Uncertainty is the new normal. UK criminal and regulatory enforcement authorities, like the rest of us, are adjusting to unprecedented levels of business disruption.
This short alert provides signposts to the guidance given by key authorities so far about immediate steps they are taking in response to the outbreak and the difficulties it causes.
We
As remote working becomes the new normal for office workers and attention focusing on ensuring colleagues, families and friends are healthy and have enough food and supplies to last any period of isolation, workers may be less attentive to cyber threats and more likely to open official looking COVID-19 related emails. Hackers are looking to
On 8 January 2018, the Information Commissioner launched a public consultation on a Direct Marketing Code of Practice, which she is required by Section 122 of the Data Protection Act 2018 to produce in order to provide practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Accordingly, like the existing ICO Direct Marketing Guidance, which it will supersede, the proposed code sets out the law and provides examples and good practice recommendations. To a significant extent, the draft code replicates the current guidance, which was updated in 2018 to reference the General Data Protection Regulation (GDPR). When finalized, the Commissioner must take the code into account when considering whether those engaged in personal data processing for “direct marketing purposes” have complied with the GDPR and PECR. The key aspects of the draft code are summarized below, including new guidance on in-app advertising and direct marketing on social media platforms.
Continue Reading UK’s ICO Publishes Draft Direct Marketing Code of Practice
The UK Information Commissioner recently published a consultation paper inviting views on the ICO’s proposal that it should be granted investigation and asset recovery powers under the Proceeds of Crime Act 2002 (“POCA”).
The powers the Information Commissioner is seeking at this time are:
The ICO is also seeking relevant authorisation powers that will enable it to exercise the powers referred to above.Continue Reading UK Information Commissioner’s Office Seeks Further Criminal Powers
The Information Commissioner’s Office has published GDPR: One Year On, describing its experiences and giving insights into the impact of the GDPR since 25 May 2018. The document reaffirms the ICO’s risk-based approach to enforcement focussing on GDPR breaches involving highly sensitive information, large groups of individuals and vulnerable individuals. A key message, however, is that there is “still a long way to go to truly embed the GDPR and to fully understand the impact of the new legislation.”
Continue Reading GDPR: One Year On
This article by partner Rohan Massey and associate Edward Machin was published by Law360 on February 25, 2019.
2018 was the year that data protection went mainstream. Having once been a topic that most folks treated with a combination of ignorance and inconvenience — “I have to read another privacy policy?” — by the year’s end the concept of privacy had firmly entered the public consciousness. Widely viewed congressional hearings on the misuse of personal data, a series of high-profile security breaches at Fortune 500 companies and an episode of “60 Minutes” dedicated to how a European law is influencing U.S. legislators all helped privacy and data security rise to the top of the public, corporate and legislative agendas.Continue Reading Five UK Privacy and Data Protection Predictions for 2019
The Article 29 Data Protection Working Party has adopted Opinion 01/2017 on the Proposed Regulation on Privacy and Electronic Communications. The draft Regulation was proposed by the European Commission in January 2017.
This article by partners Rohan Massey and Mark Szpak and counsel Clare Sellars was published by Law360 on May 26, 2017.
The General Data Protection Regulation (GDPR) is a sweeping privacy and data protection regulation in the European Union (EU) and will be enforced from May 25, 2018, replacing Data Protection Directive 95/46/EC. The GDPR aims to protect both individuals’ fundamental rights to protection of data about them and the free flow of such personal data, as well as to harmonize the existing patchwork of EU member state implementations of the Directive. In doing so, the GDPR significantly expands the application of EU data protection law.
Continue Reading Countdown to Compliance: One Year to Go Until GDPR Enforcement
Rohan Massey, Ropes & Gray IP transactions partner, discusses reform of EU data protection rules, which will establish a more robust, harmonized data protection framework across Europe.