Handley Gill's blog — Handley Gill

LEGAL, REGULATORY & COMPLIANCE CONSULTANTS

You know how i feel

You know how i feel

Handley Gill Limited, and its specialist data protection consultants, respond to the Information Commissioner’s (ICO’s) consultation on its draft ‘Employment practices and data protection: information about workers’ health guidance, which address the use of special category data concerning health in the context of maintaining sickness, injury and absence records, occupational health schemes, conducting medical examinations and testing (including drug testing) and other health monitoring.

Data Protection Day 2023

Data Protection Day 2023

In advance of Data Protection Day 2023 - aka Data Privacy Day 2023 - on 28 January, Handley Gill Limited’s specialist data protection consultants identify 5 ways you can use the occasion to enhance your data protection management programme / privacy management programme.

Nicola Cain25 January 2023Personal Data, Data Protection, Privacy, Data Protection Day, Data Protection Day 2023, Privacy Day, Privacy Day 2023, National Privacy Day 2023, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Convention 108, the Council of Europe Convention 108, Data The Story of You, Respect PrivacyComment

Watch and learn

Watch and learn

Handley Gill Limited, and its specialist data protection consultants, respond to the Information Commissioner’s (ICO’s) consultation on its draft ‘Employment practices: monitoring at work’ guidance, which addresses the lawfulness of the use of workplace monitoring and surveillance technologies in the workplace (whether office, home or remote working) and on workers’ devices.

HM Coroner vs the Online Safety Bill

HM Coroner vs the Online Safety Bill

As the deadline approaches for the government and social media platforms to respond to HM Coroner’s recommendations in the Prevention of Future Deaths report following the Molly Russell inquest verdict, Handley Gill considers how the recommendations stack up against the provisions of the Online Safety Bill.

Nicola Cain29 November 2022Online Safety, Online Harms, ONLINE SAFETY BILL, Bill 285 2021-22, Bill 004 2022-23, Bill 121 2022-23, eSafety, Content Moderation, Intermediary Liability, Social Media, Molly Russell, Molly Russell Inquest, Regulation 28 Coroners (Investigations) Regulations 2013, Regulation 29 Coroners (Investigations) Regulations 2013, Schedule 5 paragraph 7 Coroners and Justice Act 2009, HM Coroner, Chief Coroner, Ofcom, Roadmap to Regulation, Online Safety Regulator, Online Harms Regulator, UK GDPR, UK General Data Protection Regulation, Data Protection Act 2018, DPA 2018, Age Verification, Children’s Risk Assessment, Safety duties protecting children, Harmful content, Primary priority content that is harmful to children, Self-Harm, Digital Regulation Co-operation Forum, DRCF, CMA, Competition & Markets Authority, Information Commissioner, ICO, FCA, Financial Conduct Authority, Advertising, Algorithm, Algorithmic Accountability, Algorithmic TransparencyComment

Take Two

Take Two

Handley Gill Limited’s response to the Information Commissioner’s second consultation on the draft statutory ‘Data protection and journalism code of practice’, on the processing of personal data for the purpose of journalism under the UK GDPR and Data Protection Act 2018. The ICO is obliged by s.124 Data Protection Act 2018 to prepare and submit the code to the Secretary of State at the Department for Digital, Culture, Media & Sport (DCMS) for it to be laid before Parliament.

Risky business

New guidance issued by the Information Commissioner’s Office on the approach to assessing the risk of restricted ex-UK international data transfers may ease restrictions on transfers of personal data to the US and presents an opportunity to revisit ex-UK international data transfers that had previously been rejected as non-compliant.

Nicola Cain20 November 2022Data Protection, Personal Data, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Article 46 GDPR, Article 46 UK GDPR, Article 46(2)(c) UK GDPR, Article 46(2)(c) GDPR, DATA PROTECTION ACT 2018, DPA 2018, Data Transfer, US Data Transfers, Restricted Data Transfer, International data transfers, Restricted International Data Transfers, DPC22, Emma Bate, Information Commissioner's Office, Information Commissioner, ICO, EDPB, European Data Protection Board, International Data Transfer Risk Assessment, IDTRA, Transfer Risk Assessment, TRA, Data export, Personal Data Export, Data Exporter, Supplementary Measures, Data Controller, Data Processor, Data Importer, Schrems II, C-311/18, Transatlantic Data Privacy Framework, Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, Appropriate Safeguards, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, EDPB Recommendation 01/2020, International Data Transfer Agreement, International Data Transfer Addendum, IDTA, Standard Contractual Clauses, Modernised Standard Contractual Clauses, International Transfers, Privacy, Data Privacy, Human Rights, Transfer Risk Assessment Tool, Data Protection & Digital Information Bill, Adequacy Decision, UK Adequacy, Bill of Rights, Transfer Impact Assessment, TIAComment

Biden waves Privacy Magic Wand

Biden waves Privacy Magic Wand

President Biden issued Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities on 07 October 2022, enhancing the safeguards afforded to global citizens and laying the foundation for adequacy findings by the European Commission and Secretary of State for ex-EEA and ex-UK restricted international data transfers. While the risk of legal challenge to any adequacy finding would remain, such findings would provide welcome respite for the millions of data exporters who are neither equipped nor resourced to conduct wide ranging reviews of foreign legislation at an individual level.

Nicola Cain8 October 2022Data Protection, Personal Data, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, Article 45 GDPR, Article 45(2) GDPR, Article 46 GDPR, UK GDPR, Article 45(2) UK GDPR, Data Protection Act 2018, DPA 2018, Section 74A Data Protection Act 2018, S.74A Data Protection Act 2018, International Data Transfers, Restricted International Data Transfers, Adequacy Decision, Adequate Countries, Qualifying State, international Data Transfer Risk Assessment, Safe Harbor, Privacy Shield, Transatlantic Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, Max Schrems, noyb, Schrems II, Case C 311/18, CJEU, Secretary of State for Digital Culture Media & Sport, Michelle Donelan MP, European Commission, President Ursula von der Leyen, President Joe Biden, US Secretary of Commerce, Gina Raimondo, European Data Protection Board, Civil Liberties Protection Officer of the Office of the Director of National Intelligence, Civil Liberties Protection Officer, Privacy and Civil Liberties Oversight Board, Privacy and Civil Liberties Officer, Presidential Policy Directive 28 of January 17, 2014 (Signals Intelligence Activities) (PPD-28), Inspector General, Data Protection Review Court, Executive Order 14086, Executive Order on Enhancing Safeguards for United States Signals Intelligence ActivitiesComment

GDP-ouR

GDP-ouR

In a speech at the Conservative Party Conference 2022, Michelle Donelan MP, the Secretary of State for Digital, Culture, Media and Sport, announced a bespoke British system of data protection, appearing to indicate a significant revision to the Data Protection and Digital Reform Bill currently undergoing Parliamentary consideration and a potential consolidation of the UK’s data protection law framework.

Revocation and Reform offers no R & R

Revocation and Reform offers no R & R

Without intervention by DCMS, the Retained EU Law (Revocation and Reform) Bill will decimate the UK’s data protection law framework.

See ya SCCs, enter the IDTA

See ya SCCs, enter the IDTA

New data processing or other sharing agreements governed by the UK GDPR, which are entered into on or after Thursday 22 September 2022 and which involve the export of personal data from the UK to third countries and will rely on appropriate safeguards under Article 46 UK GDPR in the form of standard data protection clauses, can no longer rely on the standard contractual clauses (SCCs) or ‘model clauses’ issued by the European Commission and valid as at 31 December 2020 and must instead incorporate the International Data Transfer Agreement or modernised SCCs and International Data Transfer Addendum.

Nicola Cain20 September 2022Data Protection, Data Protection Act 2018, GDPR, UK GDPR, General Data Protection Regulation, UK General Data Protection Regulation, EUROPEAN COMMISSION, Information Commissioner, SchremsII, Schrems II, Standard contractual clauses, SCCs, Modernised Standard Contractual Clauses, Modernised SCCs, International data transfers, International Data Transfer Agreement, IDTA, International Data Transfer Addendum, International Data Transfer Risk Assessment, Article 46 UK GDPR, Article 46 GDPR, Model clauses, European Commission Decision 2001/497/EC, European Commission Decision 2010/87/EU, Brexit, UK-EU Withdrawal Agreement, Article 46(2)(c) UK GDPR, Article 46(2)(d) UK GDPR, Article 46(2)(d) GDPR, Standard data protection clauses, The Data Protection Privacy & Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), Schedule 21 Part 3 para.7 Data Protection Act 2018, Data transfer agreement, Data exporter, Commission Implementing Decision (EU) 2021/914, Data Controller, Data Processor, Data Exporter, Data ImporterComment

DCMS SoS?

DCMS SoS?

Handley Gill considers the impact of the new Prime Minister, Liz Truss, and Secretary of State at the Department for Digital, Culture, Media and Sport, for the Online Safety Bill and the Data Protection and Digital Information Bill.

Keeling calling: Data Protection & Digital Information Bill

Keeling calling: Data Protection & Digital Information Bill

Unofficial Keeling schedules demonstrating the effect that the Data Protection and Digital Information Bill (Bill 143 2022-23) (as introduced) will have on the Data Protection Act 2018 and Privacy and Electronic Communications Regulations (PECR), and a comparison between the GDPR, UK GDPR and the UK GDPR with prospective amendments from the Data Protection and Digital Information Bill.

Nicola Cain29 August 2022Data Protection, Personal Data, GDPR, UK GDPR, General Data Protection Regulation, UK GENERAL DATA PROTECTION REGULATION, Data Protection Act 2018, Privacy and Electronic Communications Regulations, PECR, Data Protection Reform, Data Protection and Digital Information Bill, Bill 143 2022-23, Keeling ScheduleComment

Truss calls time for TikTok?

Truss calls time for TikTok?

As Conservative Party Leadership Contest candidate Liz Truss threatened to crack down on ByteDance, the Chinese owner of social media platform TikTok, during the BBC’s News Special ‘Our Next Prime Minister’ on 25 July 2022, we explore how she might seek to do that under the National Security and Investment Act 2021, through amendments to the Online Safety Bill and/or Data Protection and Digital Information Bill and through the actions of regulators Ofcom and the Information Commissioner.

Nicola Cain26 July 2022Conservative Party, Conservative Party Leader, Prime Minister, Liz Truss, Nadine Dorries, Secretary of State for Digital Culture Media and Sport, Foreign Secretary, TikTok, ByteDance, China, Rishi Sunak, Faisal Islam, BBC, National Security and Investment Act 2021, The National Security and Investment Act 2021 (Notifiable Acquisition) (Specification of Qualifying Entities) Regulations 2021, Defamation, Absolute Privilege, ONLINE SAFETY BILL, Data Protection and Digital Information Bill, Data Protection & Digital Information Bill, DPDI Bill, OFCOM, Information Commissioner, Information Commissioner's Office, Information Commission, ICO25, Fit and Proper, Video on Demand, VOD, Video Streaming Sites, Video Sharing Platforms, VSPs, International data transfers, Data Localisation, Prior Consultation, Statement of Strategic Priorities, Kemi Badenoch, CONTENT REGULATION, Platform Regulation, Technology Regulation, USER GENERATED CONTENT, UGCComment

In the Firing Line?

In the Firing Line?

ICO25, the Information Commissioner’s new draft strategic plan for the period 2022-25, currently open for consultation, identifies 15 industry sectors and data processing activities proposed to be the intended focus of the Commissioner’s investigations and enforcement activity in relation to data protection and the processing of personal data under the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations (PECR), including recruitment, banking and finance, biometrics, the care sector, gambling, CCTV, law enforcement, health, AI and algorithms.

Rishi’s capital gains?

Rishi’s capital gains?

Former Chancellor and Conservative Party leadership candidate Rishi Sunak’s promise that one of his top priorities will be the removal of the burdens of the GDPR need not be interpreted as a significant departure from the proposals for the Data Reform Bill set out in the Government’s response to the Data: A New Direction consultation, but it will rely on the European Commission adopting equality of approach and not seeking to punish the UK for Brexit.

Is the Online Safety Bill safe?

Is the Online Safety Bill safe?

Conclusion of the Report stage of the Online Safety Bill in the House of Commons, which was scheduled for 20 July, has now been postponed until after the summer recess. Responding to the news, Conservative Party leadership candidate Kemi Badenoch described the Bill as being “in no fit state to become law”, raising the prospect that the Online Safety Bill may become safer, but for whom?

Bill of Rights... and Wrongs?

Bill of Rights... and Wrongs?

Handley Gill considers the impact of the Bill of Rights (Bill 117 2022/23), which would repeal and replace the Human Rights Act 1998, on the law of data protection, privacy and freedom of expression in the UK.

Nicola Cain13 July 2022Bill of Rights, Bill 117 2022/23, Human Rights Act 1998, European Convention on Human Rights, European Court of Human Rights, ECHR, Human Rights, Supreme Court, Article 8, Right to respect for private and family life, Privacy, Misuse of Private Information, Right to Freedom of Expression, Article 10, Right to free speech, Free speech, Freedom of Speech, Jury trial, Standing, Victim, Permission, Prior restraint, Protection of journalistic sources, s10 Contempt of Court Act 1981, European Commission, Adequacy Decision, UK Adequacy, Data Protection, Data Protection Act 2018, Online Safety Bill, Freedom of Information Act 2000, Compensation, Damages, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland [GC] (931/13), Douglas v Hello! Ltd [2001] QB 967, s12 Human Rights Act 1998, Clause 2(a) Bill of Rights, Clause 3(1) Bill of Rights, Clause 3(3)(b) Bill of Rights, Clause 4(1) Bill of Rights, Clause 9(2)(d) Bill of Rights, Clause 15(1) Bill of Rights, Clause 17(3) Bill of Rights, Clause 18(1) Bill of Rights, Clause 21 Bill of Rights, Sir Cliff Richard v (1) BBC and (2) Chief Constable of South Yorkshire Police [2017] EWHC 1291 (Ch), Clause 22 Bill of RightsComment

Pile Up Ahead?

Pile Up Ahead?

Handley Gill comments on the Government’s response to the ‘Data: A New Direction’ consultation, which previews the content of the forthcoming Data Reform Bill, and identifies other issues which would merit being addressed in the proposed legislation.

Nicola Cain7 July 2022Handley Gill LimitedPERSONAL DATA, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, DPA 2018, PECR, PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, DATA: A NEW DIRECTION, DATA PROTECTION REFORM, BREXIT, NATIONAL DATA STRATEGY, CONVENTION FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO AUTOMATIC PROCESSING OF PERSONAL DATA, POLITICAL PROCESSING, ARTICLE 6 UK GDPR, SPECIAL CATEGORY PERSONAL DATA, SCHEDULE 1 DATA PROTECTION ACT 2018, ANONYMITY, ANONYMOUS DATA, ARTICLE 4(1) UK GDPR, THE COUNCIL OF EUROPE’S CONVENTION 108, THE COUNCIL OF EUROPE CONVENTION 108, PRIVACY MANAGEMENT PROGRAMME, DATA PROTECTION OFFICER, ARTICLE 37 UK GDPR, DATA PROTECTION IMPACT ASSESSMENT, DPIA, ARTICLE 35 UK GDPR, ARTICLE 30 UK GDPR, RECORDS OF PROCESSING ACTIVITIES, ARTICLE 36 UK GDPR, PRIOR CONSULTATION, ARTICLE 12(5) UK GDPR, MANIFESTLY UNFOUNDED OR EXCESSIVE, VEXATIOUS OR EXCESSIVE, ARTICLE 45(2) UK GDPR, INTERNATIONAL DATA TRANSFERS, ADEQUACY DECISION, S.17B(1) DATA PROTECTION ACT 2018, COOKIES, COOKIE CONSENT, REGULATION 6 PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, REGULATION 22(2) PRIVACY AND ELECTRONIC COMMUNICATIONS REGULATIONS, SOFT OPT-IN, MARKETING, INFORMATION COMMISSIONER, EXPERT PANEL, ENFORCEMENT, MONETARY PENALTY NOTICE, ARTICLE 15 UK GDPR, DATA SUBJECT ACCESS REQUEST, SUBJECT ACCESS REQUEST, BILL OF RIGHTS, EUROPEAN COURT OF HUMAN RIGHTS, UK SUPREME COURT, SUPREME COURT, EUROPEAN COMMISSION, COMMISSION IMPLEMENTING DECISION C(2021) 4800, Data Protection & Digital Information BillComment

U-turn?

U-turn?

Handley Gill summarises the Government's publication of its response to the ‘Data: A New Direction’ consultation, previewing the content of the forthcoming Data Reform Bill, which was proposed in ‘The Benefits of Brexit’ policy paper and formally announced in the Queen’s Speech 2022.

Nicola Cain22 June 2022Personal Data, UK GDPR, UK General Data Protection Regulation, Data Protection Act 2018, DPA 2018, PECR, Privacy and Electronic Communications Regulations, Data: A New Direction, Data Protection Reform, BREXIT, National Data Strategy, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Article 89 UK GDPR, Recital 159 UK GDPR, Recital 33 UK GDPR, Article 14 UK GDPR, Recital 62 UK GDPR, Disproportionate effort, Article 6(1)(f) UK GDPR, Political processing, Article 6 UK GDPR, Special Category Personal Data, Schedule 1 Data Protection Act 2018, Anonymity, Anonymous Data, Article 4(1) UK GDPR, the Council of Europe’s Convention 108, the Council of Europe Convention 108, Privacy management programme, Data Protection Officer, Article 37 UK GDPR, Data Protection Impact Assessment, DPIA, Article 35 UK GDPR, Article 30 UK GDPR, Records of Processing Activities, Article 36 UK GDPR, Prior Consultation, Article 12(5) UK GDPR, Manifestly Unfounded or Excessive, Article 45(2) UK GDPR, International data transfers, Adequacy Decision, s.17B(1) Data Protection Act 2018, Alternative Transfer Mechanisms, Article 46 UK GDPR, Law enforcement processing, Part 3 Data Protection Act 2018, Part 4 Data Protection Act 2018, Cookie Consent, Regulation 6 Privacy and Electronic Communications Regulations, Regulation 22(2) Privacy and Electronic Communications Regulations, Soft Opt-In, Marketing, Regulatory Enforcement, Information Commissioner, Statutory Duties, Statement of Strategic Priorities, Expert Panel, Technical Reports, Notice of Intent, Final Penalty Notice, AI, Artificial Intelligence, Article 22 UK GDPR, Automated Processing, Voluntary Undertakings, Data Breach Reporting, Article 33 UK GDPR, Article 15 UK GDPR, Data Subject Access Request, Reverse Transfers, Article 49 UK GDPR, Derogations, s.35 Digital Economy Act 2017, Data Sharing, Algorithm Transparency, Schedule 1 Part 2 Data Protection Act 2018, Substantial Public Interest, Biometric Data, Impact Assessments, Legitimate Interests Assessment, Biometrics Commissioner, Smart Data Schemes, Data Intermediaries, Article 46(2)(f) UK GDPR, Certification Regime, Surveillance Camera Commissioner, Schedule 16 paragraph 2(2) Data Protection Act 2018, Data Protection & Digital Information BillComment

I Always Feel Like Somebody's Watching Me

I Always Feel Like Somebody's Watching Me

In this presentation, to coincide with London Tech Week 2022 and the Future of Work Summit, Handley Gill identifies the legal and regulatory issues arising from the deployment of employee monitoring and surveillance technologies in the hybrid workplace, and provides guidance on how to establish a compliant programme.