Life with GDPR

Life with GDPR

By Tom FoxBusinessNewsTech NewsManagement
Download on the App Store

Life with GDPR episodes

  • SARS and Liability Issues under GDPR

    In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider the increase in subject access requests (SARs) and other liability issues under GDPR. Recently, the UK Data Protection Authority, the Information Commissioner’s Office (ICO), issued new guidance on handling SARs. The guidance follows responses from organization of all shapes and sizes however and is clearly an indication of what the ICO is thinking. Cordery also took part in the consultation process for this new guidance.

    Learn more about your ad choices. Visit megaphone.fm/adchoices

    23 min
  • H&M Fined €35.2 for Data Privacy Breaches

    In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. In this episode, we consider recent decision by the Hamburg Data Protection Authority which fined H&M Germany €35.2m for GDPR violations. The case concerned excessive use of employee data and is the largest fine so far imposed by regulators for the handling of employee data. We are likely to see more pressure on employers to justify the handling of employee data as a result of today’s fine. Some of the highlights are: 

    1. What did the regulator say?
    2. What did H&M do after the investigation began?
    3. What about the current pandemic?
    4. What are the implications going forward?
    5. What is this decision’s precedential value?
    6. What are some practical tips for compliance?

      7. Check out the Cordery Compliance, client alert on this case, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

      Learn more about your ad choices. Visit megaphone.fm/adchoices

      23 min
    7. Schrems III-Impact on the Transatlantic Digital Trade

      In this episode, I am joined by Jed Gardner of Linedata to discuss some of the practical aspects the Schrems III case, where the Court invalidated Privacy Shield. Some of the highlights are:

      • Why was this and what are the wider impacts to transatlantic digital trade? 
      • When does this come into effect? Is there any grace period? 
      • Let’s look at a transatlantic organization (Investment Firm). What risks are they now dealing with? 
      • What should businesses be doing with their technology to address the ruling and ensure they can meet the EU GDPR data privacy regulations? 

        • Check out the Linedata on their homepage here.

        Learn more about your ad choices. Visit megaphone.fm/adchoices

        22 min
      • Emergency Podcast on Schrems III

        In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. Today, we do our first emergency podcast based upon the European Court of Justice’s decision handed down July 16 on the Schrems III case, where the Court invalidated Privacy Shield. Some of the highlights are: 

        1. What were the issues involved in this case?
        2. What did the Court find wanting in Privacy Shield?
        3. What are the differences in the European and American approach that led to this result?
        4. What was the ruling around standard contract clauses for data transfer?
        5. What are the implications going forward?

          6. Check out the Cordery Compliance, client alert on this case, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

          Learn more about your ad choices. Visit megaphone.fm/adchoices

          17 min
        6. Duty of Data Processor to Report Data Breach

          In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider recent decision by the Swedish Data Protection Authority recently imposed a fine of 200,000 Swedish kronor (approximately €18,700 or $21,320) on the Swedish National Government Service Centre (“the NGSC”) for failing to notify both the Data Protection Authority and others about a personal data breach in sufficient time.  Some of the highlights are:

          1. What were the issues and interests involved in this case?
          2. What are the requirements for a reporting of a data breach under GDPR?
          3. What are the differences in duties of the Data Processor and Data Controller?
          4. What are the implications going forward?
          5. What is this decision’s precedential value?
          6. Is the decision Kafkaesque in its reasoning?


            7. Check out the Cordery Compliance, client alert on this case, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.


            Learn more about your ad choices. Visit megaphone.fm/adchoices

            16 min
          7. Requirements for the DPO

            In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider recent decision by the Belgian Data Protection Authority which imposed a fine of €50,000 ($54,203) on an un-named organization for non-compliance with the GDPR conflict of interest requirement; in the selection of its Data Protection Officer.  Some of the highlights are:

            1. What were the issues and interests involved in this case?
            2. What are the requirements for a DPO under GDPR?
            3. How and why was the company ‘seriously negligent’?
            4. What are the implications going forward?
            5. What is this decision’s precedential value?
            6. How much expertise, authority and autonomy must a DPO have going forward?


              7. Check out the Cordery Compliance, client alert on this case, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.


              Learn more about your ad choices. Visit megaphone.fm/adchoices

              24 min
            7. Verbal Reporting under GDPR

              In this episode I visit with Jonathan Armstrong are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider the issue of verbal reporting under GDPR, in the context of the case of Scott v. LGBT Foundation. Some of the highlights are:

              1. What were the issues and interests involved in this case?
              2. What is a relevant filing system for automated data under GPDR?
              3. When does the public health and safety outweigh data privacy?
              4. Was Scott’s data processed by the LGBT Foundation?
              5. What is the necessity test?

                6. Check out the Cordery Compliance, client alert on the case of Scott v. LGBT Foundation, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

                Learn more about your ad choices. Visit megaphone.fm/adchoices

                20 min
              6. CCTV and Data Privacy

                In this episode I visit with Jonathan Armstrong are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider the intersection of Closed Circuit Television (CCTV) and data privacy. Some of the highlights are:

                1. CCTV is ubiquitous in the UK. Why is a DPIA so critical in GDPR compliance around this issue?
                2. What about the safety implications for CCTV?
                3. What about Subject Access Requests?
                4. Transparency is critical. This means full notice to all employees.
                5. What should be your retention policy?

                  6. Check out the Cordery Compliance, client alert on the CCTV and data privacy, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

                  Learn more about your ad choices. Visit megaphone.fm/adchoices

                  16 min
                6. Morrisons at the UK Supreme Court

                  In this episode I visit with Jonathan Armstrong are back to discuss issues relating to data privacy, data protection and GDPR. Today, we consider the recent decision by the UK Supreme Court on the Morrisons case. Some of the highlights are:

                  1. What were the background facts of the case and the trial court ruling?
                  2. What did the UK Supreme Court rule?
                  3. Does the SCt ruling leave the door open for subsequent class actions?
                  4. What are the differences between primary liability and vicarious liability?
                  5. What steps should a company take in response to the Morrisons ruling?
                  6. What does all of this mean for US companies, trying to get data out of the UK and EU?

                    7. Check out the Cordery Compliance, client alert on the Morrisons decision, here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

                    Learn more about your ad choices. Visit megaphone.fm/adchoices

                    22 min
                  7. Cathay Pacific Enforcement Action

                    In this episode of Life with GDPR, Jonathan Armstrong and Tom Fox consider the recently released UK Information Commissioner’s Office (ICO) Cathay Pacific Airways Limited fine of £500,000 for failing to protect the security of its customers’ personal data. This is a pre-GDPR case and the fine represents the maximum fine under the ICO’s pre-GDPR powers. The ICO took into particular account the fact that Cathay Pacific failed to follow its own policies and ignored fundamental best practices.

                    Some of the highlights in this episode include:

                    1. What were the background facts of the enforcement action?
                    2. What are the implications of a pre-GDPR enforcement action?
                    3. Why was the maximum fine levied?
                    4. What were the regulators findings?
                    5. What are the lessons learned for the data protection practitioner?
                    6. Where listeners can go for more information.

                      7. Resources

                      Cordery Breach Navigator

                      Cordery Client Alert “Client Alert: ICO Fines Cathay Pacific £500k for Data Security Breach”

                      Learn more about your ad choices. Visit megaphone.fm/adchoices

                      17 min

                    About Life with GDPR

                    From the publisher's feed

                    How does GDPR, data privacy, and data protection impact your business?