Handley Gill's blog — Handley Gill

LEGAL, REGULATORY & COMPLIANCE CONSULTANTS

Rishi’s capital gains?

Rishi’s capital gains?

Former Chancellor and Conservative Party leadership candidate Rishi Sunak’s promise that one of his top priorities will be the removal of the burdens of the GDPR need not be interpreted as a significant departure from the proposals for the Data Reform Bill set out in the Government’s response to the Data: A New Direction consultation, but it will rely on the European Commission adopting equality of approach and not seeking to punish the UK for Brexit.

Is the Online Safety Bill safe?

Is the Online Safety Bill safe?

Conclusion of the Report stage of the Online Safety Bill in the House of Commons, which was scheduled for 20 July, has now been postponed until after the summer recess. Responding to the news, Conservative Party leadership candidate Kemi Badenoch described the Bill as being “in no fit state to become law”, raising the prospect that the Online Safety Bill may become safer, but for whom?

Bill of Rights... and Wrongs?

Bill of Rights... and Wrongs?

Handley Gill considers the impact of the Bill of Rights (Bill 117 2022/23), which would repeal and replace the Human Rights Act 1998, on the law of data protection, privacy and freedom of expression in the UK.

Nicola Cain13 July 2022Bill of Rights, Bill 117 2022/23, Human Rights Act 1998, European Convention on Human Rights, European Court of Human Rights, ECHR, Human Rights, Supreme Court, Article 8, Right to respect for private and family life, Privacy, Misuse of Private Information, Right to Freedom of Expression, Article 10, Right to free speech, Free speech, Freedom of Speech, Jury trial, Standing, Victim, Permission, Prior restraint, Protection of journalistic sources, s10 Contempt of Court Act 1981, European Commission, Adequacy Decision, UK Adequacy, Data Protection, Data Protection Act 2018, Online Safety Bill, Freedom of Information Act 2000, Compensation, Damages, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland [GC] (931/13), Douglas v Hello! Ltd [2001] QB 967, s12 Human Rights Act 1998, Clause 2(a) Bill of Rights, Clause 3(1) Bill of Rights, Clause 3(3)(b) Bill of Rights, Clause 4(1) Bill of Rights, Clause 9(2)(d) Bill of Rights, Clause 15(1) Bill of Rights, Clause 17(3) Bill of Rights, Clause 18(1) Bill of Rights, Clause 21 Bill of Rights, Sir Cliff Richard v (1) BBC and (2) Chief Constable of South Yorkshire Police [2017] EWHC 1291 (Ch), Clause 22 Bill of RightsComment

Pile Up Ahead?

Pile Up Ahead?

Handley Gill comments on the Government’s response to the ‘Data: A New Direction’ consultation, which previews the content of the forthcoming Data Reform Bill, and identifies other issues which would merit being addressed in the proposed legislation.

Nicola Cain7 July 2022Handley Gill LimitedPERSONAL DATA, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, DPA 2018, PECR, PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, DATA: A NEW DIRECTION, DATA PROTECTION REFORM, BREXIT, NATIONAL DATA STRATEGY, CONVENTION FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO AUTOMATIC PROCESSING OF PERSONAL DATA, POLITICAL PROCESSING, ARTICLE 6 UK GDPR, SPECIAL CATEGORY PERSONAL DATA, SCHEDULE 1 DATA PROTECTION ACT 2018, ANONYMITY, ANONYMOUS DATA, ARTICLE 4(1) UK GDPR, THE COUNCIL OF EUROPE’S CONVENTION 108, THE COUNCIL OF EUROPE CONVENTION 108, PRIVACY MANAGEMENT PROGRAMME, DATA PROTECTION OFFICER, ARTICLE 37 UK GDPR, DATA PROTECTION IMPACT ASSESSMENT, DPIA, ARTICLE 35 UK GDPR, ARTICLE 30 UK GDPR, RECORDS OF PROCESSING ACTIVITIES, ARTICLE 36 UK GDPR, PRIOR CONSULTATION, ARTICLE 12(5) UK GDPR, MANIFESTLY UNFOUNDED OR EXCESSIVE, VEXATIOUS OR EXCESSIVE, ARTICLE 45(2) UK GDPR, INTERNATIONAL DATA TRANSFERS, ADEQUACY DECISION, S.17B(1) DATA PROTECTION ACT 2018, COOKIES, COOKIE CONSENT, REGULATION 6 PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, REGULATION 22(2) PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, SOFT OPT-IN, MARKETING, INFORMATION COMMISSIONER, EXPERT PANEL, ENFORCEMENT, MONETARY PENALTY NOTICE, ARTICLE 15 UK GDPR, DATA SUBJECT ACCESS REQUEST, SUBJECT ACCESS REQUEST, BILL OF RIGHTS, EUROPEAN COURT OF HUMAN RIGHTS, UK SUPREME COURT, SUPREME COURT, EUROPEAN COMMISSION, COMMISSION IMPLEMENTING DECISION C(2021) 4800, Data Protection & Digital Information BillComment

U-turn?

U-turn?

Handley Gill summarises the Government's publication of its response to the ‘Data: A New Direction’ consultation, previewing the content of the forthcoming Data Reform Bill, which was proposed in ‘The Benefits of Brexit’ policy paper and formally announced in the Queen’s Speech 2022.

Nicola Cain22 June 2022Personal Data, UK GDPR, UK General Data Protection Regulation, Data Protection Act 2018, DPA 2018, PECR, Privacy and Electronic Communications Regulations, Data: A New Direction, Data Protection Reform, BREXIT, National Data Strategy, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Article 89 UK GDPR, Recital 159 UK GDPR, Recital 33 UK GDPR, Article 14 UK GDPR, Recital 62 UK GDPR, Disproportionate effort, Article 6(1)(f) UK GDPR, Political processing, Article 6 UK GDPR, Special Category Personal Data, Schedule 1 Data Protection Act 2018, Anonymity, Anonymous Data, Article 4(1) UK GDPR, the Council of Europe’s Convention 108, the Council of Europe Convention 108, Privacy management programme, Data Protection Officer, Article 37 UK GDPR, Data Protection Impact Assessment, DPIA, Article 35 UK GDPR, Article 30 UK GDPR, Records of Processing Activities, Article 36 UK GDPR, Prior Consultation, Article 12(5) UK GDPR, Manifestly Unfounded or Excessive, Article 45(2) UK GDPR, International data transfers, Adequacy Decision, s.17B(1) Data Protection Act 2018, Alternative Transfer Mechanisms, Article 46 UK GDPR, Law enforcement processing, Part 3 Data Protection Act 2018, Part 4 Data Protection Act 2018, Cookie Consent, Regulation 6 Privacy and Electronic Communications Regulations, Regulation 22(2) Privacy and Electronic Communications Regulations, Soft Opt-In, Marketing, Regulatory Enforcement, Information Commissioner, Statutory Duties, Statement of Strategic Priorities, Expert Panel, Technical Reports, Notice of Intent, Final Penalty Notice, AI, Artificial Intelligence, Article 22 UK GDPR, Automated Processing, Voluntary Undertakings, Data Breach Reporting, Article 33 UK GDPR, Article 15 UK GDPR, Data Subject Access Request, Reverse Transfers, Article 49 UK GDPR, Derogations, s.35 Digital Economy Act 2017, Data Sharing, Algorithm Transparency, Schedule 1 Part 2 Data Protection Act 2018, Substantial Public Interest, Biometric Data, Impact Assessments, Legitimate Interests Assessment, Biometrics Commissioner, Smart Data Schemes, Data Intermediaries, Article 46(2)(f) UK GDPR, Certification Regime, Surveillance Camera Commissioner, Schedule 16 paragraph 2(2) Data Protection Act 2018, Data Protection & Digital Information BillComment

I Always Feel Like Somebody's Watching Me

I Always Feel Like Somebody's Watching Me

In this presentation, to coincide with London Tech Week 2022 and the Future of Work Summit, Handley Gill identifies the legal and regulatory issues arising from the deployment of employee monitoring and surveillance technologies in the hybrid workplace, and provides guidance on how to establish a compliant programme.

Who's Under Investigation?

Who's Under Investigation?

The Information Commissioner recently published an opinion, 'Who’s Under Investigation? The processing of victims’ personal data in rape and serious sexual offence investigations', which calls on the police, CPS and other prosecution agencies to overhaul their approach to the obtaining and retention of victim personal data.

Nicola Cain13 June 2022Data Protection, Personal Data, Data Protection Act 2018, Part 3 Data Protection Act 2018, Law enforcement processing, Information Commissioner, Police, Training, Consent, Lawful Basis for Processing, Criminal Justice System, Victims, Witnesses, Law EnforcementComment

Dominate that DSAR

Dominate that DSAR

Handley Gill’s top tips for complying with data subject access requests under Article 15 UK GDPR / GDPR.

Nicola Cain8 June 2022Data Protection, Personal Data, Data Subject Rights, DSAR, Data Subject Access Request, Data Protection Act 2018, UK GDPR, UK General Data Protection Regulation, GDPR, General Data Protection Regulation, Article 15, Article 15 GDPR, Article 15 UK GDPR, Data controllerComment

Online Safety Hazards

Online Safety Hazards

Aggregated summary of key amendments tabled to Online Safety Bill 2021/22-285, 2022/23-004.

Nicola Cain6 June 2022ONLINE SAFETY BILL, ONLINE SAFETY, ONLINE HARMSComment

Exclusive: Information Commissioner’s Office kisses source protection goodbye

Exclusive: Information Commissioner’s Office kisses source protection goodbye

Exclusive: Information Commissioner’s Office breached obligations when targeting journalists’ sources by conducting raids over Hancock snog CCTV footage

Taking a wrong turn? Government pursues data protection reform

Taking a wrong turn? Government pursues data protection reform

The Government has today (10 May 2022) announced in the Queen’s Speech that further to its consultation ‘Data: A New Direction’ it will bring forward legislation in this Parliamentary session to reform the UK’s data protection law (the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations) which has been adopted virtually wholesale from the European General Data Protection Regulation (GDPR).

Nicola Cain10 May 2022Data Protection, Personal Data, GDPR, General Data Protection Regulation, UK GDPR, UK General Data Protection Regulation, Data Protection Act 2018, DPA 2018, Privacy and Electronic Communications Regulations, PECR, Data Protection Reform, Data: A New Direction, Brexit, National Data Strategy, 10 Tech Priorities, Cookies, Data Protection Officer, Information Commissioner, International Data Transfers, Records of Processing Activities, Processing for Research Purposes, AI, Artificial Intelligence, Anonymous Data, Data Intermediaries, Data Stewards, Data Protection Impact Assessments, High Risk Processing, Prior Consultation, Data Breaches, Regulatory Enforcement, Voluntary Undertakings, Cookie Consent, Reverse Transfers, Digital Regulation Co-operation Forum, DRCF, Notice of Intent, Final Penalty Notice, Law Enforcement Processing, Part 3 Data Protection Act 2018, Part 4 Data Protection Act 2018, Automated Processing, Data Protection & Digital Information BillComment

Too Many Phish in the Sea!

Too Many Phish in the Sea!

DCMS has recently published its Cyber Security Breaches Survey 2022, based on data gathered by IPSOS MORI over winter 2021/22, which reveals that businesses and charities continue to be under prepared to respond to inevitable cyber security incidents and data breaches.

In this post, we highlight some of the key findings of the survey and identify advice, guidance and free solutions to common cyber resilience shortcomings.

Protective MeasuresNicola Cain17 April 2022Handley Gill Limited#CyberSecurity, #DataBreach, #CyberAttack, #Phishing, #Ransomware, #GDPR, #UKGDPR, #DPA2018, #DCMS, #CyberSecurityBreachesSurvey, #CyberSecurityBreachesSurvey2022, #DataBreachStatistics, #Malware, #CyberResilience, #CyberInsurance, #IncidentResponse, #CyberSecurityIncident, #DataBreachResponse, #SMEs, #Charities, #Business, #Charity, #Retail, #Education, #NCSC, #PoliceCyberAlarm, #NPCC, #LawEnforcement, #ActionFraud, #Police, #Sanctions, #SupplyChainRisk, #ThirdPartyRisk, #Training, #Logging, #TechnicalAndOrganisationalMeasures, #Penalties, #Article28, #Article32, #DataProtection, #Compliance, #SupplyChainSecurity, #CyberSecurityStrategy, #IncidentResponsePlan, #Trustees, #BusinessContinuity, #DisasterRecovery, #DataBreachReporting, #CyberCover, #IncidentReporting, #CSuite, Cyber Security, DCMS, Ransomware, Data Breach, Supply Chain Risk, Directors, Law Enforcement, Police, NCSC, National Cyber Security Centre, Cyber Attack, GDPR, UK GDPR, General Data Protection Regulation, DPA 2018, Data Protection Act 2018, Department for Culture, Cyber Security Breaches Survey, Cyber Security Breaches Survey 2022, Data Breach Statistics, Malware, Cyber Resilience, Cyber Insurance, Incident Response, Cyber Security Incident, Data Breach Response, SMEs, Micro Businesses, Charities, Start Ups, Retail, Education, Police CyberAlarm, NPCC, National Police Chiefs' Council, Action Fraud, Information Security, Cyber Crime, Sanctions, Third Party Risk, Training, Logging, Technical & Organisational Measures, Protective Measures, Costs, Fines, Administrative fine, Penalties, Monetary penalty, Data Protection, Article 28 GDPR, Article 32 GDPR, Article 28 UK GDPR, Article 32 UK GDPR, Compliance, Cyber Griffin, Cyber Essentials, Supply Chain Security, Cyber Security Strategy, Incident Response Plan, Breach Response Plan, Data breach costs, Trustees, Business Continuity, Disaster Recovery, Data Breach Reporting, Cyber Insurance Cover, Incident Reporting, C Suite, Data Controller, Data ProcessorComment

VIG (Very Important Guidance) for VSPs

VIG (Very Important Guidance) for VSPs

Ofcom publishes guidance for UK video sharing platforms (VSPs) on their obligations to protect users from harmful content.

Nicola Cain6 October 2021BREXIT, VSPs, VIDEO SHARING PLATFORMS, VSP FRAMEWORK, OFCOM, CONTENT REGULATION, ONLINE HARMS, ONLINE SAFETY, ONLINE SAFETY BILL, TECH REGULATION, TECHNOLOGY REGULATION, PLATFORM REGULATION, AUDIO VISUAL MEDIA SERVICES, AUDIOVISUAL MEDIA SERVICES, AUDIOVISUAL MEDIA SERVICES DIRECTIVE, AVMS, AVMSD, COMMUNICATIONS ACT 2003, UGC, USER GENERATED CONTENT, CHILDREN, CSAM, CHILD SEXUAL ABUSE MATERIAL, TERRORISM, RACISM, XENOPHOBIA, TERRORIST CONTENT, RACIST CONTENT, XENOPHOBIC CONTENT, BBFC, BRITISH BOARD OF FILM CLASSIFICATION, BBFC CLASSIFICATION GUIDELINES, R18 CONTENT, INCITEMENT OF VIOLENCE, INCITEMENT OF HATRED, PROTECTED CHARACTERISTICS, RESTRICTED MATERIAL, RELEVANT HARMFUL MATERIAL, INTERNET WATCH FOUNDATION, NATIONAL CENTRE FOR MISSING & EXPLOITED CHILDREN, NCMEC, THORN, TECH AGAINST TERRORISM, GLOBAL INTERNET FORUM TO COUNTER TERRORISM, Age Verification, Age Assurance, Advertising, Advertising Restrictions, Parental Control, Content RegulationComment

B.A. B.A. Black Sheep Returns to the Fold

B.A. B.A. Black Sheep Returns to the Fold

British Airways settles data breach group litigation compensation claims, concluding legal and regulatory proceedings following criminal hack

Deep Impact on Data Protection Impact Assessments

Deep Impact on Data Protection Impact Assessments

Data controllers should revisit their Data Protection Impact Assessments (DPIAs).

DPIAsNicola Cain15 November 2020Data protection, Data protection impact assessment, GDPR, Article 35, Law enforcement processing, High risk processing, Data controller, Criminal conviction & offence data, Data Protection Act 2018, Section 64, Biometric data, Systematic public monitoring, Law Enforcement, Law Enforcement Processing, DPIA, Part 3 Data Protection Act 2018

European Court of Justice wields axe against Privacy Shield

European Court of Justice wields axe against Privacy Shield

Action needed by data controllers to assess the compliance of relevant international data transfers with GDPR following CJEU decision in Schrems invalidating Privacy Shield.

Data transfersNicola Cain15 November 2020Handley Gill LimitedData protection, Data privacy, Schrems, SchremsII, International data transfers, Privacy Shield, GDPR, Article 44, Standard contractual clausesComment