Handley Gill
LEGAL, REGULATORY & COMPLIANCE CONSULTANTS

Data protection & data privacy

At Handley Gill Limited, our consultants are experts in the General Data Protection Regulation 2016/679 (GDPR), the UK GDPR, the Data Protection Act 2018, The Privacy and Electronic Communications Regulations (PECR), and other relevant privacy and data protection legislation including the Human Rights Act 1998 and Article 8 of the European Convention on Human Rights. We support our clients to convert the gamut of legislation, jurisprudence and guidance into pragmatic compliance programmes within their organisations and to manage risk.

Data Subject Rights

-

Lawful Basis for Processing

-

Age Appropriate Design Code / Children's Code

-

Data Protection Impact Assessments (DPIAs)

-

Data Protection Training

-

Data Processing Agreements (DPAs)

-

UK Representative

-

Breach Preparedness

-

Vendor / Supply Chain Risk Assessments

-

Marketing Compliance

-

Privacy by Design

-

Data Breach Remediation

-

Outsourced Data Protection Officer (DPO)

-

International Data Transfer Risk / Impact Assessment

-

Legitimate Interests Assessments (LIAs)

-

Data Sharing

-

Incident Response

-

Regulatory Enforcement

-

Governance & Oversight

-

First-Tier Tribunal (Information Rights) Appeals

-

Consent Mechanisms

-

Privacy Policies

-

International Data Transfer Agreements

-

Cookie Notices

-

Exemptions

-

Information Notices

-

Assessment Notices

-

Enforcement Notices

-

Monetary Penalty Notices

-

Reprimands

-

Compliance Orders

-

Data Protection Offences

-

Codes of Practice

-

Data Controller Obligations

-

Data Processor Obligations

-

Data Subject Rights - Lawful Basis for Processing - Age Appropriate Design Code / Children's Code - Data Protection Impact Assessments (DPIAs) - Data Protection Training - Data Processing Agreements (DPAs) - UK Representative - Breach Preparedness - Vendor / Supply Chain Risk Assessments - Marketing Compliance - Privacy by Design - Data Breach Remediation - Outsourced Data Protection Officer (DPO) - International Data Transfer Risk / Impact Assessment - Legitimate Interests Assessments (LIAs) - Data Sharing - Incident Response - Regulatory Enforcement - Governance & Oversight - First-Tier Tribunal (Information Rights) Appeals - Consent Mechanisms - Privacy Policies - International Data Transfer Agreements - Cookie Notices - Exemptions - Information Notices - Assessment Notices - Enforcement Notices - Monetary Penalty Notices - Reprimands - Compliance Orders - Data Protection Offences - Codes of Practice - Data Controller Obligations - Data Processor Obligations -

Data protection & data privacy

Recent court judgments and regulatory penalties have demonstrated the importance of seeking professional expertise when embarking upon data processing initiatives.

Our consultants are immersed in the legislation, guidance and judgments relevant to compliance with the General Data Protection Regulation 2016/679 (GDPR), the UK GDPR, the Data Protection Act 2018, The Privacy and Electronic Communications Regulations (PECR), and other relevant privacy and data protection legislation including the Human Rights Act 1998 and Article 8 of the European Convention on Human Rights.

We pride ourselves on utilising our expert knowledge to design, and support clients to implement, practical solutions to privacy problems.

We provide our services to clients from small businesses and start-ups to multi-national corporations across a range of industries, and to government and public sector entities. Our consultants have experience advising: retailers; branding, marketing and advertising (including ad-tech) providers; social media platforms; regulated industries, such as law firms and other legal professionals; financial institutions; insurers and insurance intermediaries; technology start-ups; content providers including publishers, broadcasters, social media platforms and online and editorial content creators; political parties and lobbying groups; law enforcement entities; charitable organisations; employment agencies; the public sector; sports bodies; and, health care providers.

We have particular expertise in the application of data protection and privacy laws to the creation, hosting and distribution of content, and are able to advise media organisations, news publishers, content producers, including independent production companies and their suppliers, influencers and other content creators, and content hosts such as social media sites.  

Having been involved in negotiating the drafting of the exemption at Schedule 2 Part 5 para.26 of the Data Protection Act 2018 for processing of personal data in the context of journalism, art, literature or academia, the ‘special purposes’ exemption, which provides a potentially broad but not wholesale exemption from the requirements of the legislation, our consultants have unrivalled expertise in giving practical advice on its application.

We also have substantial expertise working with law enforcement agencies in relation to the application of data protection and privacy laws to their functions, having regard the Law Enforcement Directive (EU) 2016/680 and Parts 3 and 4 of the Data Protection Act 2018. We have supported law enforcement agencies to undertake novel and high profile data initiatives to support their public functions. Our consultants hold SC (security check) clearance in connection with this work.

Featured
Peer Review - Part II
Peer Review - Part II

As the Data (Use and Access) Bill continues its passage through the House of Lords, Handley Gill’s specialist data protection consultants summarise the second scrutiny session of the House of Lords’ Grand Committee on the Data (Use and Access) Bill on 10 December 2024, when peers began their consideration of the provisions of Part 5 of the Data (Use and Access) Bill on ‘Data protection and privacy’.

Peer Review - Part I
Peer Review - Part I

As the Data (Use and Access) Bill continues its passage through the House of Lords, Handley Gill’s specialist data protection consultants summarise the first session of the House of Lords’ Grand Committee’s scrutiny of the Data (Use and Access) Bill on 03 December 2024.

Here’s one I prepared earlier
Here’s one I prepared earlier

In a comprehensive briefing, the Handley Gill’s specialist data protection consultants analyse the provisions of the Labour government’s Data (Use and Access) Bill (HL Bill 40 2024-25) as introduced in the House of Lords on 23 October 2024, the latest attempt after the Data Protection and Digital Information Bill to reform UK data protection law, as set out in the UK GDPR, Data Protection Act 2018, Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Keeping on Keeling
Keeping on Keeling

Handley Gill’s specialist data protection consultants have prepared unofficial Keeling schedules showing track change mark ups of the changes proposed by the Data (Use & Access) Bill (HL Bill 40) to the Data Protection Act 2018, UK General Data Protection Regulation (UK GDPR) and Privacy and Electronic Communications Regulations 2003 (PECR) respectively. Download for free and sign up for updates on the Bill.

Face Off
Face Off

In the first Parliamentary debate on police use of live facial recognition technology, significant concerns were raised in relation to the latitude afforded to chief officers in deploying the biometric artificial intelligence (AI) tool. Handley Gill’s specialist consultants, whose advice on the deployment of LFR was acknowledged during the debate, consider the implications of the new Labour government’s proposals to revisit the legislative and regulatory framework governing the deployment of live facial recognition by law enforcement.

Back on the Data Protection Reform Merry-Go-Round
Back on the Data Protection Reform Merry-Go-Round

The new Labour government has today (23 October 2024) introduced the Data (Use and Access) Bill in the House of Lords, in the latest attempt to reform the UK’s data protection laws as set out in the UK GDPR, Data Protection Act 2018, Data Protection Act 1998 and Privacy and Electronic Communications Regulations.

Every little bit of data helps?
Every little bit of data helps?

While the sale of marketing lists is generally prohibited, as retail insolvencies increase Handley Gill’s specialist data protection consultants analyse the Information Commissioner’s laissez-faire approach to the purchase and use of the CRM databases of companies in administration and consider the opportunity this offers to administrators and potential purchasers of distressed businesses by reference to the recent case studies of Tesco’s purchase of Paperchase’s assets and the sale of The Body Shop’s assets.  

Even more reasonable
Even more reasonable

With employers having a matter of weeks to implement reasonable measures to prevent sexual harassment at work to comply with the requirements of the Worker Protection (Amendment of Equality Act 2010) Act 2023, Handley Gill's consultants identify the steps employers should take to establish a sexual harassment prevention programme and associated data protection compliance measures. As Labour's Employment Rights Bill would expand the scope of the employer's duty to take all reasonable measures and to address threats posed by third parties, employers should consider voluntarily expanding the scope of their programme now.

#DPPC24
#DPPC24

If you couldn’t make it to the Information Commissioner's Office's (ICO's) Data Protection Practitioners' Conference 2024 (DPPC24), missed a session, were double-booked, couldn’t choose or want to delve deeper into the issues raised by any of the following sessions, Handley Gill's specialist data protection consultants highlight our related content.

You Shall EU
You Shall EU

Handley Gill's specialist data protection consultants consider the status of CJEU judgments in UK law after the Labour government intervened to prevent section 6 Retained EU Law (Revocation and Reform) Act 2023 from coming into force and amending the European Union (Withdrawal) Act 2018, and consider several CJEU judgments addressing the processing of special category personal data, the interaction between data protection and competition law, the conduct and balancing of legitimate interests assessments, data minimisation and the status of supervisory authority decisions.