News

ICO guidance on manifestly unfounded and excessive requests

See here.

See here.

The Information Commissioner’s Office has published guidance aimed at smaller firms. See here.

Civil Procedure Rule changes to CPR 35 relating to privacy and data protection claims with effect from 1 October 2019, requiring more detailed pre-action protocol letters, and all claims for data protection and misuse of private information will be required to be ...

See here.

Advice from the European Data Protection Board and European Data Protection Supervisor on compliance with GDPR when responding to requests by US law enforcement authorities under the US CLOUD Act. See here.

A Norwich Pharmacal order requiring disclosure of IP addresses would result in the Applicants becoming "recipients" of personal data but not "controllers", and therefore not subject to the more onerous obligations on "controllers". See here.

Revised ICO Guidance on calculating time limits. See here.

The blog discusses how artificial intelligence (AI) can require trade-offs between data protection principles, and what organisations can do to assess and balance them. See here.

See here.

The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems. See here.

See here.

ICO Guidance on the use of cookies and similar technologies (Updated) See here.

See here.

The report contains some potentially useful pointers for law firms and others. See here.

Claim arising from the processing of data by Cambridge Analytica. Joint Administrators were not data controllers and were therefore not personally responsible for compliance with the provisions of the Data Protection Act 1998 in respect of the data processed by ...

See here.

High Court decision (following Court of Appeal decision) determining (1) whether paper files formed part of a relevant filing system, (2) application of legal professional privilege and waiver of privilege), (3) whether solicitors had carried out reasonable and proportionate searches ...

Judgment on lawfulness of sharing of sensitive personal data relating to a 16 year old child, including bail conditions, under an information-sharing agreement between the police and a local business crime reduction partnership.  The decision also determined that the parties ...

Appeal relating to data subject access rights did not survive death of the data subject. See here.

Consideration of various issues in relation to a Subject Access Request under the Data Protection Act 1998, including an unsuccessful claim of legal professional privilege and what constitutes ‘personal data’. See here.

These Regulations make provision in relation to Brexit. http://www.legislation.gov.uk/uksi/2019/419/contents/made

These Regulations make amendments in relation to the application of the EU-US Privacy Shield to the UK post-Brexit. http://www.legislation.gov.uk/uksi/2019/485/pdfs/uksi_20190485_en.pdf

See here.

See here.

See here.

See here.

The European Data Protection Board have published Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities. See here.

Californian District Court decision ordering disclosure of emails despite objection based on GDPR. See here.

Brexit - Data Protection Commission (Ireland) Guidance on Transfers of Personal Data from Ireland to the UK in the Event of a 'No-Deal' Brexit See here.