The DPIA is a bitesize assessment of the impact of the most significant, interesting and important-to-know data protection issues. It’s not the full story, just a brisk, 3-minute resumé, collated and condensed especially for busy privacy professionals to ensure you’re aware of what’s happening in our fascinating, dynamic and engaging industry.

UK Data Protection Index results reveal drop in DPOs' compliance confidence

The latest report from the UK Data Protection Index was published last month, and it seems that DPOs are feeling rather pessimistic. Each quarter, the Index asks the same baseline questions in order to be able to track evolving trends and, judging by this latest set of results, the overwhelming trend is downwards: DPOs feel that there has been a decline in the level of precedence given to data protection by their organisations; confidence in the effectiveness of the Information Commissioner’s Office (ICO) has also fallen; and DPOs’ confidence in their own organisation’s data protection compliance fell for the second quarter in a row. The last point seems to us to be the most troubling. You would expect that, if a DPO is doing their job well, their organisation’s compliance would only be on the increase… wouldn’t you? In this blog, we consider what may be causing this crisis in DPOs’ confidence. Read more here.

Data Guardian issues warning over planned police access to patient data

Dr Nicola Byrne, England's National Data Guardian, has raised concerns over clauses contained in the Police, Crime, Sentencing and Courts Bill, which is set to be presented to the House of Lords later this month. The Bill could force NHS bodies to share patients' personal data with the police and other authorities in order to reduce serious violence in local areas. However, Byrne argued that "the risks and harms that this new duty pose to patient confidentiality" aren't addressed. She highlighted that, if passed, this new law would "erode trust and confidence, and deter people from sharing information, and even from presenting for clinical care."

Footballers threaten legal action against betting companies over use of personal data

Over 850 current and ex-football players from the Premier League, English Football League, National League and Scottish Premiership have grouped together to demand compensation from major gaming, betting and sports data companies for the alleged unlawful use of their personal data and performance statistics. Known as "Project Red Card", the group argue that these firms have been profiting from the use of players' personal data without them having consented to it, which they argue is a breach of the GDPR. At present, letters before action have been sent out to 17 companies, but it appears that the group seek to find a resolution out of court which involves the players being paid for the use of their personal data.

Elizabeth Denham's concerns over the independence of the ICO

In a statement published earlier this month, Elizabeth Denham, the outgoing UK Information Commissioner, has warned that some of the proposals included within the UK's new Data Strategy will have a negative effect on the independence of the Information Commissioner's Office (ICO). She said that "For the future ICO to be able to hold government to account, it is vital its governance model preserves its independence and is workable, within the context of the framework set by Parliament... The current proposals for the Secretary of State to approve ICO guidance and to appoint the CEO do not sufficiently safeguard this independence. I urge Government to reconsider these proposals to ensure the independence of the regulator is preserved." Elizabeth Denham is set to end her term as Information Commissioner at the end of this month, to be replaced by John Edwards.

FCA announce home visits to wealth managers

The Financial Conduct Authority (FCA) has announced that it intends to make visits to wealth managers and advisers that are working from home if an investigation requires. Since the shift to home working that occurred over 18 months ago, it has been harder for the FCA to gain access to companies' sites, records and employees as required by its regulatory role. It stated: "It is important that firms are prepared and take responsibility to ensure employees understand that the FCA has powers to visit any location where work is performed, business is carried out and employees are based (including residential addresses) for any regulatory purposes." Companies that have shifted to home working are now expected to notify the FCA if their principal business address has now changed to a residential property.

Man ordered to pay up to £100,000 for misuse of Ring doorbell

A judge at Oxford County Court has ruled that a man who installed an Amazon Ring doorbell at his home has violated the Data Protection Act 2018 by intruding on his neighbour's privacy. The neighbour, who took the individual to court, claimed that the Ring doorbell, which captures visual and audio recordings, subjected her to "continuous visual surveillance" and was intrusive. The doorbell camera's range of vision extended further than the boundaries of the defendant's property, capturing video of the neighbour's gate, garden and parking space. The judge ruled that this meant that the Data Protection Act 2018 did apply and had been breached; she ruled that the individual must put "blinkers" on the camera to ensure it did not record images beyond his property boundaries, and that he will have to pay the neighbour compensation which it has been suggested could amount to up to £100,000.

$1.1 billion in fines handed out under the GDPR in Q3 2021

Research from Finbold has revealed that EU Supervisory Authorities handed out fines amounting to over $1.1 billion (approx. €950 million) in Q3 of 2021, over three times the amount handed out in the whole of 2020. Whilst several of the fines relate to lengthy investigations that have finally been concluded in Q3, this huge increase in the severity of punishments handed out by Supervisory Authorities should be taken seriously by all organisations. Contributing to this significant uplift is the fact that hefty fines are now being levied at companies for general non-compliance - think €225 million fine for WhatsApp's lack of transparency - compared to previous years in which it seemed that the top fines were reserved for organisations that suffered significant data breaches.

Biden signs K-12 Cybersecurity Act 2021 into law

President Biden has signed into law the K-12 Cybersecurity Act 2021 which aims to protect the sensitive personal information held in schools across the US by implementing robust cybersecurity practices. The law requires the Cybersecurity and Infrastructure Security Agency (CISA) to study the cybersecurity risks facing schools in the US, develop cybersecurity guidelines for the education sector, and create an online training toolkit designed for school officials.

We need you!

The DPO Centre is looking for experienced Data Protection Officers, a Project Manager and a Digital Marketing Executive to join our ever-expanding team.

If you are looking for a new and exciting challenge, apply today!

Keep in touch

Do you have any interesting stories? Are you looking for support with your data protection compliance? We would love to hear from you!

Please email us at [email protected]

You have been sent this newsletter under legitimate interest, for more information please read our Privacy Policy

The DPO Centre is a limited company registered in England and Wales (Company Number: 10874595)
Registered Office: Suffolk Enterprise Centre, Felaw Street, Ipswich, IP2 8SJ, United Kingdom