Transparency, privacy policies and notices

The United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) provides various requirements concerning data transparency.

The terms ‘privacy policy’, ‘data protection policy’, ‘privacy notice’, ‘privacy statements’, ‘fair processing notices’ and ‘data protection notice’ are interchangeable.

For an introduction to the UK GDPR, see Practice Notes: Introduction to the EU GDPR and UK GDPR and The UK General Data Protection Regulation (UK GDPR).

Assimilated law is the name given to retained EU law (REUL) which remains in force after the end of 2023. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles.

From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under the To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

NCSC releases Annual Review 2024, highlighting cybersecurity progress

The National Cyber Security Centre (NCSC) has published its eighth Annual Review, covering the period from 1 September 2023 to 31 August 2024. The review showcases the organisation's efforts to enhance the UK's online safety and provide clarity in an increasingly complex digital landscape.

Finnish SA fines Posti €2.4m for unlawful data processing practices

The European Data Protection Board has reported that the Finnish Supervisory Authority (SA) has imposed a €2.4m fine on Posti for unlawful processing of personal data. The SA found violations of EU General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) Articles 5, 6.1, 13, and 25, including automatic creation of electronic mailboxes without consent and inadequate customer information. Posti received a reprimand for informational shortcomings and was ordered to rectify its unlawful practices, particularly focusing on data protection by design in its electronic services.

ICO extends public sector approach, launches consultation on fines

The Information Commissioner's Office (ICO) has announced the continuation of its public sector approach following a two-year trial. The approach, which emphasises proactive engagement and reduced fines for public authorities, has shown positive impact according to a review. The ICO is now consulting on the scope of the approach and circumstances for issuing fines to public bodies until 31 January 2025. The Information Commissioner has also committed to improving engagement beyond central government and ensuring senior leaders take accountability for data protection compliance.

Data breaches and liability in the age of AI—Who’s responsible?

Arbitration analysis: As Artificial Intelligence (AI) continues to revolutionise industries such as healthcare, finance, and logistics, it also raises complex legal questions, especially around data privacy. AI systems depend on massive datasets to perform functions like predictive analytics, natural language processing, and automated decision-making. These systems not only process vast amounts of personal data but often also interact autonomously, sometimes without human oversight. This makes AI both a transformative technology and a significant risk vector for data breaches. Tahir Khan, Barrister at The Barrister Group, considers data breaches and liability in the Age of AI, and who is responsible.

View Information Law by content type :

News