seismic and drilling operations are also part of the company’s diverse technology portfolio. Additionally, Kongsberg Maritime provides services within EIT (Electro, Instrument & Telecom) engineering and system integration, on an EPC (Engineering, Procurement & Construction) basis.

Kongsberg Maritime is part of Kongsberg Gruppen (KONGSBERG), an international, knowledge-based group that celebrated 200 years in business during 2014. KONGSBERG supplies high-technology systems and solutions to customers in the oil and gas industry, the merchant marine, and the defence and aerospace industries.

Web: Kongsberg Gruppen | Kongsberg Maritime

Social media: LinkedIn | Twitter | Facebook

SOURCE Berge Bulk

Since the EU General Data Protection Regulation became effective May 25, 2018, most American companies have been inundated with contract addenda from vendors, customers and just about everyone else with whom they do business, intended to respond to the privacy requirements of the GDPR. Many proposed addenda include requirements to include standard contractual clauses or similarly purposed documents, such as binding corporate rules. Should American companies without significant EU-based assets sign these addenda?

The answer may well be “no.” The reason is the Uniform Foreign Country Money Judgments Recognition Act.

Liability exposures under GDPR

Most discussion of financial remedies for “infringement” of the GDPR highlights the attention-getting maximum of “administrative fines” provided in Article 83. These fines, when levied, are issued by an EU supervisory authority, as established by each member state.

Less discussed is the potential for claims by data subjects themselves as set out in Articles 79, 80 and 82. These articles contemplate proceedings in whichever nation the data subject resides, as well as potentially allowing for collective actions, bundling of groups of similar individual claims. And while the administrative fines established in Article 83 are capped (even though that cap is massively high), there is no cap on damages for data subjects.

So, faced with such exposures, should an American company with no EU-based assets nevertheless hire an EU attorney in the forum state to defend against a complaint filed by either a supervisory authority or data subject?

UFCMJRA

If either an administrative fine or a damages judgment is entered by an EU tribunal against an American company with no assets based in the EU, the complainant would have to seek recognition of the EU judgment in a U.S. court and then enforcement of that judgment against the U.S.-based assets of the American company.

The U.S. is not a party to any international treaty on the subject of recognition of foreign country judgments. Congress has, to date, enacted no federal statute on this subject. The only applicable body of U.S. law is that applied by U.S. states.

The Uniform Law Commission proposed a comprehensive scheme in 2005, the UFCMJRA, including specific provisions for recognition of foreign country judgments. Per the ULC’s website, 24 states plus the District of Columbia, have enacted the 2005 version, and it is pending in three additional state legislatures as of this writing. As to those states that have not enacted the 2005 version, the common law is likely to vary but will generally follow the principles set out in the UFCMJRA.

The UFCMJRA provides that the act does not apply at all to, among other things, “a fine or other penalty.” Thus, a strong argument can be made that EU-entered administrative fines will not be recognized — and therefore cannot be enforced — in the U.S.

Section 4 sets out exceptions in which a court “may not” recognize a judgment and where a court “need not” do so — the first being mandatory and the second being discretionary.

In the “may not” category are lack of due process of law, lack of personal jurisdiction over the defendant and lack of jurisdiction over the subject matter. Most disputes will most likely arise under dealing with personal jurisdiction.

The “need not” provisions include eight categories. Most important for present purposes is “in the case of jurisdiction based solely on personal service, the foreign court was a seriously inconvenient forum for the trial of the action.” It is difficult to imagine a more “seriously inconvenient forum” for an American company than a forum separated by an ocean.

Unless a representative of an American company happens to be in the member state and served with process while there, the American company is likely not subject to personal jurisdiction of the EU tribunal — and therefore a foreign money judgment against that company would likely not be recognizable by a U.S. court under the UFCMJRA — unless it has performed specific other actions specified in Section 5. And this is where the intersection with SCCs and BCRs occurs.

While the UFCMJRA describes actions that submit to personal jurisdiction similar to those applied by U.S. courts for general or specific jurisdiction, more relevant to the current discussion are Sections 5(a)(2) (defendant voluntarily appeared other than to protect seized property or to contest jurisdiction) and 5(a)(3) (defendant agreed to submit to jurisdiction before commencement of the proceeding).

Section 5(a)(2) presents a partial answer to the question of whether an American company without EU-based assets should hire an EU attorney and contest the merits of a GDPR claim. There may be good reasons to do so under certain circumstances, but companies should only do so in recognition that by voluntarily appearing, they have likely waived some important potential defenses to the recognition of any judgment rendered by the EU tribunal by U.S. courts.

Section 5(a)(3), however, is more insidious. Unsuspecting companies may waive jurisdictional defenses to U.S. recognition of EU judgments without even realizing it until it is too late.

Potential impact of SCCs on UFCMJRA defenses

The purpose of SCCs, BCRs and other similar GDPR-contemplated documents is to comply with the GDPR requirements for cross-border transfers of personal data, for countries (like the U.S.) that have not been certified by the EU as “adequate jurisdictions.”

As the name implies, SCCs are “standard” — not subject to negotiation and must be accepted as is. The same is true for BCRs.

Both SCCs and BCRs include provisions that expressly allow data subjects to enforce GDPR against data exporters. They include provisions by which the data exporter agrees that persons who suffer damages are “entitled to receive compensation from the data exporter” and agree to the jurisdiction of a tribunal of the member state where the data exporter “is established,” governed by the laws of the member state.

Thus, an American company that is not otherwise subject to EU personal jurisdiction and therefore has potential grounds for contesting recognition of an EU judgment by a U.S. court risks losing that defense under Section 5(a)(3) of the UFCMJRA if it agrees to SCCs or BCRs, thereby agreeing to jurisdiction of the EU tribunal.

Many small- to mid-sized American businesses sell only within the U.S. but nonetheless communicate with (and thereby collect personal information about) foreign individuals in a myriad of contexts. Websites know no borders, and many U.S.-based companies interact with EU counterparts even as they have no EU-based assets.

And even if an American company does not itself have any contacts with EU individuals, many of the companies with which it does business may themselves have EU connections.

It is in this context that digital privacy addenda and similarly named contract documents are being received daily by most companies from vendors, customers and others whose own inside or outside counsel have devised contract forms designed to meet GDPR (and now, California Consumer Privacy Act) requirements. Wisdom suggests, however, that companies should think twice before agreeing to these contract provisions.

Photo by Leon Seibert on Unsplash0

Source: https://iapp.org/news/a/how-u-s-companies-without-eu-assets-should-approach-business-contracts/

GDPR IN THE SHIPPING SECTOR – European Community Shipowners Association have published a document intended to provide guidance to the shipping sector on the application of the EU General Data Protection Regulation (“GDPR”).

This document was prepared in consultation with our members.

It is intended for general information purposes only and does not constitute legal advice. To receive legal advice, the reader should consult legal counsel. For definitions of the terms used in these guidelines, please see Appendix 2 to the guidelines.

Application of the GDPR

Does the GDPR apply when a ship has a non-EEA flag and non-EEA crew members?

The GDPR has a broad reach. It applies to organisations established in the EEA, when they process personal data in the context of the activities of these EEA establishments, regardless of whether the processing takes place in the EEA or not. The GDPR further applies to organisations outside the EEA who process personal data, if they offer goods and services to individuals in the EEA or monitor their behaviour. This particularly affects organisations with internet-based business models, offering goods or services to consumers in the EEA.

Examples

– The GDPR applies to a ship owner, ship operator or crewing agent who processes personal data and who is established in the EEA, regardless of the flag of the ship and the nationality of the crew.

– The GDPR applies to a cruise operator established outside the EEA, when it offers cruises to passengers residing in the EEA.

– The GDPR applies to an EEA establishment of a ship owner who processes personal data of non-EEA crew members that it receives from a non-EEA crewing agency.

– The GDPR applies to a non-EEA crewing agency that provides services to individuals in the EEA.

What type of data processing activities are covered by the GDPR?

The GDPR applies to:

(i) any type of operation that is performed on personal data by automated (i.e., computerized) means, and

(ii) non-automated processing of data that (are intended to) form part of a filing system (i.e., keeping hard copy documents in a structured manner so that they are searchable according to specific criteria such as name, ID number, phone number, etc.).

The following are examples of operations that may be performed on personal data and that are covered by the GDPR: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The GDPR applies to any information relating to an identified or identifiable individual, whether or not the information as obtained in a private or professional context.

Examples

– A filing cabinet containing HR records arranged in alphabetical order of employee names would be covered by the GDPR. An unstructured box of hard copy files would not be a relevant filing system and would fall outside the scope of the GDPR.

– Activities that are covered by the GDPR include for example storing employment details of crew members, recording crew members on a ship using audio and video equipment to ensure workplace security, managing contact details of a charter’s port agents, transferring (sensitive) personal data outside the EEA.

– Any information relating to individuals of any capacity associated with a shipping company falls within the scope of the GDPR.

Does the GDPR apply only to sensitive types of information?

No. The GDPR applies to any information that relates to an identified or identifiable individual (e.g., crew members, passengers, staff at customers/partners). This includes, for example, names, email addresses, phone numbers, online identifiers, location data, and information relating to an individual’s physical, physiological, genetic, mental, economic, cultural or social identity. In addition, the GDPR imposes specific requirements when sensitive data are processed (i.e., any personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of unique identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation). Such sensitive data are referred to as “special categories of personal data” in the GDPR.

Examples

– Categories of data that are covered by the GDPR include e.g., contact details, bank information (including cash flows), medical certificates, passport information, video and audio recording.

– Information regarding a crew member’s health (like the aforementioned medical certificates) or trade union membership is considered sensitive data.

Who is the data controller? Who is the data processor?

An entity that decides on the ‘why’ and the ‘how’ of data processing is considered a “controller”. If a controller engages a third party (e.g., service provider) to process personal data on the controller’s behalf, that third party will qualify as a processor. There can be several controllers and processors that are involved in the same data processing activity.

Examples

– When a ship owner installs video cameras on a ship to ensure workplace safety, the ship owner will be considered a controller for the collection of video recordings.

– The ship owner and charterers are controllers for the disclosure of crew members’ personal data to port authorities, in order to fulfil their respective legal obligations vis-à-vis port authorities. In principle, a ship manager is a controller when it manages such data transmission to the authorities, unless its role is limited to acting solely on behalf and under the instructions of the ship owner or charterer (in which case the ship manager is a processor).

- When an external payroll agency processes salaries of crew members, the agency acts as a processor.

– When a ship owner uses a cloud-based customer relationship management program, the cloud service provider acts as a processor.

GDPR has many obligations. Does the shipping industry need to comply with all of them?

In principle: yes. The GDPR requirements apply to all organisations that process personal data, across all industries and sectors. However, some of the GDPR requirements apply only to high-risk data processing activities, which may not be relevant for all organisations in the shipping sector. Each organisation needs to assess which of the GDPR requirements apply to its specific activities.

Example

The GDPR requires that a data controller carries out a ‘data protection impacts assessment’ (‘DPIA’) when it engages in data processing activities that will likely result in a high risk to the rights and freedoms of individuals. This requirement may apply e.g., to an organisation that monitors on-board drug and alcohol use. However, it will not apply to an organisation that only carries out standard HR data processing activities, unless these activities involve large scale processing of sensitive data or criminal data (e.g., in the context of seafarers’ screening).

Does a non-EEA manning agent need to appoint a representative in the EEA? Does it need to be registered with a supervisory authority?

If a non-EEA manning agent provides services to crew members residing in the EEA, or monitors the behaviour of crew members in the EEA, it is subject to the GDPR and needs to appoint a representative in the EEA. The appointment must be in writing, but it does not need to be registered with a supervisory authority. This requirement also applies to manning agents that are established in “adequate” third countries (see section III on international data transfers below).

Example

A manning agent established in New Zealand must appoint a representative in one of the EEA countries where the crew members’ reside whose personal data are processed or whose behaviour are monitored.

GDPR IN THE SHIPPING SECTOR - ECSA DOCUMENT

1 file(s) 70.87 KB

Download

Days Left :

[wpcdt-countdown id=”8836″]

The General Data Protection Regulation (GDPR) is a comprehensive regulation that unifies data
protection laws across all European Union member states. It defines an extended set of rights for
European Union citizens and residents regarding their personal information. Consequently, it
describes strict requirements for companies and organizations on collecting, storing, processing
and managing personal data.

“The GDPR will change not only the European data protection
laws but nothing less than the world as we know it.” Jan Philipp
Albrecht, MEP, EU rapporteur on GDPR

Where organisations are established within the EU

GDPR applies to processing of personal data “in the context of the activities of an establishment” (Article 3(1)) of any organization within the EU. For these purposes “establishment” implies the “effective and real exercise of activity through stable arrangements” (Recital 22) and “the legal form of such arrangements…is not the determining factor” (Recital 22), so there is a wide spectrum of what might be caught from fully functioning subsidiary undertakings on the one hand, to potentially a single individual sales representative depending on the circumstances.

Where organisations are not established within the EU

Even if an organization is able to prove that it is not established within the EU, it will still be caught by GDPR if it processes personal data of data subjects who are in the Union where the processing activities are related “to the offering of goods or services” (Art 3(2)(a)) (no payment is required) to such data subjects in the EU or “the monitoring of their behaviour” (Art 3(2)(b)) as far as their behaviour takes place within the EU. Internet use profiling (Recital 24) is expressly referred to as an example of monitoring .

Penalties
Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors — meaning ‘clouds’ will not be exempt from GDPR enforcement.

All MARITIME COMPANIES either their headquarters based within the EU or not should comply with the GDPR Regulation by May 28,2018 !

GDPR - REGULATION

1 file(s) 958.98 KB

Download

Port of Long Beach joins Transpacific green shipping corridor

Clean Shipping: Berge Bulk and Kongsberg Maritime join forces to advance marine decarbonization

How U.S. Companies Without E.U. Assets Should Approach Business Contracts in the GDPR Age

EU General Data Protection Regulation (“GDPR”) in the shipping sector

GDPR IN THE SHIPPING SECTOR - ECSA DOCUMENT

GDPR – General Data Protection Regulation

GDPR - REGULATION

News

What is ESG? The Impact of ESG on shipping companies (MARITIME ESG)

Sustainability in Shipping Industry, ESG Performance Reporting (MARITIME ESG)

ESG in the Shipping sector (MARITIME ESG)

Quick Menu

Company DETAILS