Data protection in specific activities

This subtopic addresses compliance with the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) and the Data Protection Act 2018 (DPA 2018) in relation to specific activities carried out by organisations.

For an introduction to the data protection regime generally, including the data protection principles, the UK GDPR’s ‘assimilated law’ status, and the legislative terminology, territorial scope, applicability and exemptions, see: Data protection regime—overview and its associated subtopic.

For further guidance on the following general topics under the UK GDPR, see the relevant overview and its associated subtopic:

TopicOverview
Accountability, governance and complianceAccountability, governance and compliance—overview
Rights of data subjectsRights of data subjects—overview
Transparency, privacy policies and noticesTransparency and privacy policies and notices—overview
Sharing of personal data and personal data in commercial transactionsData sharing and transactions—overview
International transfers of personal dataInternational transfers—overview
Breaches, sanctions and enforcementData breaches, sanctions and enforcement—overview

For a collection, collating key practical guidance, see: UK

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Powered by Lexis+®
Latest Information Law News

No harm, no foul? Court of Appeal provides clarifications around controllers’ liability in the context of compensation claims under Article 82 of the UK GDPR (Farley and others v Paymaster (1836) Ltd (trading as Equiniti) (Information Commissioner intervening))

Information Law analysis: In a landmark ruling, the Court of Appeal overturned a High Court decision which denied compensation to individuals affected by a data breach. The judgment contains helpful clarifications regarding compensation claims made pursuant to Article 82 of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (the UK GDPR), including the requirements for establishing UK GDPR infringement, the scope of non-material damage and, more broadly, the position of the UK courts in relation to EU Court of Justice case law and its application in the context of domestic data protection rules. The Court of Appeal held that bringing a UK GDPR infringement claim does not require proof that personal data was actually disclosed to third parties. Unlawful processing is a sufficient basis in principle for damage to be suffered. There is also no minimum threshold for non-material damage when it comes to a data subject’s entitlement to compensation under Article 82 of the UK GDPR. The scope of such damage can include an objective, well-founded fear or apprehension of misuse of personal data. This judgment is also a helpful reminder of the broad scope of activities that fall within the concept of processing and the importance of controllers’ compliance with Articles 24, 25 and 32 of the UK GDPR and the general principles in Article 5(1) of the UK GDPR. Written by Marija Nonkovic, associate at Kemp IT Law.

View Information Law by content type :

Popular documents