Handley Gill
LEGAL, REGULATORY & COMPLIANCE CONSULTANTS

Handley Gill Limited

Our expert consultants at Handley Gill share their knowledge and advice on emerging data protection, privacy, content regulation, reputation management, cyber security, and information access issues in our blog.

Sifting Out Data Protection Rights?
Sifting Out Data Protection Rights?

The Government has prepared a draft statutory instrument, The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023, to amend the UK GDPR and Data Protection Act 2018, and laid it before the Sifting Committees. The SI would re-define post-Brexit the definition of fundamental rights and freedoms in data protection legislation. Handley Gill’s specialist data protection consultants consider the implications of the SI for the enforcement of data protection rights across the UK.

Read More
Nicola CainDepartment for Science Innovation & Technology, DSIT, Data Protection, Personal Data, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Data Protection Act 2018, Brexit, Retained EU Law (Revocation and Reform) Bill, European Union (Withdrawal) Act 2018, The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023, European Convention on Human Rights, ECHR, Human Rights, Human Rights Act 1998, Fundamental Rights & Freedoms, Convention Rights, Article 8 European Convention on Human Rights, Article 8 ECHR, Right to Private and Family Life, Right to respect for private and family life, Article 8 European Charter of Fundamental Freedoms, Charter of Fundamental Rights of the European Union, (1) Satakunnan Markkinapörssi Oy and (2) Satamedia Oy v Finland, Information Commissioner, Privacy, Data Controller, REUL (Revocation and Reform) Act 2023, REUL (Revocation and Reform) Act 2023 Statutory Instruments, Retained EU Law (Revocation and Reform) Act 2023Comment
AI Bootcamp Part I
AI Bootcamp Part I

In Part 1 of our 5 part Artificial Intelligence (AI) Bootcamp, we consider the terms and concepts needed to understand what AI is and how it works, including the difference between AI and machine learning, and what is meant by generative AI, LLMs, foundation models, neural networks and deep learning. In Parts 2-4 of our AI Bootcamp, we will consider the risks of developing, using and even not using AI, while in Part 5 of our AI Bootcamp, we will focus on AI regulation.

Read More
Nicola CainAI, Artificial Intelligence, AI Bootcamp, Artificial Intelligence Bootcamp, Introduction to AI, AI 101, Technology, Tech, TECH REGULATION, Technology Regulation, Machine Learning, Supervised Machine Learning, Unsupervised Machine Learning, Reinforcement Machine Learning, Generative AI, Generative Artificial Intelligence, Neural Networks, Artificial Neural Network, Simulated Neural Networks, ANNs, SNNs, Deep Neural Networks, Deep Learning, Large Language Models, LLMs, ChatGPT, OpenAI, DeepMind, Google, Royal Free NHS Foundation Trust, Streams, Health Tech, Turing Test, Foundation Model, Frontier AI, AI hallucinationsComment
On Hand July 2023
On Hand July 2023

July 2023 edition of Handley Gill’s monthly digital newsletter, with all the latest developments in data protection (UK, EU and global), cyber security, AI and machine learning, content regulation, open justice, access to information, reputation management and digital markets regulation. Presented in a readily digestible digital format, those who prefer the traditional newsletter format can export the newsletter to pdf.

Read More
Nicola CainData Protection, PERSONAL DATA, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, Cyber Security, CONTENT REGULATION, Content Moderation, Reputation Management, Libel, Slander, Open Justice, Malicious Falsehood, Misuse of Private Information, Privacy, Data Privacy, AI, Artificial Intelligence, Digital Markets Regulation, Access to Information, Freedom of Information Act 2000, Adequacy Decision, US Adequacy Decision, EU-US Data Privacy Framework, Trans-Atlantic EU-US Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Freedom of Expression, Free Speech, Freedom of Speech, Information Commissioner, Special Purposes, Special Purposes Processing, Journalism, Journalism Code, Journalism Exemption, Data protection and journalism code, Facial Recognition, Right to be Forgotten, CBPR Form, Global Cross Border Privacy Rules Forum, Pornography, Surveillance, Biometrics Commissioner, Surveillance Camera Commissioner, Digital Markets Act, Data Subject Rights, DATA SUBJECT ACCESS REQUEST, DSAR, SAR, Retained EU Law, Human Rights, European Convention on Human Rights, Article 8 European Convention on Human Rights, Article 10 European Convention on Human RightsComment
So you’ve been debanked…
So you’ve been debanked…

Handley Gill’s data protection consultants consider the implications of the data subject access request (DSAR) submitted by Nigel Farage in the context of his de-banking dispute with Coutts & Co and its parent company Natwest, and advise how individuals can make a data subject access request (DSAR).

Read More
Nicola CainData Protection, Personal Data, GDPR, UK GDPR, General Data Protection Regulation, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, Article 15 GDPR, Article 15 UK GDPR, DATA SUBJECT ACCESS REQUEST, DSAR, SAR, Subject Access Request, Retained EU Law, Data Protection & Digital Information (No.2) Bill, Data Protection & Digital Information Bill, Data Protection Reform, Nigel Farage, Coutts & Co, Natwest, Alison Rose, Information Commissioner, Information Commissioner's Office, Data Regulation, Data enforcement, Financial Conduct Authority, FCA, ICO, AML, Anti-Money Laundering, Know Your Customer, KYC, Banking, Financial Services, Data Processing, SPECIAL CATEGORY PERSONAL DATA, Political Opinions, Religious or Philosophical Beliefs, Article 9 UK GDPR, Article 9 GDPR, Peter Flavel, Politically Exposed Person, PEP, Money Laundering Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, Money Laundering Regulations, (SI 2017/692), Freedom of Expression, Free Speech, Financial Services and Markets Act 2023, HM Treasury, Freedom of Speech, Discrimination, Protected Characteristics, Religion or Belief, Data Subject Rights, Data Subject Access Request, Retained EU Law (Revocation and Reform) BillComment
Certify...certify me!
Certify...certify me!

Handley Gill’s specialist data protection consultants consider the options and certification requirements for US entities importing personal data from the EEA following the adoption of the European Commission’s adequacy decision in respect of the Trans-Atlantic EU-US Data Privacy Framework, providing a lawful basis for transferring personal data to the US under the GDPR.

Read More
Nicola CainData Protection, Data Privacy, PERSONAL DATA, GDPR, General Data Protection Regulation, GENERAL DATA PROTECTION REGULATION, Regulation (EU) 2016/679, Data Transfer, Restricted International Data Transfers, Restricted Data Transfer, International Transfers, International data transfers, US Data Transfers, EU-US DPF, EU-US Data Privacy Framework, SCCs, Modernised SCCs, Supplementary Measures, Transatlantic Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Transfer Risk Assessment, Transfer Impact Assessment, Transfer Risk Assessment Tool, Data transfer agreement, TADPF, Trans-Atlantic EU-US Data Privacy Framework, Trans-Atlantic EU-US Data Privacy Framework Principles, DPF Principles, Privacy Shield, Privacy Shield Principles, EU-US DPF Certification, Privacy Shield Certification, Privacy Shield Self-Certification, Schrems II, Personal Data Transfer, Personal Data Export, Data exporter, Data Importer, Safe Harbor, Chapter 5 GDPR, Article 44 GDPR, Article 45 GDPR, Adequacy Decision, US Adequacy Decision, EUROPEAN COMMISSION, C(2023) 4745, TADPF Certification, Data Controller, Data Processor, Data ExporterComment
Freedom from the tyranny of supplementary measures
Freedom from the tyranny of supplementary measures

Handley Gill Limited’s specialist data protection consultants consider the impact of the European Commission’s adequacy decision in respect of the Trans-Atlantic EU-US Data Privacy Framework and the steps controllers and processors should take in relation to transfers of personal data from the EEA and UK to the USA.

Read More
Nicola CainData Protection, Personal Data, GDPR, General Data Protection Regulation, Regulation (EU) 2016/679, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Data Transfer, Personal Data Transfer, International Transfers, International data transfers, Safe Harbor, Privacy Shield, EU-US Data Privacy Framework, Transatlantic Data Privacy Framework, Trans-Atlantic Data Privacy Framework, Chapter 5 GDPR, Chapter 5 UK GDPR, Article 44 GDPR, Article 44 UK GDPR, Article 45 GDPR, Article 45 UK GDPR, Article 45(2) GDPR, Article 45(2) UK GDPR, Adequacy Decision, Schrems II, Adequacy Regulations, Section 17A Data Protection Act 2018, S.17A Data Protection Act 2018, S.17A DPA 2018, DPA 2018, Data Protection Act 2018, Standard contractual clauses, Standard data protection clauses, Supplementary Measures, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, Transfer Risk Assessment, Transfer Impact Assessment, International Data Transfer Agreement, International Data Transfer Addendum, IDTA, SCCs, Modernised SCCs, Modernised Standard Contractual Clauses, Executive Order 14086, Qualifying State, TADPF, US Data Transfers, UK-US Data Bridge, Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, FISA 702, Prism, Upstream, EU-US DPF, Data Controller, Data Processor, Data exporter, Data ImporterComment
Licence to hack?
Licence to hack?

Home Office Minister Lord Sharpe has confirmed that, following intensive lobbying by pockets of the cyber security industry, the government intends to pursue the introduction of a statutory public interest defence to the offences under the Computer Misuse Act 1990 (‘CMA’). Handley Gill Limited’s consultants consider the implications for cyber resilience, the protection of personal data and IP, and the ability of law enforcement to prosecute offences.

Read More
Nicola CainCyber Security, Cyber Resilience, Hack, Hacking, Computer Misuse Act 1990, CMA, CMA 1990, CMA offence, Home Office, Lord Sharpe, Lord Clement-Jones, Sir Patrick Vallance, Pro-Innovation Regulation for Digital Technologies Review, Data extraction, Public Interest, Public Interest Defence, Computer Misuse Act 1990 Call for Information, Computer Misuse Act 1990 Consultation, CMA working group, Computer Fraud and Abuse Act, CFAA, Department of Justice, US DoJ, Good-faith security activity, Legitimate cyber security activity, Section 170 Data Protection Act 2018, s.170 Data Protection Act 2018, S.170(2)(c) Data Protection Act 2018, S.170 DPA 2018, Unlawful obtaining of personal data, Copyright Designs and Patents Act 1988, Section 107 Copyright Designs and Patents Act 1988, S.107 Copyright Designs & Patents Act 1988, S.107 CDPA 1988, Copyright, Consultation Response, Statutory defence, Hansard Volume 831 Column 993 03 July 2023, Computer Misuse Act 1990 defence, CMA defenceComment
Balancing act… falls off a cliff
Balancing act… falls off a cliff

Handley Gill Limited’s consultants consider the implications of the withdrawal of the Bill of Rights for freedom of speech, the protection of confidential journalistic sources and defamation, data protection, and misuse of private information  claims against the media.

Read More
Nicola CainBill of Rights, Human Rights Act 1998, Human Rights, s12 Human Rights Act 1998, Conservative Party manifesto, Human rights reform, Freedom of Speech, Free speech, Freedom of Expression, Article 10 ECHR, Article 10 European Convention on Human Rights, Confidential Source, Source Protection, Journalistic Source, Protection of journalistic sources, Clause 4(1) Bill of Rights, Clause 21 Bill of Rights, Clause 22 Bill of Rights, Injunction, Injunctive Relief, Prior restraint, s10 Contempt of Court Act 1981, Section 12 Human Rights Act 1998, Section 10 Contempt of Court Act 1981, Draft Media Bill, Bill 117 2022/23, s.40 Crime and Courts Act 2013, Section 40 Crime and Courts Act 2013, SLAPP, SLAPPs, Anti-SLAPP, Strategic Lawsuit Against Public Participation, Strategic Lawsuits Against Public Participation, Economic Crime and Corporate Transparency Bill, Chilling effect, Press Regulation, IMPRESS, Press Recognition Panel, Reputation Management, Media Law, Defamation, Libel, Slander, Privacy, Misuse of Private Information, Data ProtectionComment
Pride 2023: Take pride in your processing
Pride 2023: Take pride in your processing

Effective data protection compliance measures can promote, empower and protect the LGBTQIA+ community and can not only assist organisations in identifying and eliminating discrimination, but also in supporting LGBTQIA+ individuals and enabling them to have their gender identity and sexual orientation recognised.

Read More
Nicola CainDATA PROTECTION, PERSONAL DATA, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, GDPR, GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, DPA 2018, SPECIAL CATEGORY PERSONAL DATA, SENSITIVE PERSONAL DATA, SEX LIFE, SEXUAL ORIENTATION, GENDER, PRIDE, LGBTQIA+, Inferred personal data, Data protection impact assessment, DPIA, Article 4(1) UK GDPR, Article 4(1) GDPR, Article 9(1) UK GDPR, Article 9(1) GDPR, Section 10 Data Protection Act 2018, S.10 Data Protection Act 2018, S.10 DPA 2018, Schedule 1 Data Protection Act 2018, Schedule 1 Part 2 paragraph 8 Data Protection Act 2018, Schedule 1 Part 2 paragraph 16 Data Protection Act 2018, Schedule 1 Part 2 paragraph 17 Data Protection Act 2018, Article 5(1)(d) UK GDPR, Article 5(1)(d) GDPR, Article 17 UK GDPR, Article 17 GDPR, Right to be Forgotten, Article 21 UK GDPR, Article 21 GDPR, Article 25 UK GDPR, Article 25 GDPR, Article 5(1)(c) UK GDPR, Article 5(1)(c) GDPR, Appropriate Policy Document, Data ControllerComment
A bridge to nowhere?
A bridge to nowhere?

A commitment to establishing a UK-US data bridge, which would take the form of adequacy regulations being issued by the Secretary of State pursuant to section 17A Data Protection Act 2018, has been announced. Since this bridge is likely to be contingent on the European Commission issuing its own adequacy decision, and the draft has recently been rejected by the European Parliament, data exporters will be reliant on the Commission ramming through the roadblock or will find themselves stuck in traffic on the UK-US data flyover.

Read More
Nicola CainData Protection, Personal Data, GDPR, General Data Protection Regulation, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Privacy Shield, Schrems II, Transatlantic Data Privacy Framework, Adequacy Decision, EUROPEAN COMMISSION, Safe Harbor, Adequacy Regulations, UK Adequacy, Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, EU-US Data Privacy Framework, UK-US Data Bridge, Chapter 5 GDPR, Chapter 5 UK GDPR, Article 45 GDPR, Article 45 UK GDPR, Article 46 GDPR, Article 46 UK GDPR, Data Protection Act 2018, Section 17A Data Protection Act 2018, s17A Data Protection Act 2018, Qualifying State, Executive Order 14086, TADPF, European Parliament, Committee on Civil Liberties, Committee on Civil Liberties Justice & Home Affairs, LIBE Committee, European Data Protection Board, EDPB, Opinion 5/2023, German-American Data Protection Day, DoJ, Department of Justice, Standard contractual clauses, Standard data protection clauses, Supplementary Measures, Transfer Risk Assessment, Transfer Impact Assessment, Derogation, Data Transfer, Data transfer agreement, US Data Transfers, International Transfers, International data transfers, International Data Transfer Risk Assessment, Data Controller, Data Processor, Data exporter, Data ImporterComment
Slapp down
Slapp down

Additional protections to be granted to defendants to protect free speech in defamation, data protection and misuse of private information claims concerning economic crime from SLAPPs (Strategic Lawsuits Against Public Participation) in government amendment to Economic Crime and Corporate Transparency Bill.

Read More
Nicola CainSLAPPs, Strategic Lawsuit Against Public Participation, Defamation, Libel, Slander, Data Protection, Data Litigation, Freedom of Expression, Right to Freedom of Expression, Right to freedom of expression and information, Misuse of Private Information, Article 10 European Convention on Human Rights, Article 10 ECHR, Article 8 ECHR, Article 8 European Convention on Human Rights, Article 7 European Charter of Fundamental Freedoms, Article 8 European Charter of Fundamental Freedoms, Economic Crime and Corporate Transparency Bill, Special Purposes Exemption, Special Purposes Processing, Journalism Exemption, Journalism, Journalism Art or Literature, Economic crime, Civil Procedure Rules, Costs budgeting, Freedom of Speech, Free speech, Combatting economic crime, Combating economic crime, Harassment, Litigation, Privacy, Strategic Lawsuits Against Public Participation, SLAPP, ANTI-SLAPP, AntiSlapp, Reputation ManagementComment
CrapITa
CrapITa

Handley Gill’s data protection consultants consider recent supply chain cyber attacks, including the unfolding of the recent Capita and Zellis / MOVEit data breaches, and identify the steps data controllers should take when engaging data processors as part of their supply chain or giving third parties access to personal data, and the lessons to be learned for vendor management throughout the data processing lifecycle.

Read More
Nicola CainData Protection, Personal Data, Information Security, Cyber Security, Cyber Resilience, Cyber Attack, Data Breach, Supply Chain Risk, Supply Chain Security, Vendor Management, Capita, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, Information Commissioner, Information Commissioner's Office, ICO, Pensions Regulator, Financial Conduct Authority, FCA, Data subjects, Compensation, Data litigation, Ransom, Ransom Payment, Department for Science Innovation & Technology, DSIT, Cyber Security Breaches Survey 2023, Article 25(1) UK GDPR, Article 25(1) GDPR, Data Controller, Data Processor, Data Processing Agreement, DPA, Data Processing, Article 28 GDPR, Article 28 UK GDPR, Article 32 GDPR, Article 32 UK GDPR, Cyber Insurance, Cyber Insurance Cover, Liability, Data protection impact assessment, DPIA, Administrative fine, Monetary penalty, Article 82(3) UK GDPR, Article 82(3) GDPR, Regulatory Action Policy, Article 33 UK GDPR, Article 33 GDPR, Article 34 UK GDPR, Data Breach Notification, Breach Response Plan, Incident Response Plan, Injunction, Injunctive Relief, Article 82 GDPR, Article 82 UK GDPR, CVE-2023-34362Comment
Data Downgrade Down Under?
Data Downgrade Down Under?

Handley Gill Limited’s data protection consultants consider the implications of the 2021 Free Trade Agreement between the UK and Australia - taking effect on 31 May 2023 - for the protection of personal data and the ease of international transfers of personal data.

Read More
Nicola CainBREXIT, UK, United Kingdom, Australia, Data Protection, Personal Data, Privacy, Data Privacy, GDPR, General Data Protection Regulation, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, DATA PROTECTION ACT 2018, Section 17A Data Protection Act 2018, Adequacy Decision, Adequacy Regulations, New Zealand, European Commission, Secretary of State for Science Innovation & Technology, Marketing, Direct Marketing, Consent, Marketing Consent, Privacy Act, Privacy Act Review, Foreign Commonwealth and Development Office, Foreign Office, Department for Business and Trade, Department for Science Innovation and Technology, Department for Culture Media & Sport, Data Transfer, Restricted Data Transfer, Restricted International Data Transfers, International data transfers, Standard contractual clauses, Derogations, Data Controller, Data ProcessorComment
GDPR-versary
GDPR-versary

Handley Gill Limited’s specialist consultants have compiled 5 facts about the application of the General Data Protection Regulation (GDPR) to mark the 5th anniversary of the GDPR taking effect across the EEA on 25th May 2023. Happy 5th birthday GDPR!

Read More
Nicola CainData Protection, Personal Data, GDPR, GDPR Anniversary, EU Law, Retained EU Law, Retained EU Law (Revocation and Reform) Bill, Brexit, Data Protection Enforcement, Data Protection Legislation, Data Breaches, Data Breach Statistics, Data Breach Notification, Data Breach Reporting, Administrative fine, AEPD, Agencia Espanola de Proteccion de Datos, Data Protection Commission, Supervisory Authority, EUROPEAN COMMISSION, Adequacy Decision, General Data Protection Regulation, Regulation (EU) 2016/679, Meta Platforms Ireland LimitedComment
Golden Hour Extended
Golden Hour Extended

Handley Gill Limited’s consultants consider the impact of the government’s announced delay to the promised post-Brexit sunset of all retained EU law by the end of 2023 and amendment of the Retained EU Law (Revocation and Reform Bill) on the UK’s data protection legislative framework.

Read More
Nicola CainData Protection, Personal Data, Brexit, Retained EU Law (Revocation and Reform) Bill, UK GDPR, UK GENERAL DATA PROTECTION REGULATION, Data Protection Act 2018, Privacy & Electronic Communications Regulations, Brexit Freedoms Bill, Data Protection & Digital Information (No.2) Bill, Data Protection Reform, Kemi Badenoch, Secretary of State for Business & Trade, Prime Minister, Boris Johnson, Rishi Sunak, Jacob Rees-Mogg, Minister for Brexit Opportunities & Government EfficiencyComment
On Hand April 2023
On Hand April 2023

April 2023 edition of Handley Gill’s monthly digital newsletter, with all the latest developments in data protection (UK, EU and global), cyber security, AI and machine learning, content regulation, open justice, access to information, reputation management and digital markets regulation. Presented in a readily digestible digital format, those who prefer the traditional newsletter format can export the newsletter to pdf.

Read More
Nicola CainData Protection, Personal Data, GDPR, UK GDPR, Data Protection Act 2018, DPA 2018, Privacy and Electronic Communications Regulations, PECR, Data Reform Bill, Data Protection and Digital Information (No. 2) Bill, Information Commissioner, Content Regulation, AI, Artificial Intelligence, Machine Learning, Cyber Security, Cyber Resilience, Digital Markets Regulation, AI Regulation, Reputation Management, Defamation, Privacy, Data Privacy, Libel, Slander, Malicious Falsehood, Misuse of Private Information, Breach of Confidence, Digital Services Act, Data Subject Rights, Data Subject Rights Request, Data Subject Access Request, Global Cross Border Privacy Rules Forum, IMPRESS, Press Regulation, DSIT, Department for Science Innovation & Technology, Cyber Security Breaches Survey 2023, Digital Markets Competition & Consumers Bill, EDPB, European Data Protection Board, Data Breach, Data Breach Reporting, Data Breach Notification, Facial Recognition, Ofcom, On Hand, Product Security and Telecommunications Infrastructure Act 2002Comment
On Hand March 2023
On Hand March 2023

March 2023 edition of Handley Gill’s monthly digital newsletter, with all the latest developments in data protection, cyber security, AI and machine learning, content regulation, access to information and reputation management. Presented in a readily digestible digital format, those who prefer the traditional newsletter format can export the newsletter to pdf.

Read More
Nicola CainOn Hand, Data Protection, Personal Data, GDPR, UK GDPR, DPA 2018, Data Protection Act 2018, Data Protection Reform, Data Reform Bill, Data Protection & Digital Information Bill, Data Protection & Digital Information (No.2) Bill, AI, Artificial Intelligence, Machine Learning, Cyber Security, Cyber Resilience, Age Appropriate Design Code, European Data Protection Board, EDPB, Department for Science Innovation & Technology, DSIT, Privacy, Misuse of Private Information, Information Commissioner, ICO, Data Protection Officer, DPO, Data protection Legislation, Information Rights, Access to Information, Freedom of Information Act 2000, FOIA, Human Rights, Content Regulation, Article 8, Article 8 ECHR, Article 8 European Convention on Human Rights, First Tier Tribunal (Information Rights), European Court of Human Rights, Data Breach, Data Breach Reporting, AI Regulation, Reputation Management, Libel, Slander, Defamation, Breach of Confidence, Confidential Information, Open JusticeComment