TikTok: keep an eye on the clock

March 10th, 2022 by Robin Hopkins

Prior to the Supreme Court’s judgment in Lloyd v Google [2021] UKSC 50, numerous representative claims – akin to opt-in class actions – were afoot in the data protection arena. Most seem, understandably, to have fizzled out following Lloyd. But not all. Following this week’s judgment in SMO v TikTok Inc. and Others [2022] EWHC 489 (QB), the claim against TikTok has more or less scraped through its first procedural hurdle, and now is now gearing up for a summary judgment hearing in the months ahead. Read more »


FOIA and security bodies: running sections 23 and 24 together

October 18th, 2021 by Robin Hopkins

Some knotty FOIA debates end up generating confusing and apparently contradictory case law; some others get resolved by an authoritative three-person Upper Tribunal. The recent judgment of the UT (Mrs Justice Farbey and UT Judges Mullan and Wikeley) in FCDO v IC, Williams and Others [2021] UKUT 248 (AAC) is a neat example of the latter. It deals with the interplay between sections 23 and 24 of FOIA. Read more »


Important new High Court judgment on data breach litigation

July 30th, 2021 by Robin Hopkins

The High Court (Saini J) has today handed down judgment in Warren v DSG Retail Ltd [2021] EWHC 2168 (QB) (available here: Warren v DSG judgment). It is pithy and important stuff for data protection litigation, especially as regards accidental data breaches and the recoverability of ATE premiums. Read more »


Court of Appeal finds DPA exemption is unlawful under GDPR

May 26th, 2021 by Robin Hopkins

The Court of Appeal’s judgment in R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, handed down this morning, concludes that the ‘immigration exemption’ in Schedule 2 to the DPA 2018 is not compliant with the GDPR. That is a very significant conclusion in its own right, from the perspectives of both immigration and data protection law. But the Court’s analysis also applies to a more general question: what does a valid (i.e. GDPR-compliant) exemption from data protection rights and duties look like? Read more »


FOIA and security bodies: the definitive principles

February 11th, 2021 by Robin Hopkins

My colleague Christopher Knight is a man of principle. In particular, he articulated the “Goldsmith Principles”, a kind of roadmap for dealing with the legitimate interests processing condition under DP law – see the Goldsmith judgment, and the approval of the Goldsmith Principles in Cooper. In a recent judgment from the Upper Tribunal, he has done the same for the security bodies exemption under section 23 of FOIA. Read more »


Leave it out: marketing content in non-marketing emails

February 11th, 2021 by Robin Hopkins

Regulation 22 of PECR 2003 makes just about anybody working with marketing emails wince. It prohibits the sending of “unsolicited communications for the purposes of direct marketing” by electronic means (emails, texts, etc.) unless the recipient has consented, or unless the “soft opt-in” applies. How does this apply to emails with mixed content, i.e. that contain some bits of marketing material? Are these caught or not? Read more »