The Court of Appeal’s judgment in R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, handed down this morning, concludes that the ‘immigration exemption’ in Schedule 2 to the DPA 2018 is not compliant with the GDPR. That is a very significant conclusion in its own right, from the perspectives of both immigration and data protection law. But the Court’s analysis also applies to a more general question: what does a valid (i.e. GDPR-compliant) exemption from data protection rights and duties look like? Read more »

My colleague Christopher Knight is a man of principle. In particular, he articulated the “Goldsmith Principles”, a kind of roadmap for dealing with the legitimate interests processing condition under DP law – see the Goldsmith judgment, and the approval of the Goldsmith Principles in Cooper. In a recent judgment from the Upper Tribunal, he has done the same for the security bodies exemption under section 23 of FOIA. Read more »

Regulation 22 of PECR 2003 makes just about anybody working with marketing emails wince. It prohibits the sending of “unsolicited communications for the purposes of direct marketing” by electronic means (emails, texts, etc.) unless the recipient has consented, or unless the “soft opt-in” applies. How does this apply to emails with mixed content, i.e. that contain some bits of marketing material? Are these caught or not? Read more »

Data-sharing arrangements between one controller and another proliferate across all sorts of processing contexts, aimed at all sorts of purposes. If those arrangements are to comply with the GDPR and/or DPA 2018, they need to be structured so as to ensure that the data-sharing satisfies the data protection principles. This includes having ‘appropriate technical and organisational measures’ in place. So far, so clear. But how do you assess whether your measures are ‘appropriate’? And if push comes to shove, how will a court approach that assessment? Read more »

Suppose I run a website in the US. I only have staff and offices there, and my target audience is America. Sometimes punters in the UK read my stuff and even buy the odd thing from my website, but not that much, and I don’t really care if they do or not. Is the territorial reach of the GDPR – and/or UKGDPR – wide enough to get me, and thereby expose me to risks of the ICO or civil claimants going after me in the UK? Read more »

This week’s decision of the First-Tier Tribunal’s decision in True Vision Productions v IC (EA/2019/0170) is probably one of the last to deal with enforcement action under the old DPA 1998, but it is one of the first that deals with the journalism exemption (section 32 of the DPA 1998, reincarnated in substantially the same form in paragraph 26 of Schedule 2 to the DPA 2018). The exemption saved the controller – the production company, TVP – from part, but not all of its difficulties. TVP did enough, however, to persuade the Tribunal to slash the ICO’s £120k monetary penalty notice to £20k. Read more »