Regulation 22 of PECR 2003 makes just about anybody working with marketing emails wince. It prohibits the sending of “unsolicited communications for the purposes of direct marketing” by electronic means (emails, texts, etc.) unless the recipient has consented, or unless the “soft opt-in” applies. How does this apply to emails with mixed content, i.e. that contain some bits of marketing material? Are these caught or not? Continue reading →

Data-sharing arrangements between one controller and another proliferate across all sorts of processing contexts, aimed at all sorts of purposes. If those arrangements are to comply with the GDPR and/or DPA 2018, they need to be structured so as to ensure that the data-sharing satisfies the data protection principles. This includes having ‘appropriate technical and organisational measures’ in place. So far, so clear. But how do you assess whether your measures are ‘appropriate’? And if push comes to shove, how will a court approach that assessment? Continue reading →

Suppose I run a website in the US. I only have staff and offices there, and my target audience is America. Sometimes punters in the UK read my stuff and even buy the odd thing from my website, but not that much, and I don’t really care if they do or not. Is the territorial reach of the GDPR – and/or UKGDPR – wide enough to get me, and thereby expose me to risks of the ICO or civil claimants going after me in the UK? Continue reading →

This week’s decision of the First-Tier Tribunal’s decision in True Vision Productions v IC (EA/2019/0170) is probably one of the last to deal with enforcement action under the old DPA 1998, but it is one of the first that deals with the journalism exemption (section 32 of the DPA 1998, reincarnated in substantially the same form in paragraph 26 of Schedule 2 to the DPA 2018). The exemption saved the controller – the production company, TVP – from part, but not all of its difficulties. TVP did enough, however, to persuade the Tribunal to slash the ICO’s £120k monetary penalty notice to £20k. Continue reading →

The free expression right conferred by Article 10 ECHR encompasses a right “to receive and impart information and ideas without interference by public authority”. Does this create a right to request information from a public authority, such that a refusal to disclose would constitute an interference with Article 10? Continue reading →

September: Panopticon is scraping itself off furlough and bounding back to school. Here are two information rights from August that are worth noting, both anchored in ECHR rights.

First, readers will recall the high-profile case of R (Bridges) v Chief Constable of South Wales Police and Others. Bridges concerned a challenge on (among others) Article 8 ECHR and DP grounds to the police force’s use of automated facial recognition (AFR) as part of a pilot project aimed at spotting the faces of suspects on wanted lists among the crowds. Continue reading →