Source: https://www.legalrisk.co.uk/data-protection-resources/
Timestamp: 2019-11-13 09:15:52
Document Index: 33223037

Matched Legal Cases: ['EWCA ', 'CJEU ', 'EWCA ', 'EWCA ', 'Art. 35', 'EWCA ', 'EWCA ', 'EWCA ']

Data Protection Resources | Legal Risk LLP SolicitorsLegal Risk LLP Solicitors
Article 29 Working Party Guidelines on Personal data breach notification under Regulation 2016/679 [GDPR]
Article 29 Working Party Opinion 1/2006
On the application of EU data protection rules to internal whistleblowing schemes in the fields of accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime (WP 117). Note: this predates GDPR but may still provide some useful guidance
Article 29 Working Party – archived opinions and recommendations
Article 29 Working Party’s final Guidance on Consent
Article 29 Working Party’s Guidance on Transparency
B v The General Medical Council [2018] EWCA Civ 1497 - Successful appeal by a patient for disclosure of a medical report containing mixed personal data of both the patient and the doctor. The case involved a balancing exercise
Breach reporting: Article 29 Working Party Guidelines on Personal data breach notification under Regulation 2016/679 [GDPR]
Brexit - Data Protection Commission (Ireland) Guidance on Transfers of Personal Data from Ireland to the UK in the Event of a 'No-Deal' Brexit
Brexit and GDPR - HM Government guidance: Using personal data after Brexit
Brexit – Government guidance on data protection
Brexit – ICO guidance
Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband e v Planet49 GmbH
The CJEU held that pre-ticked check-boxes authorising the use of cookies do not constitute valid consent under the e-Privacy Directive (whether or not the cookies constitute personal data), and the GDPR standard of consent applies. Information must be provided on the duration of cookies and whether third parties will have access to them.
Campbell v Secretary of State (Information rights - Data protection) [2018] UKUT 372 (AAC)
Children and the GDPR guidance - ICO
Council of Bars and Law Societies of Europe Guidance
Introduction to the Data Protection Bill (Please note that the Data Protection Act 2018 has received Royal Assent – see link above – and that some changes were made after this note was produced. Nonetheless it may still be a source of useful background information to assist the understanding of the Act.)
Law Society guidance on appointing a Data Protection Officer
Regulations amending legislation relating to personal data, including GDPR and the Data Protection Act 2018, in anticipation of Brexit.
Data transfers between EU and non-EU countries
Standard contractual clauses for data transfers between EU and non-EU countries. Note: These predate GDPR
Dawson - Damer & Ors v Taylor Wessing LLP [2017] EWCA Civ 74 – extent of the legal professional privilege exception, disproportionate effort and motive for subject access request
Derogations - EU Member State GDPR Derogation Implementation Tracker
Durant v Financial Services Authority [2003] EWCA Civ 1746 – what constitutes personal data
e-Privacy Regulation, revised draft
EDPB guidance on international transfers - Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 Article 29 Working Party
EDPB Guidelines relevant for controllers and processors
EDPB Opinion on the UK draft list of processing operations subject to the requirement of a data protection impact assessment (DPIA) under Art. 35.4 GDPR
Equifax – ICO Monetary Penalty Notice
EU Member State GDPR Derogation Implementation Tracker
Fees – ICO guide for controllers
GDPR Security Outcomes – joint guidance from the ICO and National Cyber Security Centre describing a set of technical security outcomes that are considered to represent appropriate measures under the GDPR
GDPR | ICO
GDPR official text (user friendly)
General Data Protection Regulation - ‘Keeling Schedule’ showing proposed Brexit-related tracked changes under the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 when these come into force (subject to Parliamentary approval).
Higinbotham (formerly BWK) v Teekhungam & Anor [2018] EWHC 1880 (QB)
Dismissal of claim for misuse of private information, breach of confidence and breach of the Data Protection Act 1998 as an abuse of process.
ICO - Speech by Emma Bate, General Counsel, covering recent action and ICO’s latest thinking on international data transfers.
ICO - The data protection fee: A guide for controllers
Note: this predates GDPR and the Data Protection Act 2018. The ICO is working on updating the code.
ICO guidance - Data Protection Act 2018
ICO guidance on Data Controllers and Data Processors (Data Protection Act 1998)
Data controllers and data processors: what the difference is and what the governance implications are. Note: this guidance relates to the law pre-GDPR
ICO guidance on Data Controllers and Data Processors (GDPR)
See ICO guidance: Contracts and liabilities between controllers and processors
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/contracts-and-liabilities-between-controllers-and-processors-multi/
ICO guidance on Data Protection Impact Assessments (DPIAs)
ICO guidance on international transfers International transfers – ICO guidance
ICO Guidance on Legitimate Interests
ICO guidance on the right to be informed
This covers the Data Protection Act 2018 and the GDPR as it applies in the UK. The guide combines the existing ICO guides to the GDPR and Law Enforcement Processing.
ICO Guide to the General Data Protection Regulation (GDPR) (alternative link)
ICO template Excel spreadsheets for record keeping (one for data controllers, one for data processors) in accordance with Article 30
ICO Timescales for responding to a subject access request
ICO – Children and the GDPR guidance
Ireland - Brexit - Data Protection Commission (Ireland) Guidance on Transfers of Personal Data from Ireland to the UK in the Event of a 'No-Deal' Brexit
Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd& Ors [2017] EWCA Civ 121
Pre-GDPR appeal. Information is not disqualified from being “personal data” merely because it has been supplied to the data controller by the data subject. A person who processed data as agent for a data controller was not himself a data controller. Proportionality applied and there was no obligation to search for material covered by legal professional privilege. Whether it is reasonable to disclose information about another individual is an evaluative judgement.
Jehovah's Witness case - Tietosuojavaltuutettu v Jehovan todistajat — uskonnollinen yhdyskunta (Case C-25/17) - The Court of Justice of the European Union applied a broad interpretation (a) to what constitutes a filing system and (b) concerning joint controllers under Directive 95/46/EC
Legal professional privilege and client confidentiality: Law Society guidance
Class action against Google dismissed.
Judgment on lawfulness of sharing of sensitive personal data relating to a 16 year old child, including bail conditions, under an information-sharing agreement between the police and a local business crime reduction partnership. The decision also determined that the parties to the agreement were joint controllers of the data, rather than controller and processor respectively, and held that the defendant had implemented ‘appropriate technical and organisational measures’ by using a secure intranet, which was encrypted and password protected.
Maryland State Bar Association Ethics Docket No. 2018-06 on conflicts of interest checking and GDPR
Memorandum of Understanding Between the United States Federal Trade Commission and the Information Commissioner's Office of the United Kingdom On Mutual Assistance In the Enforcement of Laws Protecting Personal Information In the Private
A Norwich Pharmacal order requiring disclosure of IP addresses would result in the Applicants becoming "recipients" of personal data but not "controllers", and therefore not subject to the more onerous obligations on "controllers".
Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339
Morrisons Supermarket Plc v Various Claimants (Rev 1) [2017] EWHC 3113 (QB)
Various Claimants v WM Morrisons Supermarket Plc (Rev 1) [2017] EWHC 3113 (QB)
Morrisons found vicariously liable for a data breach by a rogue employee, despite the adequacy of its data security measures.
National Data Protection Authorities – Article 29 Working Party overview
Planet 49 case (Bundesverband der Verbraucherzentralen und Verbraucherverbände — Verbraucherzentrale Bundesverband e v Planet49 GmbH)
Privacy and Electronic Communications (Amendment) Regulations 2018, The
Privacy and Electronic Communications (EC Directive) Regulations 2003, The
Privilege - Legal professional privilege and client confidentiality: Law Society guidance
Secretary of State for the Home Department & Anor v TLU & Anor [2018] EWCA Civ 2217 – liability for data breach to claimants not identified directly, definition of ‘personal data’, damages for distress
Standard contractual clauses ("model clauses") for data transfers between EU and non-EU countries.
Note: These predate GDPR
The Article 29 Working Party Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR
Tietosuojavaltuutettu v Jehovan todistajat — uskonnollinen yhdyskunta (Case C-25/17) - The Court of Justice of the European Union applied a broad interpretation (a) to what constitutes a filing system and (b) concerning joint controllers under Directive 95/46/EC
Unabhangiges Landeszentrum fur Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein (Facebook Ireland Ltd and Vertreter des Bundesinteresses beim Bundesverwaltungsgericht intervening) Case C-210/16
The administrator of a fan page hosted on Facebook was held to be a joint controller with Facebook. By creating such a page, it gave Facebook the opportunity to place cookies on the computer or other device of a person visiting its fan page, whether or not that person had a Facebook account. (Preliminary ruling in relation to Directive 95/46/EC, so pre-GDPR.)
Whistleblowing - Article 29 Working Party Opinion 1/2006 on the application of EU data protection rules to internal whistleblowing schemes in the fields of accounting, internal accounting controls, auditing matters, fight against bribery, banking and financial crime (WP 117). Note: this predates GDPR but may still provide some useful guidance
UK Financial Intelligence Unit Suspicious Activity Reports Annual Report 2019