Category: Data Protection

[Note added: 16 March 2017. The Executive Order has been rescinded. However, the analysis of Privacy Act 1974 in the USA is valid.  It does not apply to EU nationals and even if it did, the analysis shows that there is very little in the way of privacy protection.  It appears to me to be data sharing legislation] President Trump’s Executive Order (Enhancing Public Safety in the Interior of the United States) has caused controversy over its temporary ban on all Muslims

A House of Lords Committee has heavily criticised the data sharing provisions in Part V of the Digital Economy Bill; it has reported that the provisions should not be supported in their current form. The Report confirms my comments in previous Blogs (see references) that the data sharing provisions (e.g. for efficient public sector service delivery, for research and statistics, for debt recovery and for fraud) are untrammelled. Namely the provisions: combined with the flexibility for Ministers to add to the

This blog tries to answer a simple question: “what can a data controller do if there are transfers between the UK and the European Union(EU) if the Article 50 button is pressed and there is a no subsequent agreement between the UK and the European Commission within the two-year timeframe?”. In other words, what happens if there is a very Hard Brexit? The assumptions I am therefore making are as follows: there is no deal re Brexit and the UK is

Happy New Year (and welcome back to the daily grind). This blog adds two further reasons why I think a post-Brexit UK is very unlikely to offer an adequate level of protection in terms of the General Data Protection Regulation (GDPR). One reason relates to recent comments made by Prime Minister Mrs May about human rights. The other relates to the non-compliance of the national security agencies with their existing data protection obligations under the Data Protection Act 1998 (DPA).

Adjournment debate on GDPR – last Monday December 12 Full debate on: https://hansard.parliament.uk/Commons/2016-12-12/debates/6EB0C615-2571-4B26-A75B-8CD1CF5FD854/EUDataProtectionRules Key quotes from the Minister for Digital and Culture (Matt Hancock) are below. "We were clear in the negotiations on the GDPR that any new data protection legislation needs to meet the need for high standards of protection for individuals’ personal data while not placing disproportionate burdens on businesses and organisations. The UK was successful in negotiating a more risk-based approach to the GDPR, allowing for greater flexibility

As promised in last Friday’s blog, an explanation why the data sharing provisions in Part V of the Digital Economy Bill (the “Bill”) should not be supported. The Bill completes its Commons stages today with hardly any detailed scrutiny of its data sharing provisions. In privacy terms, this blog shows that the data sharing proposals demonstrate: (a) a lack of understanding of how the Data Protection Act (DPA) works; (b) a failure to explain how the interference inherent in data sharing

Many commentators have reported the statement from the Secretary of State at the Department of Culture, Media and Sport (DCMS) that the UK Government is to implement the General Data Protection Regulation (GDPR). However, those who reported the announcement have failed to follow through with a detailed analysis of this position. For example, data controllers should not assume that UK’s adoption of the GDPR will automatically mean that the UK offers an adequate level of protection. This blog explains this

Clause 77 of the Digital Economy Bill will establish a statutory Direct Marketing Code of Practice that has the same status as the Data Sharing Code of Practice. This Code should finally put to bed all the controversial issues with respect to Direct Marketing (e.g. whether there should be “opt-in” or “opt-out”), the meaning of “consent” in the context of marketing and when it is possible to engage in Direct Marketing without the consent of the data subject. The Code,