Your DSAR Questions Answered

Over the last six months, we have hosted a series of webinars centred around providing helpful advice on dealing with some of the most complex types of Data Subject Access Requests: those tricky employee and medical DSARs. During these webinars we received a number of interesting questions from attendees about scenarios that are common to them, so we compiled the most frequently asked questions and answers. If you would like to read the full blog click here. 

New Data Protection and Digital Information Bill introduced to Parliament 

This new data protection Bill was introduced to Parliament last week, formalising the government's proposed reforms that were outlined in their response to the 'Data: A New Direction’ consultation, published last month. The Bill does not seek to repeal any existing UK data protection legislation, it rather proposes amendments to it. In his statement, the Minister for Media, Data and Digital Infrastructure, Matt Warman, said that the Bill will "improve people’s lives", especially around nuisance calls and the removal of cookie banners. The new Bill will also reduce burdens on businesses by “focusing on outcomes and not tick boxes”. 

ICO releases their 'ICO25' plan 

The Information Commissioner’s Office (ICO) has released its ‘ICO25’ plan, setting out the organisation's goals for the next three years. The plan’s overall aim is to empower organisations and data subjects to use and understand their rights, and to hold the government to account. The plan also aims to save UK businesses “more than £100 million through greater certainty and targeted support”. Its four strategic enduring objectives include safeguarding and empowering people; empowering responsible innovation; promoting transparency and accountability; and developing the ICO’s culture, capability, and capacity. The ICO is calling for views on the plans; if you would like to have a look and comment on them, you can find them here.

European Commission could be sued for violating EU GDPR 

The European Commission could face a lawsuit over allegations that it is violating its own data transfer laws by sending EU residents’ personal data to the United States through its Conference of the Future of Europe website, hosted by AWS. Although the EU GDPR, and therefore the Schrems II decision, doesn’t directly apply to EU institutions (they are bound by a different set of rules) it is believed that the lawsuit could bring them into the scope of the decision.

EDPB publishes statement on transferring data to Russia   

As a result of Russia's war on Ukraine, the European Data Protection Board (EDPB) has published a statement on transferring EU personal data to the country. Russia was excluded from the Council of Europe due to the attack, and whilst no longer being considered a contracting party to conventions and protocols that are only open to CofE members, it remains a contracting party of Convention 108 covering data protection. However, the EDPB have stated that "the modalities of Russia's participation in these instruments are still to be determined." The statement also highlights that as Russia does not benefit from an adequacy decision, transfers must be carried out using an alternative transfer mechanism, however, Supervisory Authorities are currently investigating the overall legality of data transfers to Russia. 

US FTC to enforce against illegal sharing of sensitive data 

The United States Federal Trade Commission (FTC) has posted a blog addressing its commitment to stopping the illegal use and sharing of highly sensitive data. The FTC highlighted concerns around devices that collect sensitive information and how this data could be used by data brokers and aggregators. It stressed that there is a lack of awareness around what consumer data is being used for once it has been collected, further expressing concerns around the potential claims that data is anonymous when it may be possible to re-identify the data subject.

The DPO Centre Charity and Community Fund  

To celebrate The DPO Centre's fifth birthday, we are extremely proud to introduce our brand new £100,000 Charity and Community Fund! Our Charity and Community Fund's purpose is to provide charities and not-for-profit organisations access to our data protection consultancy services, but at an 80% funded rate, therefore enabling worthy causes to access our expertise, but with the least effect on their ability to fund their core purpose. Eligible charities will be able to apply for up to £10,000 of funding towards any of our consultancy services. Our dedicated funding panel will then carefully consider all applications and award the funding in three funding rounds per year. If you know of any charities, or your organisation is a charity itself, that could benefit from this fund, please visit the page here.