Transparency, privacy policies and notices

The United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) provides various requirements concerning data transparency.

The terms ‘privacy policy’, ‘data protection policy’, ‘privacy notice’, ‘privacy statements’, ‘fair processing notices’ and ‘data protection notice’ are interchangeable.

For an introduction to the UK GDPR, see Practice Notes: Introduction to the EU GDPR and UK GDPR and The UK General Data Protection Regulation (UK GDPR).

This subtopic contains guidance:

  1. relating to privacy policies generally

  2. on the related topic of cookie policies

  3. relating to employment specific policies

Transparency and the role of privacy policies

Transparency is an overarching obligation under the UK GDPR

The concept is embodied in the lawfulness, fairness and transparency principle under Article 5(1)(a) of the UK GDPR, which requires personal data to be ‘processed lawfully, fairly and in a transparent manner in relation to the data subject’.

However,

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Powered by Lexis+®
Latest Information Law News

No harm, no foul? Court of Appeal provides clarifications around controllers’ liability in the context of compensation claims under Article 82 of the UK GDPR (Farley and others v Paymaster (1836) Ltd (trading as Equiniti) (Information Commissioner intervening))

Information Law analysis: In a landmark ruling, the Court of Appeal overturned a High Court decision which denied compensation to individuals affected by a data breach. The judgment contains helpful clarifications regarding compensation claims made pursuant to Article 82 of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (the UK GDPR), including the requirements for establishing UK GDPR infringement, the scope of non-material damage and, more broadly, the position of the UK courts in relation to EU Court of Justice case law and its application in the context of domestic data protection rules. The Court of Appeal held that bringing a UK GDPR infringement claim does not require proof that personal data was actually disclosed to third parties. Unlawful processing is a sufficient basis in principle for damage to be suffered. There is also no minimum threshold for non-material damage when it comes to a data subject’s entitlement to compensation under Article 82 of the UK GDPR. The scope of such damage can include an objective, well-founded fear or apprehension of misuse of personal data. This judgment is also a helpful reminder of the broad scope of activities that fall within the concept of processing and the importance of controllers’ compliance with Articles 24, 25 and 32 of the UK GDPR and the general principles in Article 5(1) of the UK GDPR. Written by Marija Nonkovic, associate at Kemp IT Law.

View Information Law by content type :

Popular documents