Phil Lee

In our latest blog, our Head of Consultancy Louise Brooks gives a refresher on the lawful bases for processing, how consent compares to other lawful bases and consent management. Read it here: https://lnkd.in/e2tRd9SD #GDPR #consent #consentmanagement

2

LIVE WEBINAR: How to Adopt AI in Compliance with the GDPR 4th June | 3pm Join our consultant Mark James for: • How existing data protection laws such as the GDPR regulate AI use; • Assessing risk and mitigation strategies through DPIAs (data protection impact assessments); • Key data protection pitfalls to look out for when assessing AI tools; • Privacy by design as a concept for organisations striving for innovation; and • Our recommendations for AI success. Sign up here: https://lnkd.in/dmn-dnTW (Even if you can't attend, you'll still receive a copy of the slides and recording) #GDPR #dataprotection #AI

12

The ICO are cracking down on cookie compliance! Is your website taking the biscuit? 🍪 We’ve been talking to Tom Gell, data protection expert at Trust Keith • The DPO-aaS for Scale-Ups and ISO Serious, about cookies. You might think that you have this covered, but it’s a fast-moving area and many organisations don’t realise they are out-of-date and failing to comply with the law. Tom shares his list of the top 7 things you need to know below to help ensure you measure up... 1️⃣ There are two types of cookies 2️⃣ Analytical cookies  3️⃣ Other tracking technology 4️⃣ Changing law 5️⃣ 3rd party providers 6️⃣ "Reject all"  7️⃣ Countries If you want to discuss any of the above or if would like us to check your cookie policy for compliance please get in touch on info@legaledge.co.uk. You may also want to check out our previous blog on why do I need a cookie notice (linked below). #Cookies #Compliance #CookiePolicy #DataProtection Mitchell Omer

10

5 Comments

🚀 Exciting update! Introducing the ICO UK's BCR Addendum: a key document enabling EU BCRs to form Article 47 UK GDPR BCRs. Streamline your compliance with the latest from the Information Commissioner's Office. #GDPR #DataProtection #Compliance #BCR

4

📲 Data Protection Reform in the UK Data protection law is in a constant state of flux globally, driven by new guidance, cases, enforcement action, and emerging technologies (hello, generative AI!). The UK is no exception, especially post-Brexit. The journey began with the Data Protection and Digital Information Bill under Boris Johnson. It evolved through various stages and names, finally becoming the Data Protection and Digital Information Bill 2023. Despite much anticipation, progress stalled. There was hope it would pass before the summer recess, but... On 22 May, Rishi Sunak called for an election on 4 July. By 23 May, it was clear the Bill wouldn’t be part of the government's ‘wash-up’ session, leaving commentators to declare it “dead” for now. What’s next? If Labour wins, they might not prioritise data protection reform. However, there's a rumour of potential Labour-led reform this Autumn, which could also address AI. Stay tuned! Follow us on LinkedIn for the latest updates on this ever-changing landscape! 📲🔍 Click here for more Data Protection news: https://lnkd.in/enPmyRyf Louise Thompson Sarah Wheadon Kate S. #DataProtection #UKGDPR #UKLaw #TechNews #GenerativeAI #StayInformed

2

✅ GDPR (General Data Protection Regulation) The EU’s General Data Protection Regulation (GDPR) came into effect from May 2018, when it overlapped the UK Data Protection Act 1998. Well enough and wide-approached in scope, the new law brings a 21st century practices to data protection. Visit 👉 https://lnkd.in/gSxGn_xf for more information. #CyberSecurity #DataProtection #CyberAware #SecureData #DataPrivacy #CyberDefense #ITSecurity #DataSecurity #CyberThreats #NetworkSecurity #EncryptEverything #SecurityAwareness #SecureDigitalWorld #DataBreach #CyberCrime #SafeBrowsing #PhishingProtection #DigitalPrivacy

3

When does your organisation need a Data Protection Impact Assessment? Registered Social Landlords, as well as other organisations are subject to the UK General Data Protection Regulation (GDPR), and Article 35(1) requires that a Data Protection Impact Assessment (DPIA) should be undertaken before beginning any type of processing which is “likely to result in a high risk.” Claudia White's blog looks at the factors to consider👇 https://lnkd.in/evr_Mq3e #dataprotectionimpactassessment

9

1 Comment

Our new book, Mastering AI: A Guide for Data Protection Practitioners by DPAS founder Nigel Gooding, is finally out! 🙌 If you're a data protection professional looking for a guide to help you understand AI and how it relates to data privacy (in both the challenges and opportunities it poses), then you've come to the right place. Get it now for: 💻 eBook: £9.99 📗 Paperback: £22 📕 Hardback: £25 Click below to learn more and order yourself a copy today: https://lnkd.in/e5acFt4R Melanie Garnett Natalie Bennett Emma Martins Teresa Gudge #data #privacy #dataprotection #dataprivacy #ai #artificialintelligence #machinelearning #deeplearning #gdpr

20

2 Comments

The latest update from the data protection team explores the UK Information Commissioner's Office's strategic approach to regulating AI. Please click below to read the full update. #Technology #DataProtection

34

Data Protection By Design & By Default. Do your staff take this approach? To find out more about our Data Protection & GDPR Practitioner Course use the QR code or go to https://lnkd.in/eYsdHGcE #training #GDPR #dataprotection #course #infosec

1

A proposed overhaul of the Privacy Act would affect how organisations collect, use and manage data. We explain how this could affect you > https://loom.ly/3V2NlzI #CCIWA #privacyact #privacy #data Cass Wright

8

Recent UK guidance has been issued regarding the processing of personal data in the context of content moderation, particularly pertinent for organizations navigating the Online Safety Act (UK OSA), UK GDPR, and Data Protection Act (DPA 2018). This guidance is essential for organizations obligated to moderate content under the UK OSA or those offering content moderation services. It particularly applies to entities facilitating user-generated content (UGC), including media posts, reviews, and community forums. Organizations must establish a legal basis for processing personal data in the course of moderating content. This could include compliance with legal obligations, including under the UK OSA. When opting to rely on legitimate interests, it will be important to conduct a legitimate interest assessment. Remember to have appropriate policies in place too. Additional Considerations: 𝐂𝐨𝐧𝐭𝐞𝐧𝐭 𝐓𝐚𝐤𝐞𝐝𝐨𝐰𝐧 𝐒𝐎𝐏𝐬: Establish internal policies detailing obligations under UK OSA and procedures for content takedown.  𝐂𝐡𝐢𝐥𝐝𝐫𝐞𝐧’𝐬 𝐂𝐨𝐝𝐞: If dealing with data of individuals under 18, compliance with the Children’s Code is essential.  𝐃𝐏𝐈𝐀𝐬: Understand when and why Data Protection Impact Assessments are necessary.  𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬 𝐚𝐧𝐝 𝐓𝐫𝐚𝐧𝐬𝐩𝐚𝐫𝐞𝐧𝐜𝐲: Transparency with users regarding content moderation practices is crucial.  𝐀𝐈 𝐚𝐧𝐝 𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐢𝐨𝐧: Unique considerations arise when employing automated decision-making tools for content moderation.  𝐒𝐭𝐚𝐲 𝐔𝐩𝐝𝐚𝐭𝐞𝐝: Keep abreast of forthcoming amendments to UK data protection law through the Protection and Digital Information Bill. Navigating the intersection of content moderation and data protection requires diligence and a proactive approach. By adhering to guidance and staying informed about regulatory changes, organizations can ensure compliance while maintaining the integrity of their services.  #DataProtection #ContentModeration #UKOSA #UKGDPR 

8

In today’s business world, data protection is not just a “nice to have”; it’s an absolute necessity. Safeguarding your data is crucial for maintaining the trust and confidence of your clients. A data breach can lead to severe legal repercussions and significant damage to your reputation, which can be challenging to recover from. It’s essential to recognise that data protection isn't a one-off task. As your business grows, it becomes a continuous responsibility, requiring consistent attention on a monthly, weekly, and even daily basis. Effective data protection combines both legal and practical measures. This means not only adhering to legal requirements but also implementing best practices for data security. Your clients expect their data to be protected and managed responsibly. Any breach of this trust can leave your business in hot water, making it imperative to prioritise data protection at all levels of your business. Regular audits, employee training, and updated security protocols are all part of a robust data protection strategy. By prioritising data protection, you demonstrate your commitment to your clients and set a strong foundation for sustainable business growth. Just as your management accounts or client invoices are each a key business focus, you should make data protection a top priority. If you would like some more information on this, please contact us at Farringford Legal and we would be happy to guide you. We aren't scary I promise! 😃

4

1 Comment

𝗪𝗵𝗲𝗻 𝗶𝘀 𝗶𝘁 𝗼𝗸 𝗳𝗼𝗿 𝗮𝗻 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝘁𝗼 𝘀𝗵𝗮𝗿𝗲 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗱𝗮𝘁𝗮? In truth, it is not always clear cut. This article, written by Principal Data Protection Consultant Sandy May, will help your organisation 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝗱𝗮𝘁𝗮 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 𝗯𝗲𝘀𝘁 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀 within the UK GDPR, and the steps to take to make an informed decision when it comes to sharing personal data. So, if your organisation regularly shares data, or is embarking on a project which will involve data sharing, or you would like to understand the steps to take to ensure you are prepared for sensitive situations within the workplace, here are some important things for you to consider. #datasharing #gdpr #dataprotection #dpo #dataprotectionofficer #b2b https://lnkd.in/ekMrkaPG

12

🔏 𝐂𝐚𝐧 𝐚𝐧 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐫 𝐛𝐞 𝐞𝐱𝐞𝐦𝐩𝐭 𝐟𝐫𝐨𝐦 𝐥𝐢𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐟𝐨𝐫 𝐛𝐫𝐞𝐚𝐜𝐡𝐞𝐬 𝐨𝐟 𝐭𝐡𝐞 𝐆𝐃𝐏𝐑 𝐜𝐚𝐮𝐬𝐞𝐝 𝐛𝐲 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐞 𝐞𝐫𝐫𝐨𝐫? 🔏 The General Data Protection Regulation (GDPR) provides that a controller or processor is exempt from liability for breaches of the GDPR if it proves that it is not in any way responsible for the event causing the damage. The judgment of 11 April 2024 of the Court of Justice sheds light on the question whether a controller can be exempted from liability under this provision for the default of a person acting under its authority. The answer is negative. The Court clarifies that the controller must ensure that its employees follow instructions. Discover our latest newsflash concerning this topic in the Comments section below. 👇 #claeysengels #gdpr #databreach #liability

25

1 Comment

Did you know..... The GDPR says 'an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in:' * ART 24 the controller shall implement appropriate technical and organisational measures * ART 25 Data protection by design and by default * ART 28 Processor responsibilities * ART 32 Security In addition Art 83 says: 'When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (j) approved certification mechanisms pursuant to Article 42' LOCS:23 is the ICO approved Art 42 certification scheme for legal services - why wouldn't you?

18

4 Comments

The Data Protection and Digital Information Bill (DPDI Bill) was designed to make the UK’s data protection legislative framework more practicable and less burdensome in lower-risk situations while maintaining high data protection standards. It has been in the pipeline for years and included a series of reforms to the UK's GDPR- most notably, an expansion of what's considered ‘legitimate interest’, more cookie consent exemptions and a change to the role of the Data Protection Officer. However, following the announcement of the upcoming general election, the government then entered what is known as a ‘wash up’ period: the time between the election being called and the Parliament being dissolved during which Bills which are not passed, are effectively dropped. The ‘wash up’ period concluded on 24 May and the DPDI Bill was not passed. In their latest blog, Loretta Maxfield and Lucy Hennessy summarise what this now means for the future of the DPDI Bill. Read more here: https://lnkd.in/dEhjaumu

7

🆕 New Blog: Overview of ISO/IEC 27701 Controls To effectively implement and maintain a Privacy Information Management System (PIMS), organisations must follow laid-down controls to mitigate privacy risks. Our ISO/IEC 27701 blog series is back! This time, we delve into the 5 sub-categories which the standard's 184 controls are divided into: http://spkl.io/60484fnok If you missed the first 2 blogs in the series, you can catch up on them here: ▶️ Comprehensive Guide to ISO/IEC 27701 – http://spkl.io/60494fnoZ ▶️ ISO/IEC 27701 Requirements – http://spkl.io/60404fnow #tuvsud #cybersecurity #ISO27701 #DataPrivacy #PIMS #blog

5