Life with GDPR

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, consider the recently announced EU/US resolution to allow data transfer from the EU to the United States through the mechanism of Privacy Shield 3. Some of the issues we consider include:

1.     Is it Déjà vu all over again?

2.     What about consent and standard contractual clauses as a basis for data transfer?

3.     What was the court’s ruling?

4.     Why double due diligence will be required going forward?

5.     What about the UK?

6.     What does Max Shrems have to say?  

 Resources

Check out the Cordery Compliance, client alert on this topic, click here and here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In the 2020 Morrisons case the UK Supreme Court ruled that an employer can be legally responsible for data breaches caused by their employees, although in the particular situation in that case the court ruled that Morrisons (the employer) was not liable for the actions of their rogue employee. In this episode, Tom and Jonathan look at the more recent case of Isma Ali v. Luton Borough Council where the High Court ruled that in committing the data security breach actions the rogue employee undertook, she had solely pursued her own interests and so the employer was not liable for her conduct. Some of the issues we consider include:

1.     What were the underlying facts of the case?

2.     What was the court’s ruling?

3.     Key Takeaways for the data privacy, data protection practitioner, including:

·      Take a close look at security measures and ensuring that access rights are policed. Data loss prevention and monitoring systems should also be in place to check for large data files leaving the organization – depending on the circumstances, a rogue employee might be after a lot of data;

·      Put in place appropriate policies and procedures to make sure that data protection principles like data security and data minimization are properly understood;

·      Perform a Data Protection Impact Assessment for new processes;

·      Make sure that employees in trusted roles are reliable and that their access rights are reviewed.  

·      Put in place and rehearse a data breach notification procedure, including detection and response capabilities;

·      Training staff on all of the above; and,

·      Check existing insurance or taking out new insurance to cover the range of potential risks from “innocent” errors to the actions of a rogue employee. 

 

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, dissect the case of the Smart TV and considers its implications for de minimis cases brought under GDPR. Some of the issues we consider include:

1.     What were the underlying facts of the case?

2.     Was the case filed in the correct court (High Court)? If not, why not?

3.     What was the court’s ruling?

4.     What is the viability of a de minimums claim going forward?

5.     When dealing with data protection infringement compensation claims, look to cases from other jurisdictions.

6.     No matter how seemingly trivial, organizations should be prepared for them and manage them with care.  

 Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we celebrate the 10-year anniversary of the initial proposal of the law which became GDPR. Some of the issues we consider include:

1. What was in the original proposal that did not become enacted in the final law?
2. Reduction in costs-what happened?
3. Right to be Forgotten, morphed into something very different than intended.
4. Fines, Fines, Fines.
5. Evolution of regulatory sophistication.
6. Criticism of regulators.

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong and Tom Fox return for another episode of Life with GDPR. In this episode, we take a deep dive into class action litigation in the UK and EU around data privacy and data protection. Some of the issues we consider include:

1.     Has the tide turned in favor of defendants in class action litigation in the UK?

2.     Are actual damages now required to receive damages after a data breach?

3.     How can a company manage a regulatory investigation of a data breach during a class action litigation?

4.     What about suits against Boards of Directors?

 Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Life with GDPR named one of the top 30 Data Security Podcasts you must follow in 2022.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong returns from assignment to take on a potpourri of issues with co-host Tom Fox. In this episode, we consider some of the issues from the Blackbaud data breach enforcement action. Some of the issues we consider include:

1. Does this matter signal a priority in risk shifting by the regulators?
2. Implications for class actions involving customers.
3. Hardening of the insurance market regarding data breaches.
4. More due diligence coming in the B2B arena.
5. Steps your organization should take now.

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong returns from assignment to take on a potpourri of issues with co-host Tom Fox. We use the recent speech by Deputy Attorney General Lisa Monaco as a jumping off point to discuss how this change in DOJ enforcement policy and focus will be impacted by GDPR, the new EU Whistleblower Directive and how increased international cooperation around international anti-corruption compliance may play out. Some of the issues we consider include:

1. Data protection issues under the new DOJ FCPA enforcement policy?
2. Monitorships outside the US.
3. Data privacy and investigations.
4. Class actions in the UK going forward.
5. Increased cooperation between the DOJ/SEC and the UK Serious Fraud Office.

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong is on assignment in Cornwall so for this episode Cordery Compliance co-founder Andre Bywater joins Tom Fox to discuss issues relating to the upcoming EU Whistleblower Directive, with a go live date of December 17. This is Part 2 of a special 2-part episode. Some of the questions we consider include:

1. What about whistleblowing and data protection issues?
2. Are individuals subject to whistleblowing allegations also protected?
3. Subject Access Requests.
4. False whistleblowing.
5. Sanctions for non-compliance.
6. Bounties for whistleblowing.
7. When must the EU whistleblowing rules be implemented?
8. Post-Brexit, how will the UK be implementing these rules?
9. What are Andre’s three takeaways?

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jonathan Armstrong is on assignment in Cornwall so for this episode Cordery Compliance co-founder Andre Bywater joins Tom Fox to discuss the upcoming EU Whistleblower Directive go live date of December 17. This is Part 1 of a special 2-part episode. Some of the questions we consider include:

1.     Why is the EU tackling whistleblowing & what EU areas fall in scope?

2.     Who can be a whistleblower?

3.     What about anonymity and confidentiality?

4.     Which whistleblowing route should a whistleblower follow?

5.     Are there any record-keeping obligations?

6.     Is retaliation prohibited?

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode Jonathan Armstrong and Tom Fox are back to discuss issues relating to data privacy, data protection and GDPR. In this episode we take up a recent decision from Luxembourg which would seem antithetical to good whistleblower practices. We also consider the upcoming EU Whistleblower Directive go live date of December 17. Some of the questions we consider include:

1.     What are the facts of the enforcement actions? 

2.     When should company harm outweigh public good from whistleblowers?

3.     What lessons can companies learn from this matter in conjunction with the EU whistleblower directive?

Resources

Check out the Cordery Compliance, client alert on this topic, click here. For more information on Cordery Compliance, go their website here. Also check out the GDPR Navigator, one of the top resources for GDPR Compliance by clicking here.

Learn more about your ad choices. Visit megaphone.fm/adchoices