|
|
|
|
UK regulator receives record number of breach notifications
The ICO has published its Annual Report, showing some of the early effects of the GDPR. The number of self-reported data breaches increased by 29% from 2,447 last year to 3,156 this year. In June, the ICO received 1,700 notifications which was a sharp increase compared with previous levels (around 360-390 breach notifications per month). Last year also saw the regulator issue the largest number and amount of civil monetary penalties in the Office's history. This included 26 penalties totalling £3.28 million for breaches of electronic marketing laws relating to nuisance calls and spam text messages, eleven fines totalling £1.29 million for serious security failures under the Data Protection Act 1998, 11 fines to charities totalling £138,000 for unlawfully processing personal data and an £80,000 fine issued to a data broking organisation.
|
Japan gets adequacy status
The European Union and Japan have successfully concluded negotiations on a reciprocal finding of an adequate level of data protection. The agreement will allow personal data to flow safely between the EU and Japan, without being subject to any further safeguards or authorisations. This is the first time that the EU and a third country have agreed on a reciprocal recognition of the adequate level of data protection. So far, the EU has adopted only unilateral adequacy decisions with 11 other countries: Andorra, Argentina, Canada (organisations subject to PIPEDA only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Switzerland and Uruguay.
|
Inquiry into child sexual abuse fined £200,000 in UK
The Independent Inquiry into Child Sexual Abuse has been fined £200,000 by the Information Commissioner's Office after sending a bulk email that identified possible victims of non-recent child sexual abuse. The Inquiry was set up in 2014 to investigate the extent to which institutions failed to protect children from sexual abuse. In February 2017, an IICSA staff member sent a blind carbon copy email to 90 Inquiry participants telling them about a public hearing. After noticing an error in the email, a correction was sent but email addresses were entered into the 'to' field, instead of the 'bcc' field by mistake. This allowed the recipients to see each other's email addresses, identifying them as possible victims of child sexual abuse. 52 of the email addresses contained the full names of the participants or had a full name label attached.
|
Singer's privacy ruling could restrict reporting of police investigations
Resolving a dispute between Sir Cliff Richard and the BBC, the UK High Court has ruled that "as a matter of general principle, a suspect has a reasonable expectation of privacy in relation to a police investigation". As a result of the ruling, the media will only be able to identify the individual in question if it can show that, on the facts of the case, its rights of freedom of expression and the public's right to know outweighs the privacy rights of the individual concerned. The finding has major implications for journalists, who will now need to consider carefully whether they can report information which comes into their hands, for example from anonymous sources, even where they have been able to confirm the accuracy of that information.
|
Browser setting rules could be dropped from new e-Privacy Regulation
Plans to compel web browser providers to ask users to set their privacy preferences could be scrapped, according to proposals under consideration by EU lawmakers. The European Commission had set out plans to require web browsers, and other providers of software that permit electronic communications, to inform users of their options to "prevent third parties from storing information on the terminal equipment of an end-user or processing information already stored on that equipment", and to require those users to select a particular privacy setting at the point of installation. However, the Austrian presidency of the Council of Ministers has now proposed to remove those provisions from the new e-Privacy Regulation that is being developed. The Austrian presidency said the original proposals had "raised a lot of concerns" related to "the burden for browsers and apps, the competition aspect, the link to fines for non-compliance but also the impact on end-users and the ability of this provision to address e.g. the issue of consent fatigue", it said.
|
Singapore personal data hack hits 1.5m
Hackers have stolen personal data in Singapore belonging to 1.5 million people - about one quarter of the population. According to officials, the hackers broke into the government health database in a "deliberate, targeted and well-planned" attack. Those targeted visited clinics between May 2015 and July of this year. Data taken include names and addresses but not medical records, other than medicines dispensed in some cases. The data of Prime Minister Lee Hsien Loong, who has survived cancer twice, including information on his outpatient dispensed medicines, was "specifically and repeatedly targeted".
|
Dutch regulator to check compliance with GDPR
The Dutch Data Protection Authority has started an exploratory investigation to see how well large organisations are complying with the new European privacy regulations. The sample will come from ten sectors: industry and metal, water supply, construction, trade, catering, travel, communication, financial services, business services and healthcare. No names will be mentioned in the study and there will be no consequences for any company found lacking.
|
|
More in depth data protection news and articles...
Privacy & Data Protection Journal
Subscribe to two or more titles at the same time and receive a 15% discount off the cheapest journal.
|
Keynote:
How the ICO will exercise its New Powers
James Dipple-Johnstone
Infomation Commissioner's Office (ICO)
|
This year, the conference is dedicated to reviewing the practical implications of the General Data Protection Regulation, and to help organisations ensure they are compliant.
Outsourcing - Overcoming the GDPR Challenges
Naomi Vann - Managing Legal
Counsel, RBS
Commencing and maintaining relationships with service providers has become more challenging under the GDPR. This talk looks at the increased need for due diligence before engaging a provider, the changes to contracts that are needed under Article 28 GDPR, the complexities that arise when a provider can be a controller for some activities and a processor for others, and the practical issues that must be considered in relation to sub-processors. Naomi describes her experience of handling the changes required to her organisation's relationship with hundreds of processors as a result of the enhanced GDPR requirements.
For more information and to book your place:
- Visit PDP Conferences
- Send us an This email address is being protected from spambots. You need JavaScript enabled to view it.
- Telephone +44 (0)207 014 3399
|
|
Our professional and practical Training Courses enable delegates to understand the legal requirements in key areas of information and data protection compliance. Courses run throughout the year around the United Kingdom.
Here is a selection of courses taking place shortly:
|
The Data Protection Act 2018 makes key changes to data protection law in the United Kingdom. It supplements the GDPR, and the two have to be read together to have a complete picture of the UK position. It adds to the "lawful bases" on which special category data may be processed, sets out the extensive exemptions to the GDPR which apply in the UK, defines the scope of much processing in the public sector, and applies rules based on those in the GDPR to processing for activities which fall outside EU competence. This course focuses on assisting those working in mainstream data protection compliance (in both the private and public sectors) to understand the DPA 2018's implications from a practical perspective, including:
- modifications to key definitions contained in the GDPR, and their significance
- the lawful bases for processing special category personal data in the UK - when and how they will apply, and how controllers can take advantage of them
- exemptions from the GDPR in the UK
- the age of consent of children to processing for internet society services
- how provisions based on the GDPR are applied by the Act to activities outside EU competence
- the conditions for processing personal data on criminal matters
- modifications to the rights of individuals
- public interest processing - scope and applicability
- restrictions on the applicability of certain aspects of the GDPR in the UK
- enhanced powers of the Information Commissioner, including entry and inspection, and the new enforcement regime
It is recommended that delegates attending this session have at least a basic knowledge of current data protection legal requirements under the GDPR. Delegates with no existing knowledge may find it helpful to attend Data Protection Essential Knowledge Level 1 before attending this training course.The course is next taking place on the following dates (further dates available online):
- London Monday, 1st October 2018
- Manchester Monday, 12th November 2018
For further information and to make a booking,
- Visit PDP's website
- Telephone PDP at +44 (0)207 014 3399
- Download the PDF Training Catalogue
|
|
Accountability - How to Comply with the GDPR's Requirements
For the first time in data protection law, the GDPR introduces the requirement of "accountability". In basic terms, accountability means that organisations are not only be required to comply with data protection requirements, but also that they must demonstrate that they comply.Demonstrating compliance consists of several elements, including preparing policies, monitoring compliance with internal policies and procedures, amending job roles and updating customer facing documentation such as websites and offline forms.This highly practical sessions looks at the detail of what accountability requires, and provides delegates with all the knowledge and tools necessary to achieve compliance in their organisations.It is recommended that delegates attending this session have a basic knowledge of current data protection legal requirements. Delegates with no existing knowledge may find it helpful to attend Data Protection Essential Knowledge Level 1 before attending this training course.The course is taking place on the following dates:
- Brussels Friday, 14th September 2018
- Manchester Friday, 28th September 2018
- Isle of Man Monday, 15th October 2018
For further information and to make a booking,
- Visit PDP's website
- Telephone PDP at +44 (0)207 014 3399
- Download the PDF Training Catalogue
|
|
This course is an introductory level course for all those that are new to data protection and the GDPR, or those that require a refresher on the fundamental concepts. It is designed for people who work with, or will work with, data protection issues on a regular basis.This invaluable and practical training session examines core concepts of practical data protection compliance. This course can be used as credit towards the Practitioner Certificate in Data Protection.The upcoming available dates for this course are (further dates available online):
- Belfast Monday, 10th September 2018
- London Monday, 17th September 2018
- Bristol Monday, 22nd October 2018
For further information and to make a booking,
- Visit PDP's website
- Telephone PDP at +44 (0)207 014 3399
- Download the PDF Training Catalogue
This practical training session is designed for those that work in the field of data protection. The Level 1 and Level 2 courses taken together constitute a complete training package on the fundamentals of data protection. This session provides a thorough grounding in the important aspects of data protection practice.The Level 2 course is designed as a natural progression from Data Protection Essential Knowledge - Level 1, although attending Data Protection Essential Knowledge - Level 1 is not a pre-requisite to attending the Level 2 unless you are a complete beginner to data protection. Attendance on this course can be used as credit towards the Practitioner Certificate in Data Protection.The upcoming available dates for this course are (further dates available online):
- Belfast Tuesday, 11th September 2018
- London Tuesday, 18th September 2018
- Bristol Tuesday, 23rd October 2018
For further information and to make a booking,
|
|
|
|
|
| |
|
To celebrate the 70th birthday of the NHS, 
To celebrate IHRIM's 70-year Platinum anniversary, we are giving away prizes 