Category Thought Leadership

Interview with the World Advertising Research Council (WARC) on what marketers need to do now about the GDPR

Read More

Landmark judgment in data protection action against Morrisons at High Court in UK

Supermarket giant Morrisons has been found vicariously liable for the actions of a rogue member of staff who stole the personal data of thousands of workers and posted it online in revenge for disciplinary action taken against him by the company.

On 1 December 2017, Mr Justice Langstaff at the High Court ruled that Morrisons was vicariously liable for the personal data breach that leaked their names, addresses, salaries, bank account details, national insurance and other sensitive personal data on line.

In July 2015, former internal auditor Andrew Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data and jailed for eight years.

The trial heard that his motive appeared to have been a grudge over a previous i...

Read More

My ‘light bulb’ moment on the GDPR

On Tuesday 31 October, President Donald J Trump gave the executive order to release previously withheld files relating to the 1963 assassination of John F Kennedy.

Among the many black and white TV news clips of speeches made by JFK that I’ve been watching across several TV networks that are marking one of the darkest hours in American history, one sentence in particular struck a chord with me and perhaps many of you reading this too:

“In each of us there’s a private hope and dream which, if fulfilled, can be translated into benefit for everyone.”

That may sound like a lofty ideal, but I sincerely believe that as data protection professionals we all need to have the conviction to want to make a positive difference for both the company and organisation that we are part of as well as...

Read More

Take a Chance on Me? Not worth the risk when it comes to the GDPR

The cost of compliance is much less than the price of failure.

To most readers of my blog, this adage may sound obvious, with respect to the General Data Protection Regulation (Regulation 2016/679). Nonetheless, it’s advice isn’t universally observed.

Some months ago, I was talking to a director of a well-known European financial services company about the impact Regulation 2016/679 would have on the business. But I wasn’t fully prepared for his response. “We can afford to pay the fines,” he said.

Wow!

There then followed a couple of seconds of silence as I composed myself. Had I really heard this or had I imagined it? Was it boastful, perhaps intended to impress or simply a bold statement of fact?

I remarked this was interesting...

Read More

Do you still worship at the Temple of Big Data?

Major personal data breaches are happening at a rate of one a day – Equifax, BUPADeloitteNHSNottingham County CouncilIslington CouncilHCA Healthcare and many, many more. Wanna Cry? (I bet you do).

Do you live in fear of whether you’re next? It doesn’t have to be this way. We are transitioning to an era in which individuals have both the skills and the opportunities to choose how they manage and share their personal data to achieve a range of beneficial outcomes.

Digital evangelists like Stephen Deadman, Global Deputy Chief Privacy Officer at Facebook remains optimistic about the future, rather than terrified by it...

Read More

Legality of Standard Contractual Clauses (SCC’s) hangs in the balance awaiting decision by CJEU

Ireland’s High Court has just ruled today (Tuesday 3 October 2017) that the decision to ban the use of Standard Contractual Clauses (SCC) by social media giants like Facebook, Microsoft and Google to transfer users’ personal data to the US must be initially decided by the Court of Justice of the European Union (CJEU).

Giving her judgment in open court, Irish High Court Judge Caroline Costello said: “I have decided to ask the Court of Justice for a preliminary ruling. European Union law guarantees a high level of protection to EU citizens…they are entitled to an equivalent high level of protection when their data is transferred outside of the European Economic Area.”

This of course looks like a spooky re-run of the Safe Harbor legal action brought by Max Schrems that resulted in the...

Read More

Interview with Liberum Investment Bank on the consequences of the GDPR for institutional investors

This is a short 5 minute filmed interview produced by Liberum Investment Bank for its clients in London and New York on the Directive 2016/679 (General Data Protection Regulation). Recorded in London in July 2017.

Copyright Liberum Investment Bank 2017.

 

Read More

It’s time to press the delete key

One of the most important and fundamental principles of data protection under Regulation 2016/679 (GDPR) is the Principle of Minimisation. Arguably, it’s the one principle can help satisfy the need to manage security, data protection and privacy objectives, especially with respect to the Internet of Things (IoT).

Under Art.5(1)(c), GDPR, the Data Controller must ensure that ‘processing of personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.’ This is about ensuring that staff are only processing personal data in accordance with the purposes and once these have been satisfied, it’s safest to delete this personal data unless other legal grounds exist to hang on to it.

But the Principle of Minimisation is g...

Read More

Snooping by an employer on its workers will be a breach of the GDPR

In its latest Opinion, adopted on the 8 June and published on 29 June 2017, the Art.29 Data Protection Working Party (WP29) makes a fresh assessment of the balance between legitimate interests of the employer and the reasonable privacy expectations of employees working within the European Union.

The concept of ‘employee’ is widened and includes those with a contract of service as well as contractors working under a contract for services. The Opinion is intended to cover all situations where there’s an employment relationship, irrespective of whether this relationship is based on an employment contract.

WP29 also highlighted the risks posed by new technologies deployed in the workplace and the need for the employer to undertake a proportionality assessment before deploying such measur...

Read More

Special considerations when using Cloud Service Providers under the GDPR

Regardless of the size of the organisation, Data Controllers are entering arrangements with Cloud Service Providers in the hope of improving customer service levels coupled with reductions in processing costs and enhanced personal data security.

It’s important for a Data Controller to understand the different Cloud Service models to select the one that’s best aligned with its risk appetite and business requirements.

Many are often apprehensive about cloud security, however cloud storage with a reputable provider will likely be more secure than on-premises storage because protecting data is the core function of the business.

Unlike a Data Controller that has the entire organisation to consider, a Cloud Service Provider’s only business is to securely process a Data Controller’s data and ...

Read More