How do I know if I am a data controller? In particular, how do data controller responsibilities work when it comes to cookies operating on my website (especially for targeted advertising purposes)? The GDPR has not invented these questions, but it has injected them with urgency and sharpness. The CJEU’s judgment in the ‘Facebook Fan Page’ case, handed down this morning, is a very significant contribution on increasingly important issues of this kind. Continue reading →

Needless to say, group actions for data protection breaches will generally be shaped by financial considerations. Those are partly about compensation, but also about costs. To make it worthwhile, claimants need not only to win and be awarded compensation, but also to get their costs covered, or at least not have their costs eat too far into their compensation. On this issue, today’s costs judgment in the Morrisons litigation is novel, interesting and instructive in practice. Continue reading →

My post below from earlier this week contained some head-scratching about timings for GDPR implementation. When will our Data Protection Bill make further progress through Parliament, I asked? We now have an answer: the Bill will have its report and third reading stages on 9 May. We’ll miss the deadline for implementing the Law Enforcement Directive (6 May), but never mind. The proposed amendments up for debate next week are here.

With the GDPR taking effect later this month, the Council of the EU has done its last round of proof-reading and made some changes to the final GDPR text. Most of those will be inconsequential for the majority of controllers and processors. Meanwhile, on this side of the Channel, a much bigger question remains unanswered: when exactly will we get our Data Protection Act 2018? Continue reading →

The Upper Tribunal’s most recent judgment – IC v Malnick and ACOBA (GIA/447/2017) – is a rare thing these days: a binding decision that makes a meaningful and general (rather than fact-specific) contribution to FOIA jurisprudence. In particular, it tells us (1) how to assess the reasonableness of a qualified person’s opinion for section 36 FOIA purposes, and (2) whether the FTT can remit a case to the ICO for a fresh decision if it allows an appeal. Continue reading →

The Times’ Lawyer of the Week this morning discusses an Upper Tribunal FOIA appeal brought by Rights Watch UK (for whom Daniel Carey, the Lawyer of the Week, acted pro bono), seeking disclosure of the Attorney General’s advice on drone strikes in Syria. The case was Corderoy & Ahmed v IC, AGO, Cabinet Office [2017] UKUT 495 (AAC). Whether you consider it a win, a loss or a draw (and if so for whom) will depend on which side you’re on here and, as counsel on all sides were colleagues at 11KBW, I will attempt a studied neutrality. I confess I have not found all aspects of the judgment easy to follow, but here you go. Continue reading →