Category: Data Protection

Yesterday, the Taskforce on Innovation, Growth and Regulatory Reform (TIGRR) reported to the Prime Minister on how the UK could, in general,  reshape its approach to regulation and seize new opportunities from Brexit with its newfound regulatory freedom.  Unsurprisingly, changes to the UK_GDPR are high on TIGRR’s list. In summary, under the heading “Replace GDPR with a new UK framework for data protection”,  perhaps with a “UK Framework for Citizen Data Rights”, TIGRR propose:  a Common Law approach towards enforcement;

Like many, I did not know about the Ministerial Directions that require NHS Digital to create a national database of GP medical records until the indefatigable “Med Confidentiality” NGO raised its profile.  In this blog, I will make some comments about data protection safeguards, most of them statutory,  which appear to me to be missing. NHS Digital, at the behest of the Secretary of State for Health, has been given Directions to take copies of medical records from all GP surgeries in

The Court of Appeal’s conclusion that the ‘Immigration Exemption’ in Schedule 2 to the DPA 2018 is not compliant with the GDPR creates two data protection headaches for Government. First, the Court’s method of determining the illegality of the immigration exemption (i.e. that the safeguards in Article 23(2) of the GDPR were missing from the UK’s DPA2018),  applies to ALL exemptions in Schedules 2 to 5.  So does this mean ALL exemptions in the DPA2018 are equally unlawful? Second, if

When I posted the blog on the return of the database state via the National Fraud Initiative (NFI), I knew I was going out on a limb.  Afterall, if one criticises a key Government initiative for being incredibly invasive of privacy, one hardly expects to be awarded two or three “back-of-the-hand” COVID contracts as a “thank you”. So it is a relief that the ICO’s response to NFI consultation on data matching (just published) has come to similar conclusions (see

The Government propose to expand the data matching capability of the Cabinet Office as legitimised by the Local Audit and Accountability Act 2014.  Data matching (and the associated data sharing) is to be extended from its current anti-fraud base to include any other criminal activity, debt recovery and data quality (e.g. improving accuracy of personal data). The proposals are described in a document entitled “Consultation on the expansion of the National Fraud Initiative Data Matching Powers” which also includes a

Can I wish blog readers a belated “Happy New Lockdown”. This blog considers two issues (a) the adequacy arrangements in the EU-UK Trade Agreement (the “Agreement”) and (b) electronic marketing provisions in the Agreement which might sink the “soft opt-in”. But first a reminder for readers to refer to the UK_GDPR and EU_GDPR from now on.  These two GDPR variants are established by the “Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019” (the “Brexit DP Regs”)