Following the widely read posts in 2018 and 2019 here is my selection of most notable privacy and data protection cases from 2020:
Continue readingData Protection Commentary
Citation: BBC: England police to get access to NHS Test and Trace Data
YouTube faces £2bn legal action for alleged misuse of child data
A class action style law suit valued at £2bn has been filed in the High Court against Google, focusing on subsidiary YouTube’s handling of child user data.
Continue readingThe Schrems II case- EU-US data transfers left in question
The European Court of Justice has handed down its highly anticipated ruling in the Schrems II case. The case considered the validity of the EU-US Privacy Shield and the efficacy of Standard Contractual Clauses (“SCC”) as data transfer protection mechanisms.
In this landmark case it was found that the EU Commission’s adequacy decision around the EU-US Privacy Shield framework was invalid. The leaves the mechanism for conducting EU-US data transfers in question. This matter maybe covered by recent discussions between the UK and US around entering into a seperate data sharing agreement. However, in the interim a transitional mechanism is sorely needed alongside guidance for data processors to give clarity to how data sharing between the countries can be regulated and data subjects rights safeguarded.
The SCC regime was affirmed to be valid however, it was suggested that companies and regulators enter into a case by case basis analysis of risk. In particular, it was highlighted that such an assessment should take place where government access to data is mandated. This is a highly topical issue in the US given current efforts to put in place a federal data protection regime.
For more details on the Schrems II case see-
The ICO‘s press release
UK government releases NHS covid-19 data sharing agreements
Following significant pressure from groups such as OpenDemocracy and Foxglove the UK government has released its data sharing contracts with companies such as Amazon, Google and Microsoft for the creation of a cloud database for sharing covid-19 related data. Contracts with AI firms Planatir and Faculty were also released.
Continue readingWhat you need to know about privacy policies
Sites you visit, applications you use and services you take all have privacy policies – but what are they and why are they important, despite many people just check boxing them? Continue reading
Morrisions data breach vicarious liability case before UK Supreme Court
Following its data breach in November 2013 the Morrisons data breach case is now before the UK Supreme Court. The breach involved the personal data of 5,500 employees.
An employee, Mr Skelton, took a memory stick containing the records of employees home. In January 2014 he uploaded the contents onto a data sharing website, later sending it to newspapers. Continue reading
Compound liability following data breaches – Equifax two years on
In September 2017 Equifax suffered a data breach exposing the personal data of over 147 million people. Hackers utilised a website application vulnerability to access the personal data of customers. Continue reading
Data protection rights
Personal data, such as your name, likeness, birthday or any other information which can be used to identify you is highly sensitive.
Protecting and bringing actions on the basis of your personal data being harvested, used or misused is a key foundational right to privacy. Continue reading
£3billion class action against Google given the go-ahead – Lloyd v Google LLC [2019] EWCA Civ 1599
Mr Lloyd, a consumer protection advocate, brought a claim against Google for damages on behalf of 4m Apple iPhone users. It was alleged that Google secretly tracked some of their internet activity for commercial purposes between 9 August 2011 and 15 February 2012. Continue reading