The DPIA is a bitesize assessment of the impact of the most significant, interesting and important-to-know data protection issues. It’s not the full story, just a brisk, 3-minute resumé, collated and condensed especially for busy privacy professionals to ensure you’re aware of what’s happening in our fascinating, dynamic and engaging industry.

DPIAs and AIAs: The AI data controller's best friends

In the first of our AI blog mini-series, we mentioned that Data Protection Impact Assessments (DPIAs) and Algorithm Impact Assessments (AIAs) will likely become a data controller’s best friends if they opt to use an AI system. So, we thought it only right to dedicate a whole blog to these concepts and how they apply to AI. Both of these assessments should be considered essential tools for AI developers and AI-data controllers, even if only one is mandated by law. They are fundamental in ensuring that the rights of individuals are protected and help to ensure that AI systems are compliant with the wider GDPR. Click here to read the rest of this blog, where we delve a bit deeper into what DPIAs and AIAs are and how to conduct them.

Supreme Court unanimously rejects representative action in Lloyd v Google

Last week, the UK Supreme Court came to a long-awaited decision on the case of Lloyd v Google, which concerned whether individuals are entitled to receive compensation for the mere "loss of control" of their data caused by any non-trivial breach of the Data Protection Act 2018. The Court unanimously rejected this argument, instead confirming that an award for compensation can be made only if the data subject suffered some form of material damage; for example, tangible financial loss or demonstrable distress. The case concerned Google’s placing of advertising cookies on iPhones using Apple’s ‘Safari’ browser in England and Wales between August 2011 and February 2012. Google rolled out their “social ads2" cookie on its discontinued Google+ service, claiming that data privacy was protected through the segregation of data. This result will come as a relief to many organisations who were envisaging facing similar representative actions in the future.

Irish DPC releases guidance on vaccine certificate checks

The Deputy Commissioner of the Irish Data Protection Commission (DPC) has announced that the regulator has released new guidance on vaccine certificate checks. The guidance highlights that the owners or operators of premises conducting checks are data controllers for the vaccine passport information and, therefore, must identify a lawful basis to ask for and verify the vaccination status of attendees or patrons. Moreover, the guidance provides that vaccination status checking should be determined with reference to the current advice of public health authorities.

Facebook to roll back facial recognition features

Following the news that numerous schools have halted the use of facial recognition in lunch halls off the back of the Information Commissioner's Office's advice, Facebook has stated that it will be rolling back on some of its own facial recognition features. While Facebook said that they still continue to see facial recognition as a useful tool, they were concerned that regulators were starting to scrutinise the technology. The social media giant was using facial recognition to automatically detect people found in photos and videos on the platform. Anyone who was opted-in to the system, which at the time accounted for a third of Facebook’s active users, will no longer be recognised.

Landmark ruling set to brand IAB's consent system unlawful

It has been revealed that IAB Europe's Transparency and Consent Framework (TCF) is set to be ruled unlawful in an upcoming decision by the Belgian Data Protection Authority, turning the world of cookie banners on its head. The TCF is a technical standard for encoding users’ preferences about their personal data and effectively makes up a set of best-practice guidelines for collecting and processing data for ad targeting. It is these guidelines upon which thousands of organisations base their website cookie banners, which will, following the ruling, be deemed non-compliant with the GDPR. This ruling comes at a time when there are already calls for cookie banners to be scrapped. Whilst the ruling has not officially been published, IAB Europe has released a statement confirming the rumours and maintaining that the non-compliance will be simple to fix.

Hackers demand $1 million to prevent Israeli LGBT+ dating site information leak

Atraf, an Israeli LGBT+ dating site, is one of many websites that were hit by the ‘Black Shadow’ hacking group late last month after Israeli internet hosting company Cyberserve suffered a break-in affecting its servers. The following day, the group leaked tens of thousands of online records, including 1,000 Atraf users’ profiles, with information including name, location and HIV status being revealed. The group also demanded a $1 million ransom to prevent the release of the rest of the information that had been stolen. A spokesperson for the Israeli AIDS Task Force stated “The thought that a person’s HIV status will be revealed against his will bothers us greatly. For many, this is sensitive information, and its very exposure, not through choice, is worrying.”

Zoom accused of lying to users about end-to-end encryption

Zoom has agreed with the Federal Trade Commission (FTC) to update its security practices following allegations that it lied to its users for years by claiming that it offered end-to-end encryption. Since 2016 the company claimed that it offered "end-to-end, 256-bit encryption" to secure its users’ communications, when in fact it provided a much lower level of security. The FTC has also claimed that “Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers’ meetings, and secured Zoom Meetings, in part, with a lower level of encryption than promised.” Despite the FTC’s investigation, the Republican majority voted against the proposal to offer refunds and compensation to the company's customers.

Labour Party ransomware attack affected personal data of ex-Party members

Earlier this month, the Labour Party revealed that it had suffered a breach resulting from a ransomware attack. Officials have said very little about what happened, merely stating that a “cyber incident” resulted in unspecified party IT systems “being rendered inaccessible”. There is no clear understanding of how many members and ex-members have been affected, but the Party is working to resolve the issue and understand how it happened. In addition, following the revelation that the personal data of ex-Party members was also caught up in the breach, questions have been raised around how long the Party retains personal data for and the lawful basis upon which they hold this data.

We need you!

The DPO Centre is looking for experienced Data Protection Officers, Data Subject Access Request (DSAR) Officers, a Project Manager and a Digital Marketing Manager to join our ever-expanding team in the UK. In addition, we are also expanding our footprint in Europe by recruiting Data Protection Officers based in The Netherlands.

If you are looking for a new and exciting challenge, apply today!

Keep in touch

Do you have any interesting stories? Are you looking for support with your data protection compliance? We would love to hear from you!

Please email us at [email protected]

You have been sent this newsletter under legitimate interest, for more information please read our Privacy Policy

The DPO Centre is a limited company registered in England and Wales (Company Number: 10874595)
Registered Office: Suffolk Enterprise Centre, Felaw Street, Ipswich, IP2 8SJ, United Kingdom