Welcome to our regular European Data Protection Bulletin
Particular highlights this month include:
- Updates on ICO Guidance on video surveillance, anonymisation and research; and
- EDPB Guidelines on Codes of Conduct for Data Transfers and draft Guidelines on the use Dark Patterns in Social Media
Use the links below to navigate through our newsletter:
European Union
United Kingdom
UK Enforcement
Information Tribunal Appeal Cases
EDPB
EDPB issues finalised Guidelines on Codes of Conduct as tools for transfers. They have also produced Draft Guidelines on dark patterns in social media platform user interfaces. In our bulletin, we explore what dark patterns are, how they can be categorised, the social media lifecycle, and how they interact with the GDPR.
Information Commissioner’s Office (ICO)
ICO issues updated Guidance on Video Surveillance, and we explore examples of how to build trust when using surveillance systems if they are aligned with data protection law requirements. The ICO also consult on two further chapters of its Anonymisation guidance, we present a summary of Chapter 3 (Pseudonymisation) and Chapter 4 (Accountability and governance). Lastly, in April 2022, the ICO closed a consultation into its new guidance on the research provisions in the UK GDPR and the DPA 2018.
UK Cases
In this month’s bulletin, the UK case that we discuss is the ‘Brake v. Guy [2022] EWCA Civ 235: Employee had no reasonable basis to expect privacy in respect of personal emails sent using a shared work account’. This case focuses on the law of misuse of private information, how you demonstrate that misuse and the factors undermining a reasonable expectation of privacy.
UK ICO Enforcement
The ICO has been particularly active in the last couple of months with PECR monetary penalties and enforcement notices particularly against organisations making unsolicited marketing calls to vulnerable older individuals. There has also been an Enforcement Notice for failing to respond to a DSAR and a monetary penalty for a security breach caused by a ransomware attack under the GDPR.
Information Tribunal Appeal Cases
The case that we present this month, is the James Peters appeal. The appeal against the imposition of a monetary penalty for failure to pay the £60 data protection fee. Click on the link below to discover the outcome.
For further information, please contact:
Ariane Mole, Partner, Bird & Bird
ariane.mole@twobirds.com
