On May 25, 2021, the Grand Chamber of the European Court of Human Rights handed down its judgement in the case of Big Brother Watch and Others v. the United Kingdom, determining that the former surveillance regime in the UK violated Article 8 of the European Convention on Human Rights (i.e., the right to respect for private and family life).
Continue Reading European Court of Human Rights Says Bulk Interception Is Not a Violation of Human Rights
United Kingdom
European Commission Publishes Final Version of Updated Standard Contractual Clauses
Posted on
Posted in European Union, International
On June 4, 2021, the European Commission published the final version of the implementing decision on standard contractual clauses for transfers of personal data to third countries under the EU General Data Protection Regulation, as well as the final version of the new standard contractual clauses.…
Continue Reading European Commission Publishes Final Version of Updated Standard Contractual Clauses
UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions
Posted on
Posted in European Union, Information Security
On May 26, 2021, the Court of Appeal handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the UK 2018 Data Protection Act’s “immigration exemption” is unlawful.…
Continue Reading UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions
MEPs Urge European Commission to Amend Draft UK Adequacy Decision
Posted on
Posted in European Union, Information Security
On May 11, 2021, the European Parliament issued a press release requesting that the European Commission amend its draft decisions on UK adequacy to more closely align with EU court rulings and the opinion of the European Data Protection Board. The request came after the Parliament’s Civil Liberties Committee passed a resolution evaluating the Commission’s approach regarding the adequacy of the UK’s data protection regime.…
Continue Reading MEPs Urge European Commission to Amend Draft UK Adequacy Decision
EDPB Adopts Opinion on Draft UK Adequacy Decision
Posted on
Posted in European Union, Information Security
The European Data Protection Board has adopted its Opinion on the draft UK adequacy decision issued by the European Commission on February 19, 2021. The EDPB’s Opinion is non-binding but will be persuasive. The adequacy decision will be formally adopted if it is approved by the EU Member States acting through the European Council. If the adequacy decision is adopted, transfers of personal data from the EU to the UK may continue without the implementation of a data transfer mechanism under the EU General Data Protection Regulation, such as Standard Contractual Clauses. …
Continue Reading EDPB Adopts Opinion on Draft UK Adequacy Decision
Ticketmaster Appeal of ICO Fine Stayed by UK Tribunal Until 2023
Posted on
On April 9, 2021, the First-Tier Tribunal of the General Regulatory Chamber stayed proceedings in Ticketmaster UK Limited’s (“Ticketmaster’s”) appeal against a fine issued by the UK Information Commissioner’s Office (“ICO”) until 28 days after a judgment in civil litigation brought by 795 customers against Ticketmaster. The group action, which relates to the breach for which Ticketmaster was fined by the ICO, is currently before the High Court in England. As a result of the stay in proceedings, the appeal likely will not be heard before the Tribunal until mid to late 2023.
…
Continue Reading Ticketmaster Appeal of ICO Fine Stayed by UK Tribunal Until 2023
UK Government and ICO Agree on Procedure for Future Adequacy Decisions
Posted on
The Secretary of State for Digital, Culture, Media & Sport has signed a Memorandum of Understanding with the UK Information Commissioner’s Office in relation to new UK adequacy assessments following the UK’s departure from the European Union. The Memorandum of Understanding sets out how DCMS and third countries will negotiate adequacy decisions, referred to under the Memorandum of Understanding as “adequacy regulations”. …
Continue Reading UK Government and ICO Agree on Procedure for Future Adequacy Decisions
European Commission Publishes Draft UK Data Transfer Adequacy Determination
Posted on
Posted in European Union, Information Security
On February 19, 2021, the European Commission published a draft data protection adequacy decision relating to the UK. If the draft decision is adopted, organizations in the EU will be able to continue to transfer personal data to organizations in the UK without restriction, and will not need to rely upon data transfer mechanisms, such as the EU Standard Contractual Clauses, to ensure an adequate level of protection.…
Continue Reading European Commission Publishes Draft UK Data Transfer Adequacy Determination
ICO Confirms UK Firms May Rely on Public Interest Derogation for SEC Transfers
Posted on
On January 19, 2021, the UK Information Commissioner’s Office published its analysis of the application of the UK General Data Protection Regulation to transfers from UK-based firms or branches that are registered, required to be registered or otherwise regulated by the U.S. Securities and Exchange Commission. …
Continue Reading ICO Confirms UK Firms May Rely on Public Interest Derogation for SEC Transfers
UK Case Tests the Territorial Application of the GDPR to U.S. Run Website
Posted on
The recent UK case of Soriano v Forensic News and Others tested the territorial reach of the General Data Protection Regulation and represents the first UK judgment dealing with the territorial scope of the GDPR. This was a “service out” case, where the claimant, Walter T. Soriano, sought the Court’s permission under the UK Civil Procedure Rules to serve proceedings on the defendants, who were all domiciled in the U.S.…
Continue Reading UK Case Tests the Territorial Application of the GDPR to U.S. Run Website