|
|
|
|
Data broking company fined £140,000 in UK
The Information Commissioner's Office has finedpregnancy and childcare advice company, Emma's Diary, £140,000 for illegally collecting and selling personal information belonging to more than one million people. The data broking company sold the information to Experian Marketing Services, a branch of the credit reference agency, specifically for use by the Labour Party. Experian then created a database which the party used to profile the new mums in the run up to the 2017 General Election. The Labour Party was consequently able to send targeted direct mail to mums living in areas with marginal seats about its intention to protect Sure Start Children's centres. The regulator signalled its intention to fine the company in July, as it released an interim report of its comprehensive investigation into data analytics for political purposes. The ICO has outstanding enquiries with a number of data brokers, including Experian.
|
FTC to expand power to regulate corporate privacy practices
The US Federal Trade Commission is considering expanding its enforcement power over corporate privacy and data security practices. The action follows FTC Chairman Joseph Simons' recent declaration that the regulator's current authority under Section 5 of the FTC Act is inadequate to deal with the privacy and security issues in today's market. The FTC is also considering growing its authority in several other areas, including the intersection between privacy, big data and competition. Beginning in September 2018, the FTC will conduct a series of public hearings to consider these issues.
|
Company director disqualified after marketing calls breach
A man whose business was responsible for millions of nuisance marketing calls in the UK has been barred from serving as a company director for six years. Coventry-based Easyleads Limited was issued with a £260,000 fine by the Information Commissioner's Office in September 2017, after the regulator found the company responsible for making 16.7 million automated marketing calls without the prior consent of recipients. Easyleads failed to pay the fine which led the ICO to file for and obtain a court order to wind up the company. The Insolvency Service subsequently investigated and has now announced that the sole director of Easyleads, Shaun Harkin, 48 from Coventry, has accepted a disqualification undertaking that will prevent him from being directly or indirectly involved n the promotion, formation or management of a company for six years from 13th July 2018.
|
ICANN loses injunction bid in dispute over WHOIS data in Germany
A German appeals court has rejected a bid from the internet's global domain name organisation, the Internet Corporation for Assigned Names and Numbers (ICANN), to force a domain name registrar in the country to collect additional personal data. ICANN had applied for a court order to be issued against EPAG Domainservices to force EPAG to collect the personal data of technical and administrative contacts of organisations that register domain names with it. EPAG already collect the domain name holder's contact data in accordance with the terms of its contractual agreement with ICANN. It previously collected the data of technical and administrative contacts too on a voluntary basis, but stopped doing so in light of the GDPR. ICANN will still have an opportunity to "enforce the rights it asserts" in the main proceedings in the dispute, according to the new ruling.
|
Butlin's warns of potential personal data breach
UK holiday camp chain Butlin's has warned that the personal data of up to 34,000 customers may have been exposed in a cyber breach. The company has blamed the breach on a phishing attack, which indicates that an employee was tricked into divulging user credentials for a customer data system, rather than any high-tech hacking technique. Butlin's said the data at risk includes names, addresses, contact details and holiday arrival dates, but does not include any financial information. The company began notifying customers of the breach within 72 hours in line with the requirements of the GDPR.
|
| |
|
|
|
More in depth data protection news and articles...
Privacy & Data Protection Journal
Subscribe to two or more titles at the same time and receive a 15% discount off the cheapest journal.
|
Keynote:
How the ICO will exercise its New Powers
James Dipple-Johnstone
Deputy Commissioner (Operations)
Infomation Commissioner's Office (ICO)
|
This year, the conference is dedicated to reviewing the practical implications of the General Data Protection Regulation, and to help organisations ensure they are compliant.
 Workshop C. Compulsory Documentation - What is now Required of Organisations
Jenai Nissim, Legal Director, TLT Solicitors
In contrast to pre-GDPR law, several sets of documents must now be created and be made available in order to demonstrate compliance with the GDPR. This Workshop looks in detail at the requirements of the GDPR in terms of accountability, and provides delegates with the knowledge and tools necessary to achieve compliance in their organisations, including:
- what policies must be drafted, and the necessary content of those policies
- how existing data protection statements and privacy notices need to be altered and extended
- how organisations can raise awareness of data protection in their data protection policies and procedures
For more information and to book your place:
- Visit PDP Conferences
- Send us an This email address is being protected from spambots. You need JavaScript enabled to view it.
- Telephone +44 (0)207 014 3399
|
|
Our professional and practical Training Courses enable delegates to understand the legal requirements in key areas of information and data protection compliance. Courses run throughout the year around the United Kingdom.
Here is a selection of courses taking place shortly:
|
|
Data Protection Essential Knowledge - Level 1
This course is an introductory level course for all those that are new to data protection, or those that require a refresher on the fundamental concepts. It is designed for people who work with, or will work with, data protection issues on a regular basis.This invaluable and practical training session examines core concepts of practical data protection compliance. This course can be used as credit towards the Practitioner Certificate in Data Protection (GDPR)The course is next taking place on the following dates (further dates available online):
- Belfast Monday, 10th September 2018
- London Monday, 17th September 2018
- Bristol Monday, 22nd October 2018
For further information and to make a booking,
- Visit PDP's website
- Telephone PDP at +44 (0)207 014 3399
- Download the PDF Training Catalogue
Data Protection Essential Knowledge - Level 2
This practical training session is designed for those that work in the field of data protection. The Level 1 and Level 2 courses taken together constitute a complete training package on the fundamentals of data protection. This session provides a thorough grounding in the important aspects of data protection practice.The Level 2 course is designed as a natural progression from Data Protection Essential Knowledge - Level 1, although attending Data Protection Essential Knowledge - Level 1 is not a pre-requisite to attending the Level 2 unless you are a complete beginner to data protection. Attendance on this course can be used as credit towards the Practitioner Certificate in Data Protection.The course is next taking place on the following dates (further dates available online):
- Belfast Tuesday, 11th September 2018
- London Tuesday, 18th September 2018
- Bristol Tuesday, 23rd October 2018
For further information and to make a booking,
|
|
Data protection law requires that personal information be held and used securely. The law also requires that relevant security arrangements be put in place for all outsourcing arrangements. News headlines consistently show that organisations are not doing enough to ensure the security of people's personal information, both within the organisation and externally. It is not always obvious what measures should be taken by organisations to comply with the legal obligations.This session, which is fully up to date with the requirements of the General Data Protection Regulation (GDPR), as well as the implications of Brexit, examines the law as it relates to data security and the practical steps that organisations need to take to ensure compliance with their obligations. It concentrates on how to avoid a data security breach, as well as what can be done to mitigate the effects of a breach that does occur. It also considers the steps that must be taken when an organisation outsources operations, such as payroll, website hosting, digitisation of records, debt collection and waste management. The session considers lessons that must be learned by the fines that have been imposed by regulators.This session can be used as a credit towards the Practitioner Certificate in Data Protection (GDPR)
The course is next taking place on the following dates (further dates available online):
- Belfast Wednesday, 12th September 2018
- London Wednesday, 19th September 2018
- Edinburgh Wednesday, 31st October 2018
For further information and to make a booking:
|
Data Protection Impact Assessments (DPIAs) enable organisations to assess potential data protection and other privacy implications at the design stage of a new system or process. Such risks can be assessed and addressed within the development of the system or process, rather than being a "bolt-on" after implementation (when it may be too late to address all the concerns, at least without significant cost implications).DPIAs are recommended by data protection regulators, and they are a requirement in some sectors. DPIAs are an important part of the "privacy by design" culture, and they will be mandatory under the General Data Protection Regulation.Different approaches and levels of assessment can be undertaken depending on the nature of the system/process and the size of the organisation. This course gives practical guidance on conducting DPIAs, and includes:
- what is a DPIA, and when should one be carried out
- national regulators' recommendations and guidance
- stages of a DPIA and what to do in practice: initial assessment, preparation, information flows, consultation with stakeholders, analysis, documentation
- the relationship between conducting PIAs with other risk and project management activities (e.g. other risk assessments, data protection audits)
- legal and compliance issues to consider.
The course is next taking place on the following dates (further dates available online):
- Belfast Friday, 14th September 2018
- London Friday, 21st September 2018
- Edinburgh Friday, 2nd November 2018
For further information and to make a booking,
- Visit PDP's website
- Telephone PDP at +44 (0)207 014 3399
- Download the PDF Training Catalogue
|
|
|
|
|
| |
|
New standard for clinical referrals will support faster, better patient care
Please click the following link to download 
NHS NETWORKS daily news stories:
