Sam Plackett

Stay ahead in the digital world! Discover how GDPR shapes global data privacy and its impact on eDiscovery. Dive into our latest blog to navigate compliance and protect personal data. #weareiDS #DataPrivacy #GDPR #eDiscovery

7

Recent UK guidance has been issued regarding the processing of personal data in the context of content moderation, particularly pertinent for organizations navigating the Online Safety Act (UK OSA), UK GDPR, and Data Protection Act (DPA 2018). This guidance is essential for organizations obligated to moderate content under the UK OSA or those offering content moderation services. It particularly applies to entities facilitating user-generated content (UGC), including media posts, reviews, and community forums. Organizations must establish a legal basis for processing personal data in the course of moderating content. This could include compliance with legal obligations, including under the UK OSA. When opting to rely on legitimate interests, it will be important to conduct a legitimate interest assessment. Remember to have appropriate policies in place too. Additional Considerations: 𝐂𝐨𝐧𝐭𝐞𝐧𝐭 𝐓𝐚𝐤𝐞𝐝𝐨𝐰𝐧 𝐒𝐎𝐏𝐬: Establish internal policies detailing obligations under UK OSA and procedures for content takedown.  𝐂𝐡𝐢𝐥𝐝𝐫𝐞𝐧’𝐬 𝐂𝐨𝐝𝐞: If dealing with data of individuals under 18, compliance with the Children’s Code is essential.  𝐃𝐏𝐈𝐀𝐬: Understand when and why Data Protection Impact Assessments are necessary.  𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬 𝐚𝐧𝐝 𝐓𝐫𝐚𝐧𝐬𝐩𝐚𝐫𝐞𝐧𝐜𝐲: Transparency with users regarding content moderation practices is crucial.  𝐀𝐈 𝐚𝐧𝐝 𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐢𝐨𝐧: Unique considerations arise when employing automated decision-making tools for content moderation.  𝐒𝐭𝐚𝐲 𝐔𝐩𝐝𝐚𝐭𝐞𝐝: Keep abreast of forthcoming amendments to UK data protection law through the Protection and Digital Information Bill. Navigating the intersection of content moderation and data protection requires diligence and a proactive approach. By adhering to guidance and staying informed about regulatory changes, organizations can ensure compliance while maintaining the integrity of their services.  #DataProtection #ContentModeration #UKOSA #UKGDPR 

8

On the 2nd day of Christmas my lawyer sent to me... 2 data processing agreements. Senior Associate, Gurinder Hayer gives two things to consider with data processing agreements: 1. Primarily, your DPA must ensure all the mandatory clauses included in Article 28 UK GDPR are included. Failure to do so may mean your DPA is not UK GDPR compliant. The ICO website includes some useful guidance which you can use as a checklist. 2. Liability – often the most hotly-contested clause is any contract and DPA’s are no different. In negotiating liability consider what the risk is and what could go wrong in relation to personal data given the services being provided. It is common to include a specific data protection liability cap which sits outside of the general cap in the main agreement. Season's greetings from our In-House team to yours - make sure to watch this space for more tips over the festive period 🎁 #GDPR #DataProtection #DataPrivacy

4

𝗪𝗵𝗲𝗻 𝗶𝘀 𝗶𝘁 𝗼𝗸 𝗳𝗼𝗿 𝗮𝗻 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝘁𝗼 𝘀𝗵𝗮𝗿𝗲 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗱𝗮𝘁𝗮? In truth, it is not always clear cut. This article, written by Principal Data Protection Consultant Sandy May, will help your organisation 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝗱𝗮𝘁𝗮 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 𝗯𝗲𝘀𝘁 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀 within the UK GDPR, and the steps to take to make an informed decision when it comes to sharing personal data. So, if your organisation regularly shares data, or is embarking on a project which will involve data sharing, or you would like to understand the steps to take to ensure you are prepared for sensitive situations within the workplace, here are some important things for you to consider. #datasharing #gdpr #dataprotection #dpo #dataprotectionofficer #b2b https://lnkd.in/ekMrkaPG

12

What's involved in the role of a Data Protection Officer? One thing we're asked a lot is whether law firms actually need a Data Protection Officer (DPO). Read about what a DPO actually is, what the guidance says, and delve into the crucial role they play in ensuring GDPR compliance. Visit: https://loom.ly/JsKcICs #gdpr #gdprcompliance #lawfirmcompliance #legalcompliance

2

Take a look at the latest data protection developments in this month's data protection bulletin: - The responsible use of AI in HR and recruitment - The TUC’s AI Bill - Worker Compensated for AI Facial Recognition Discrimination - Proposal to Amend GDPR in UK at an End? https://hubs.ly/Q02BR_l00 #dataprotection #informationsecurity #data #NormCyber #TeamNorm

9

Ever feel like data privacy compliance is like assembling IKEA furniture? 🛠️ You’ve got all the pieces (and maybe a few extra cups of coffee) ,but without the right instructions things can get… a little messy. Enter the Record of Processing Activities (RoPA)—the instruction manual for most Data Privacy Laws' compliance. It got all the details on what data you’re processing, why, and who’s involved, so you don’t end up with a pile of unassembled compliance risks. No Allen wrench required—just some good documentation and a dash of attention to detail! Let’s break down what goes into a RoPA, so you can build a privacy-friendly business that’s ready for anything. 🔧📚" (RoPA Template available at https://lnkd.in/ddKsn2jn 💡) 🔖What is a Record of Processing Activities (RoPA)? A Record of Processing Activities (RoPA) is a comprehensive document that organizations must maintain to track and document all data processing activities they perform. It is a key requirement under the GDPR and other data protection laws. The purpose of the RoPA is to help organizations ensure transparency, accountability, and compliance with data protection laws. The RoPA serves as an internal tool for organizations to monitor their data processing operations, identify privacy risks, and demonstrate compliance to supervisory authorities (e.g., the Information Commissioner’s Office in the UK, or the European Data Protection Board in the EU). 🔖Key Purpose of the RoPA - Transparency: To ensure data subjects (individuals whose data is processed) are informed about how their personal data is used. - Accountability: To demonstrate compliance with applicable data protection regulations, such as the GDPR. - Risk Management: To identify and assess privacy risks within an organization’s data processing activities. - Audit and Inspection: To provide a documented record that can be reviewed by regulators or auditors. 🔖What Should a Record of Processing Activities Include? Depending on what law applies maintaining RoPA, there are specific requirements for what the RoPA must contain. Here are the key components that should be included: - Identity and contact details of the data controller, data processor, and DPO. - Purpose(s) of the processing. - Categories of data subjects and personal data. - Categories of recipients of the personal data. - International data transfers and safeguards. - Retention periods for the personal data. - Technical and organizational security measures. - Data Protection Impact Assessments (DPIAs) (if applicable). - Legal basis for processing the data. #dataprotection #gdpr #artificialintelligence #dataprivacy #privacy #cpra #article #uslaw #RoPA #compliance #dataprivacylaw #complianceofficer #privacymatters #privacylaw #dataanalysis #dataprivacymatters #AI #EUAI #privacypolicy #privacyofficer #iotdevelopment #cookies #privacypolicy

29

2 Comments

Our upcoming Data Protection Made Easy podcast episodes cover a range of critical topics. First up, we're exploring the intricacies of the DPO role. What does it take to be a successful Data Protection Officer? Next, join us for GDPR Radio as we discuss the latest news and trends in data protection. Finally, we'll unravel the complexities of international data transfers, helping you navigate the legal landscape with confidence. Stay tuned for valuable insights, expert advice, and practical tips. Don't miss out. Register for our upcoming events here: https://lnkd.in/gFn93M-y #dataprivacy #DPO #GDPR #internationaldatatransfers #podcast #dataprotection #cybersecurity

24

The ultimate DPO hiring guide is here! Tech companies all over the world must comply with privacy laws, and for many, that includes the GDPR. But does that mean that your project needs to hire a Data Protection Officer (DPO)? To answer that question, the Legal Nodes Privacy Team has created a four-part guide that explains: 📌 what a DPO does and when you need to get one 📌 what happens if you don’t get a DPO 📌 who you can appoint to be your DPO 📌 how to choose the right expert to act as the DPO for your business Read (or save for later) the guide here: https://lnkd.in/dcjmBZ5u

7

Search by sender and recipient so you can mark emails as protected by attorney-client privilege right from the start. Learn more at https://lnkd.in/eymsE2t3 #ediscovery #allinonai #revealreview #reveal

2

Automated Decision Making and the UK GDPR. Some key points to consider: In today's fast moving and increasingly data-driven world, automated decision making is becoming increasingly common. How does this intersect with the UK GDPR? The Right to Human Intervention: Under the UK GDPR, individuals have the right to not be subject to purely automated decisions that significantly affect them. Transparency: Organisations should clearly inform individuals when automated decision-making is being used and explain the logic involved. Do this now! Lawful Basis: Automated decision making must have a lawful basis under the UK GDPR, such as consent, legitimate interests or the processing is necessary for entering into, or for the performance of a contract to which the individual data subject is party. Data Protection Impact Assessments: These are often required for automated decision-making systems to evaluate and mitigate risks. Fairness and Non-Discrimination: ADM systems must be designed to avoid unfair or discriminatory outcomes. ICO guidance states “In simple terms, fairness means you should only process personal data in ways that people would reasonably expect and not use it in any way that could have unjustified adverse effects on them” ..which is a good starting point. A point that can be further investigated and documented in the Data Protection Impact Assessment, a tool for Data Protection Risk Assessment – and mitigation where needed. Do the Data Protection Impact Assessment (DPIA) and keep a record. As businesses leverage AI and machine learning, it is important to balance innovation with data protection rights. How is your organisation addressing these challenges? Take action before you start, and before you intend to start using people’s data. #UKGDPR #AutomatedDecisionMaking #DataProtection #AI #Privacy

2

High Court Rules Government’s Immigration Exemption to Data Protection Act Unlawful On 30 March 2023, the High Court declared the government's second attempt to create an immigration exemption within the Data Protection Act 2018 incompatible with the UK GDPR. This exemption allowed the Home Office to refuse access to personal data if it might "prejudice the maintenance of effective immigration control." The ruling follows a case brought by the3million and the Open Rights Group, highlighting the exemption's failure to meet GDPR safeguards. This decision underscores the critical importance of data protection for migrants, who often rely on access to their personal data to challenge immigration decisions effectively. The judgment demands legislative amendments to ensure proper safeguards and prevent data misuse. For more insights on this ruling and its implications, read our full article here: https://lnkd.in/epcg2y4w #DataProtection #ImmigrationLaw #HighCourt #UKGDPR

2

If you're a start-up, small business or coming to it from a country with less comprehensive data protection laws, it can be easy to feel overwhelmed by the (UK) GDPR. We break down some of the most important aspects of data protection compliance in the EU and UK, with a focus on online businesses: https://bit.ly/3xThZCn #GDPR #DataProtection

24

Cookies: top ten steps towards EU cookie compliance - As part of this month’s edition of the Global Data Hub (UK) GDPR – what you really need to know, Julie Dumontet, Associate in our IP/IT department in France, and Sharif Ibrahim have looked at the essentials of EU cookie compliance: https://lnkd.in/e7xBUwpz #GDPR #DataProtection

7

NEW data protection code of conduct launched for UK private investigators: We have approved and published the first sector-owned code of conduct - The Association of British Investigators Ltd (ABI) UK GDPR code of conduct for Investigative and Litigation Support Services. #dataprotection #dataprivacy #privacy

1

What are the data protection principles under the GDPR? 🤷‍♀️ If you’ve had any dealings with the GDPR (General Data Protection Regulation), chances are you’ve also heard of the seven key principles, usually referred to as ‘data protection principles’ or ‘data processing principles’. As the name suggests, these principles are fundamental to data protection, and failing to comply with them can result in a fine up to £17.5 million or 4% of global annual turnover (whichever is greater). We take a closer look at what those principles are, and how to comply with them 👉 https://ow.ly/4kpA50TEbCW #GDPRCompliance #DataProtectionPrinciples #DataPrivacyLaws #DataSecurity

9

Good morning, The UK Data (Use and Access) Bill was published last week. Most Linkedin coverage of this important Bill has focused on the #dataprotection, #digitalidentity and #smartdata provisions But the Bill also reforms the UK's electronic signature framework (UK #eidas). In this new briefing paper, I look at the key changes to the UK eIDAS Regulations. Clause 129 of the draft Bill will be of particular interest to those of you working in the eIDAS sphere and to the leading #esigning platforms such as Docusign Scrive Namirial Ascertia – An InfoCert Company and Adobe. Here's why: in 2020, the UK agreed that EU 'qualified trust service providers' (QTSPs) could continue to provide their qualified electronic signatures (QESs) into the UK market. The #europeancommission said Merci, Vielen Dank, Grazie......but it did not give UK QTSPs a reciprocal right to provide their QESs (and other qualified trust services) into the EU market. This has placed the UK at a severe disadvantage. QES is the "gold standard" under UK and EU eIDAS - yet there are no QTSPs supervised in the UK by #ico. Instead, the e-signing platforms have integrations with EU QTSPs to enable UK customers to sign documents with QES. So, what is the UK doing to solve this conundrum and level the playing field for UK and EU QTSPs? Clause 129 of the Bill would allow the UK to revoke the status of EU qualified trust service providers (QTSPs) under UK law and deviate from EU technical standards. This is a bad idea. Given that the UK market is wholly dependent on qualified trust services from EU QTSPs, it is hard to discern why the UK would choose to do this. For my detailed critique of the changes to the UK eIDAS Regulations, please read and share this briefing paper. Thank you. #electronicsignature #digitalidentity #digitalwallet #biometrics #ai #europeanparliament #ETSI #ENISA #eidas2 OneID® Digidentity Yoti Ezer Farhi Marcel Wendt Eva Lambooij Matteo Tadjo K. Joerg Lenz Antonio Taurisano Andrea Servida Meaghan Hess Vedran Lalic Aurélien Rocher Apostolos (Tolis) Apladas MSc Viky Manaila 💯 Adrian Doerk 🇪🇺 📲 Adrian Field Michał Tabor Luca Castellani Robin Tombs Martin Röver-Parkes Viktor Wrede Jay Epton Adam Kissane

104

16 Comments

Here's our latest data privacy updates from Stephenson Harwood!

20

1 Comment