Life with GDPR

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we discuss British Prime Minster Boris Johnson’s recent announcement that he will be resigning as British PM when his successor is announced. Some of the highlights include:

Resources

For more information on the issues raised in this podcast, check out the Cordery Compliance, News Section. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we review the recently released European Data Protection Board (EDPB) draft guidance on calculating fines entitled “Guidelines 04/2022 on the calculation of administrative fines under the GDPR”. Some of the highlights  include: 

1.     There have been just under 1.5 billion in overall fines under GDPR.

2.     Spain has the largest number of fines but the smallest monetary amount of fines.

3.     The five-step calculation methodology.

4.     What are the aggravating and mitigating factors.

5.     Key takeaways from the draft guidance.

Resources

For more information on the draft guidance, check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we review the recently released Financial Reporting Council (FRC), the UK Anti-Slavery Commissioner, and Lancaster University (Management School) report on a sample of a hundred major companies’ modern slavery statements and their strategic and governance reports. Some of the highlights  include:

1.     Why the Report?

2.     Some successes but much criticism.

3.     Public responses when slavery issues are uncovered.

4.     Why contracts are a part of the solution.

5.     Key takeaways from the Report.

Resources

For more information on the FRC Report, check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we take up a fine in the UK by the ICO against Clearview AI. We have discussed other EU countries’ fines against Clearview previously. Some of the highlights include:

Resources

For more information on the Clearview AI fine by the ICO, check out the Cordery Compliance client alert on this topic; click here. For more information on Cordery Compliance, go to their website here. Also, check out the GDPR Navigator, one of the top resources for GDPR Compliance, by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Tom Fox returns for another episode of Life with GDPR. Jonathan Armstrong is on assignment this week, so we are joined by our colleague André Paris, a Brazilian Privacy and Compliance Consultant, Professor and Lawyer. Andre is the author of the book "Ethics and Transparency - A Path to Compliance". He is a specialist in building a Corporate Culture based on Ethics, Transparency and Respect. Experienced in Corporate Risk Analysis and Management, as well as in Protecting Corporate Reputation and Crisis Management. He is also an enthusiast on building a more ethical and transparent business environment.

In this episode, we take up the Brazilian national GDPR-like data privacy law.  Some of the issues we consider include: 

1.     What is the Brazilian law?

2.     Who does it apply to?

3.     What does a compliance program look like?

 Resources

Check out Andre’s book, ETHICS & TRANSPARENCY: A Path To Compliance.

Andre Paris on LinkedIn

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we take up the proposed agreement for data transfers from the EU (and UK) to the US. Some of the issues we consider in the myriad of questions around this latest version of Privacy Shield include: 

1.     Is this simply an agreement to agree?

2.     Who will populate the independent court review in the US?

3.     Will US spy agencies ever comply?

4.     Will there be a real deal by the end of 2022?

5.     Is this simply a temporary solution.

 Resources

For more information on the new data transfer agreement, check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we consider the Italian Data Protection Authority (the Garante) fine against Clearview AI €20m for GDPR violations.  It is the latest in a series of regulatory actions in Europe and in Australia against Clearview AI and it also continues a trend of AI enforcement in Italy.

1.     Who is Clearview AI?

2.     What is this matter about?

3.     The background facts and the Italian investigation.

4.     What did the Garante say?

5.     Lessons learned and next steps.

Resources

For more information on the Italian Clearview AI enforcement action, check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we consider the UK Data Protection Authority, the Information Commissioners Office (ICO) recent announcement that it had fined a law firm, Tuckers Solicitors LLP for GDPR breaches.  Tuckers was fined £98,000 after being hit by a ransomware attack.

1.     Law firms are not unique.

2.     What about other legal regulations and regulatory bodies?

3.     The background facts.

4.     What did the ICO say?

5.     Lessons learned.

Resources

For more information on the Tuckers enforcement action, check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, consider the recently announced EU/US resolution to allow data transfer from the EU to the United States through the mechanism of Privacy Shield 3. Some of the issues we consider include:

1.     Is it Déjà vu all over again?

2.     What about consent and standard contractual clauses as a basis for data transfer?

3.     What was the court’s ruling?

4.     Why double due diligence will be required going forward?

5.     What about the UK?

6.     What does Max Shrems have to say?  

 Resources

Check out the Cordery Compliance, client alert on this topic, click here and here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In the 2020 Morrisons case the UK Supreme Court ruled that an employer can be legally responsible for data breaches caused by their employees, although in the particular situation in that case the court ruled that Morrisons (the employer) was not liable for the actions of their rogue employee. In this episode, Tom and Jonathan look at the more recent case of Isma Ali v. Luton Borough Council where the High Court ruled that in committing the data security breach actions the rogue employee undertook, she had solely pursued her own interests and so the employer was not liable for her conduct. Some of the issues we consider include:

1.     What were the underlying facts of the case?

2.     What was the court’s ruling?

3.     Key Takeaways for the data privacy, data protection practitioner, including:

·      Take a close look at security measures and ensuring that access rights are policed. Data loss prevention and monitoring systems should also be in place to check for large data files leaving the organization - depending on the circumstances, a rogue employee might be after a lot of data;

·      Put in place appropriate policies and procedures to make sure that data protection principles like data security and data minimization are properly understood;

·      Perform a Data Protection Impact Assessment for new processes;

·      Make sure that employees in trusted roles are reliable and that their access rights are reviewed.  

·      Put in place and rehearse a data breach notification procedure, including detection and response capabilities;

·      Training staff on all of the above; and,

·      Check existing insurance or taking out new insurance to cover the range of potential risks from "innocent" errors to the actions of a rogue employee. 

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices