GDPR compliance

Q&As

How do we respond to customers who question or challenge us in relation to automated decision making?

Article 22(1) of the General Data Protection Regulation (UK GDPR), Retained Regulation (EU) 2016/679gives data subjects the right not to be subject to...

15th Feb

Q&As

Should law firms redact personal data from transaction bibles?

All personal data must be processed in accordance with the GDPR, including the seven data protection principles set out in Article 5 of Retained...

15th Feb

Q&As

Is a law firm a data controller or data processor under the General Data Protection Regulation? If a law firm acts as data processor, what contractual terms are required?

In the vast majority of cases, solicitors will act as the data controller in relation to personal data processed in connection with a client’s...

15th Feb

Q&As

What is the effect of the GDPR on direct marketing? Once the GDPR is applicable, can an organisation send direct marketing to customers, where they don’t know whether these customers have opted-in or opted-out to such marketing?

This response is limited to UK law as regulated by the Information Commissioner’s Office. For the purposes of this response we assume that no special...

Produced in partnership with Daradjeet Jagpal of Information Law Solutions 15th Feb

Q&As

Does the prohibition on unsolicited telephone calls advertising claims management services (Privacy and Electronic Communications (EC) Directive Regulations 2003, SI 2003/2426) apply to law firms?

This prohibition on unsolicited telephone calls advertising claims management services derives from the Privacy and Electronic Communications (EC)...

15th Feb

Q&As

When a solicitor instructs counsel to appear at a hearing and advise generally in respect of a matter, should the barrister be considered a processor, a controller or a joint controller (along with the solicitor) of the data?

The General Data Protection Regulation (GDPR) distinguishes between ‘data controllers’ and ‘data processors’.The GDPR definition of a data controller...

15th Feb

Precedents

Response to subject access request—able to comply with request—law firms [Archived]

ARCHIVED: This archived Precedent reflects the data protection regime before 25 May 2018 under the Data Protection Act 1998. This Precedent is for...

14th Feb

Q&As

If an employer dismisses a data protection officer with less than two years’ service on the grounds that they were insufficiently expert and/or capable to do the job, what individual rights of redress would that officer have in respect of that dismissal? What enforcement action might the ICO take? How would a data protection officer dismissed in contravention of the GDPR bring a claim for compensation for that dismissal under the GDPR? Does the reference in Article 79(2) of the GDPR to ‘data subject’ in any way affect or limit the right to bring a claim for compensation under Article 82(1) of the GDPR?

Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) itself describes issues pertaining to data protection officers (DPOs) at Articles...

14th Feb

Q&As

When will a consultant be a processor for the purposes of Regulation (EU) 2016/679, the GDPR?

For further information, see the sections in Practice Note: The General Data Protection Regulation (GDPR), headed: Controllers and Processors.Under...

14th Feb

Practice notes