Category: News

Data Protection and the bulk personal datasets covering political campaigns, Referendums, Electoral Rolls etc

Were you phoned up by the Leave or Remain Campaigns on your ex-directory telephone number during the Referendum Campaign (probably in breach of PECR)? I was.  If so, how did they my number? How did one of the Campaigns, for example, know who was a Millwall fan so the caller from a Campaign gloated (sorry, I mean commiserated) with him or her over the 3-1 defeat by Barnsley at Wembley in May? Intrigued, I have done a little digging; first

Read article

GDPR and Brexit: what are the options?

Last week’s Brexit vote in the Referendum has created some uncertainty as to whether or not the UK will implement the General Data Protection Regulation (GDPR).  The answer to this question is that the UK is very likely to implement the GDPR or something of a very similar standard with few exceptions. This blog explains why this is the case and explores some other options. When the UK leaves the European Union (EU), it may become a territory outside the

Read article

Message to data subjects: national security purpose is free of constraints such as lawful or compatible processing

Today, the Government will whip its controversial Investigatory Powers Bill (IP Bill) through its Parliamentary Report stage; the Bill, in part, provides powers that permit the national security agencies to amass bulk personal datasets where the majority of personal data in a bulk dataset relates to data subjects who are not of interest to these agencies. The Government has so far ignored the data protection recommendations of the draft IP Bill Committee which asked for important data protection considerations to

Read article

Poor staff training highlighted by ICO in audits, undertakings, follow-ups and now in an Enforcement Notice

At our last UPDATE session in May 2016, I raised five recent Undertakings and several audit summaries which focused around the lack of staff training or training quality. I predicted that it would not be long before a controller would be on the receiving end of Enforcement for failing to train its staff. Well this has happened. An Enforcement Notice has been served on West Dunbartonshire Council (see references) for failing to implement detailed staff training.  The Notice requires West

Read article

Marketing by opt-in, opt-out, consent or legitimate interest? Consider your ABC

If a=b and b=c then it follows that a=c. So, how does this set of simple equations relate to data protection? Well if direct marketeers, privacy advocates and supervisory authorities recognised that a=c then most of the debate concerning data protection and the marketing purpose would be settled. Don’t believe me? Just follow the argument under the current Act (DPA) or indeed the General Data Protection Regulation (GDPR). All across Europe (and especially the UK) there has been a debate

Read article

Will the UK’s approach to the GDPR be harmonised?

If Member States can, by law, exercise legislative “flexibility” when implementing 50+ Articles of the General Data Protection Regulation (GDPR), how can the Regulation ever become harmonised across European Union? Pose this important question another way: given that the UK Government intends to use legislative flexibility to the maximum in favour of the interests of controllers (see report on meeting with the Minister in January; references), how do we know that the UK will not enact something that could be

Read article

Information Commissioner attacks the length of Fair Processing Notices

In the week that Elizabeth Denham was announced as the next UK Information Commissioner, the outgoing Commissioner has made several controversial statements about fair processing notices which are to change dramatically in length with the advent of a General Data Protection Regulation (GDPR). The Commissioner noted that when Articles 14 and 14A of the GDPR came into force, he was expecting privacy policies of more than 5,000 words to become the norm. To avoid this prospect, the Commissioner intimated that

Read article

Give NGOs the tools and they will finish the job: Article 76 & Recital 112 of the GDPR should keep Data Controllers “honest”

Note added 24 May: Article 76 and Recital 112 relates to the agreed text of the GDPR that was circulating at the time of the blog; with respect to the OJ version of the GDPR, the references are to Article 80 and Recital 142 Those concerned with data protection and privacy have their work cut-out in the UK. On top of understanding what the General Data Protection Regulation (GDPR) and the Data Protection Directive in the field of law enforcement

Read article

“Leave” or “Stay” in the Referendum? GDPR has to be implemented by the UK whatever the result.

This brief blog is to explain why, “in” or “out”, the UK has to implement the General Data Protection Regulation (GDPR). This is important given that some organisations might think that a “Leave” vote might change matters with respect to the GDPR compliance (especially as the Cabinet Minister responsible for GDPR implementation, John Whittingdale, is a prominent “outer”). Obviously, if the vote in June is for “Stay” then the UK remains a Member of the European Union (EU) and the

Read article

Put privacy first! Parliamentary report calls for national security agencies to apply Data Protection Principles

For a long time, I have been arguing that the national security agencies should apply the data protection principles to their processing of personal data subject, if necessary, to exemptions from subject access and fair processing requirements. Today’s report from the Joint Committee on the Draft Investigatory Powers Bill (DIP) supports that position. In summary, if the criminal intelligence processed by the police relating to serious crime can be subject to most data protection requirements without mishap (since the 1984 Act),

Read article
Search Hawktalk blogs by month :
Select Date
View blogs by category:
Hawktalk Taxonomy