You Shall EU

Handley Gill's specialist data protection consultants consider the status of CJEU judgments in UK law after the Labour government intervened to prevent section 6 Retained EU Law (Revocation and Reform) Act 2023 from coming into force and amending the European Union (Withdrawal) Act 2018, and consider several CJEU judgments addressing the processing of special category personal data, the interaction between data protection and competition law, the conduct and balancing of legitimate interests assessments, data minimisation and the status of supervisory authority decisions.

Nicola Cain7 October 2024Data Protection, GDPR, EU GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Retained EU Law, Retained EU Law (Revocation and Reform) Act 2023, European Union (Withdrawal) Act 2018, Section 6 European Union (Withdrawal) Act 2018, section 6 Retained EU Law (Revocation and Reform) Act 2023, Assimilated Law, BREXIT, CJEU, Data Controller, Data Minimisation, Supervisory Authority, Health Data, Article 9(1) GDPR, Article 9 GDPR, Article 9 UK GDPR, Article 9(1) UK GDPR, Legitimate Interests, Legitimate Interests Assessment, LIA, Article 6(1)(f) UK GDPR, Article 6(1)(f) GDPR, Commercial Interests, Advertising, MARKETING, Targeted Advertising, Behavioural Advertising, Personalised Advertising, Data Sharing, Necessity, C-446/21, C-621/22, C-21/23, C-200/23, SPECIAL CATEGORY PERSONAL DATA, Special Category Data, Sexual Orientation, Article 9(2)(a) GDPR, Article 9(2)(a) UK GDPR, Article 9(2)(e) GDPR, Article 9(2)(e) UK GDPR, Article 5(1)(c) GDPR, Article 5(1)(c) UK GDPR, Data Retention, C-507/23, Compensation, Damages, Article 82 GDPR, Article 82(1) GDPR, ApologyComment

A paradox of choice

Handley Gill Limited’s specialist consultants unpack the recent High Court decision in Harrison v (1) Cameron & (2) Alasdair Cameron Limited [2024] EWHC 1377 (KB), in which the High Court determined that data controllers responding to data subject access requests (DSARs) are obliged to disclose the specific identities of recipients of personal data, and are not permitted to merely disclose categories of recipient unless exceptions or exemptions apply.

Best Before: 21 March 2024

Handley Gill’s specialist data protection consultants highlight the forthcoming deadline for data controllers to review and, if necessary, update the safeguards relied upon as the lawful basis for conducting transfers of personal data from the UK to overseas where these currently rely upon the old European Commission standard contractual clauses / model clauses, including guidance on the actions that need to be taken.

Nicola Cain13 March 2024Data Protection, Personal Data, UK GDPR, Data Transfer, International data transfers, Restricted International Data Transfers, Article 46(2)(d) UK GDPR, BREXIT, Standard contractual clauses, SCCs, Modernised SCCs, Modernised Standard Contractual Clauses, Standard data protection clauses, Information Commissioner, Information Commissioner's Office, International Data Transfer Agreement, IDTA, International Data Transfer Addendum, EUROPEAN COMMISSION, Model clauses, European Commission Decision 2001/497/EC, European Commission Decision 2010/87/EU, DATA PROTECTION ACT 2018, Schedule 21 Part 3 para.7 Data Protection Act 2018, The Data Protection Privacy & Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), International Data Transfer Risk Assessment, International Data Transfer Impact Assessment, Transfer Risk Assessment, Transfer Impact Assessment, Transfer Risk Assessment Tool, Appropriate Safeguards, Commission Implementing Decision (EU) 2021/914 of 4 June 2021Comment

On Hand May 2023

May 2023 edition of Handley Gill’s monthly digital newsletter, with all the latest developments in data protection (UK, EU and global), cyber security, AI and machine learning, content regulation, open justice, access to information, reputation management and digital markets regulation. Presented in a readily digestible digital format, those who prefer the traditional newsletter format can export the newsletter to pdf.

Nicola Cain1 June 2023Data Protection, Personal Data, GDPR, General Data Protection Regulation, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, DPA 2018, Privacy and Electronic Communications (EC Directive) Regulations 2003, PECR, Information Commissioner, Data Protection Commission, CONTENT REGULATION, AI, Artificial Intelligence, AI Regulation, Machine Learning, Cyber Security, Cyber Resilience, Digital Markets Regulation, Reputation Management, Defamation, Privacy, Data Privacy, Libel, Slander, Malicious Falsehood, Misuse of Private Information, Breach of Confidence, Data Breach, Press Regulation, Broadcasting, Broadcasting Regulation, Ofcom, Digital Markets Competition & Consumers Bill, European Data Protection Board, EDPB, On Hand, Facial Recognition, Meta Platforms Ireland Limited, Ransomware, Data Protection & Digital Information (No.2) Bill, EU law, Retained EU Law, BREXIT, Brexit Freedoms Bill, Retained EU Law (Revocation and Reform) Bill, Cyber Attack, ESG, Environmental Social & Governance, Environmental, Environmental Social & Corporate Governance, Human Rights, China, Data Transfer, International data transfers, Restricted International Data Transfers, Broadcasting Code, Ofcom Broadcasting Code, Online Safety, Online Harms, eSafety, Open Justice, Reporting Restriction, CHILDREN, Children's Data, Misinformation, Disinformatoin, Disinformation, Illegal Harms, Child Sexual Abuse Regulation, Child Sexual Abuse Material, CSAMComment

Data Downgrade Down Under?

Handley Gill Limited’s data protection consultants consider the implications of the 2021 Free Trade Agreement between the UK and Australia - taking effect on 31 May 2023 - for the protection of personal data and the ease of international transfers of personal data.

Nicola Cain31 May 2023BREXIT, UK, United Kingdom, Australia, Data Protection, Personal Data, Privacy, Data Privacy, GDPR, General Data Protection Regulation, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, Section 17A Data Protection Act 2018, Adequacy Decision, Adequacy Regulations, New Zealand, European Commission, Secretary of State for Science Innovation & Technology, Marketing, Direct Marketing, Consent, Marketing Consent, Privacy Act, Privacy Act Review, Foreign Commonwealth and Development Office, Foreign Office, Department for Business and Trade, Department for Science Innovation and Technology, Department for Culture Media & Sport, Data Transfer, Restricted Data Transfer, Restricted International Data Transfers, International data transfers, Standard contractual clauses, Derogations, Data Controller, Data ProcessorComment

DCMS SoS?

Handley Gill considers the impact of the new Prime Minister, Liz Truss, and Secretary of State at the Department for Digital, Culture, Media and Sport, for the Online Safety Bill and the Data Protection and Digital Information Bill.

Pile Up Ahead?

Handley Gill comments on the Government’s response to the ‘Data: A New Direction’ consultation, which previews the content of the forthcoming Data Reform Bill, and identifies other issues which would merit being addressed in the proposed legislation.

Nicola Cain7 July 2022Handley Gill LimitedPERSONAL DATA, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, DPA 2018, PECR, PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, DATA: A NEW DIRECTION, DATA PROTECTION REFORM, BREXIT, NATIONAL DATA STRATEGY, CONVENTION FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO AUTOMATIC PROCESSING OF PERSONAL DATA, POLITICAL PROCESSING, ARTICLE 6 UK GDPR, SPECIAL CATEGORY PERSONAL DATA, SCHEDULE 1 DATA PROTECTION ACT 2018, ANONYMITY, ANONYMOUS DATA, ARTICLE 4(1) UK GDPR, THE COUNCIL OF EUROPE’S CONVENTION 108, THE COUNCIL OF EUROPE CONVENTION 108, PRIVACY MANAGEMENT PROGRAMME, DATA PROTECTION OFFICER, ARTICLE 37 UK GDPR, DATA PROTECTION IMPACT ASSESSMENT, DPIA, ARTICLE 35 UK GDPR, ARTICLE 30 UK GDPR, RECORDS OF PROCESSING ACTIVITIES, ARTICLE 36 UK GDPR, PRIOR CONSULTATION, ARTICLE 12(5) UK GDPR, MANIFESTLY UNFOUNDED OR EXCESSIVE, VEXATIOUS OR EXCESSIVE, ARTICLE 45(2) UK GDPR, INTERNATIONAL DATA TRANSFERS, ADEQUACY DECISION, S.17B(1) DATA PROTECTION ACT 2018, COOKIES, COOKIE CONSENT, REGULATION 6 PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, REGULATION 22(2) PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, SOFT OPT-IN, MARKETING, INFORMATION COMMISSIONER, EXPERT PANEL, ENFORCEMENT, MONETARY PENALTY NOTICE, ARTICLE 15 UK GDPR, DATA SUBJECT ACCESS REQUEST, SUBJECT ACCESS REQUEST, BILL OF RIGHTS, EUROPEAN COURT OF HUMAN RIGHTS, UK SUPREME COURT, SUPREME COURT, EUROPEAN COMMISSION, COMMISSION IMPLEMENTING DECISION C(2021) 4800, Data Protection & Digital Information BillComment

U-turn?

Handley Gill summarises the Government's publication of its response to the ‘Data: A New Direction’ consultation, previewing the content of the forthcoming Data Reform Bill, which was proposed in ‘The Benefits of Brexit’ policy paper and formally announced in the Queen’s Speech 2022.

Nicola Cain22 June 2022Personal Data, UK GDPR, UK General Data Protection Regulation, Data Protection Act 2018, DPA 2018, PECR, Privacy and Electronic Communications Regulations, Data: A New Direction, Data Protection Reform, BREXIT, National Data Strategy, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Article 89 UK GDPR, Recital 159 UK GDPR, Recital 33 UK GDPR, Article 14 UK GDPR, Recital 62 UK GDPR, Disproportionate effort, Article 6(1)(f) UK GDPR, Political processing, Article 6 UK GDPR, Special Category Personal Data, Schedule 1 Data Protection Act 2018, Anonymity, Anonymous Data, Article 4(1) UK GDPR, the Council of Europe’s Convention 108, the Council of Europe Convention 108, Privacy management programme, Data Protection Officer, Article 37 UK GDPR, Data Protection Impact Assessment, DPIA, Article 35 UK GDPR, Article 30 UK GDPR, Records of Processing Activities, Article 36 UK GDPR, Prior Consultation, Article 12(5) UK GDPR, Manifestly Unfounded or Excessive, Article 45(2) UK GDPR, International data transfers, Adequacy Decision, s.17B(1) Data Protection Act 2018, Alternative Transfer Mechanisms, Article 46 UK GDPR, Law enforcement processing, Part 3 Data Protection Act 2018, Part 4 Data Protection Act 2018, Cookie Consent, Regulation 6 Privacy and Electronic Communications Regulations, Regulation 22(2) Privacy and Electronic Communications Regulations, Soft Opt-In, Marketing, Regulatory Enforcement, Information Commissioner, Statutory Duties, Statement of Strategic Priorities, Expert Panel, Technical Reports, Notice of Intent, Final Penalty Notice, AI, Artificial Intelligence, Article 22 UK GDPR, Automated Processing, Voluntary Undertakings, Data Breach Reporting, Article 33 UK GDPR, Article 15 UK GDPR, Data Subject Access Request, Reverse Transfers, Article 49 UK GDPR, Derogations, s.35 Digital Economy Act 2017, Data Sharing, Algorithm Transparency, Schedule 1 Part 2 Data Protection Act 2018, Substantial Public Interest, Biometric Data, Impact Assessments, Legitimate Interests Assessment, Biometrics Commissioner, Smart Data Schemes, Data Intermediaries, Article 46(2)(f) UK GDPR, Certification Regime, Surveillance Camera Commissioner, Schedule 16 paragraph 2(2) Data Protection Act 2018, Data Protection & Digital Information BillComment

VIG (Very Important Guidance) for VSPs

Ofcom publishes guidance for UK video sharing platforms (VSPs) on their obligations to protect users from harmful content.

Nicola Cain6 October 2021BREXIT, VSPs, VIDEO SHARING PLATFORMS, VSP FRAMEWORK, OFCOM, CONTENT REGULATION, ONLINE HARMS, ONLINE SAFETY, ONLINE SAFETY BILL, TECH REGULATION, TECHNOLOGY REGULATION, PLATFORM REGULATION, AUDIO VISUAL MEDIA SERVICES, AUDIOVISUAL MEDIA SERVICES, AUDIOVISUAL MEDIA SERVICES DIRECTIVE, AVMS, AVMSD, COMMUNICATIONS ACT 2003, UGC, USER GENERATED CONTENT, CHILDREN, CSAM, CHILD SEXUAL ABUSE MATERIAL, TERRORISM, RACISM, XENOPHOBIA, TERRORIST CONTENT, RACIST CONTENT, XENOPHOBIC CONTENT, BBFC, BRITISH BOARD OF FILM CLASSIFICATION, BBFC CLASSIFICATION GUIDELINES, R18 CONTENT, INCITEMENT OF VIOLENCE, INCITEMENT OF HATRED, PROTECTED CHARACTERISTICS, RESTRICTED MATERIAL, RELEVANT HARMFUL MATERIAL, INTERNET WATCH FOUNDATION, NATIONAL CENTRE FOR MISSING & EXPLOITED CHILDREN, NCMEC, THORN, TECH AGAINST TERRORISM, GLOBAL INTERNET FORUM TO COUNTER TERRORISM, Age Verification, Age Assurance, Advertising, Advertising Restrictions, Parental Control, Content RegulationComment