Upper Tribunal undermines data breach reporting under the UK_GDPR?
The Upper Tribunal (UT) appeal [DSG Retail Limited -v- ICO; see references] is important even though it relates to the DPA1998; the judgement has the potential to undermine the data breach reporting requirements of the UK_GDPR/DPA2018. This blog explains why this is the case, why legislative changes might prove to be necessary and, for good measure, provides details of two errors in the UT’s analysis. The appeal concerns the meaning of “personal data” in the context of the security obligations




