Please ensure that this Privacy impact assessment is sufficient for your needs—you may need to carry out a full Data protection impact assessment (DPIA)—see [insert link to your organisation’s DPIA screening questions]. 1 Background information Project name [insert a name for the project] Date of privacy impact assessment (PIA) completion [insert the date the PIA is being completed] Name and email address of person responsible for the project and completing this form [insert name and email address of the person completing the PIA form—eg the project manager] 2 Describe the project Describe the project or activity and its intended purpose [insert general description of the project or activity, eg what you want to achieve and why. You may find it helpful to refer or link to other documents, eg a project proposal] Explain why you need to process personal data—including whether you could achieve your project aims without the use of personal data [insert explanation, eg describe specifically what the project aims to achieve using personal data and/or why the project will not work without using personal data. Explain what steps you have taken to consider whether you actually

Please ensure that this privacy impact assessment (PIA) is sufficient for your needs. You may need to carry out a full data protection impact assessment (DPIA)—see [insert link to your organisation’s DPIA screening questions]. 1 Background information Project name [insert a name for the project] Date of PIA [insert the date the PIA is being completed] Name and email address of person responsible for the project and completing this PIA [insert the name and email address of the person completing the PIA, eg the project manager] 2 Describe the project Describe the data sharing project/activity and its intended purpose [insert a general description of the project, eg what you want to achieve by sharing personal data and why. You may find it helpful to refer or link to other documents, such as a project proposal] Could you achieve your project aims without sharing personal data? ☐ Yes—if so, you should not share the personal data. ☐ No—[explain why not.] Could you achieve your project aims by sharing less personal data? ☐ Yes—if so, you should reduce the amount of personal data you intend to share. ☐ No—[explain why not.]

So-called ‘super-injunctions’ refer to court orders which prohibit reporting the fact of the order (ie that an injunction exists at all). They gained particular notoriety in the media between 2010 and 2011, although only a small handful were ever actually granted by the courts in that time. ‘Anonymised injunctions’ were generally more common, although since 2011 applications for injunctions (anonymised or otherwise) have been few and far between in English courts.

The tort of misuse of private information is focused on ‘the protection of human autonomy and dignity—the right to control the dissemination of information about one’s private life and the right to the esteem and respect of other people’ (Campbell v MGN). In most cases, as in Campbell, the only alleged ‘misuse’ is the wrongful publication, or threatened publication, of personal information to the world at large. The defendant is often a media organisation and/or a person seeking to disclose information through the media. However, a misuse of private information claim may be brought in respect of information disseminated less widely if that would unjustifiably interfere with the claimant’s right to respect for privacy under article 8 of Part I of Schedule I to the Human Rights Act 1998 (HRA 1998). This gives effect to the rights enshrined in the European Convention on Human Rights (ECHR). However, the tort is not confined to publication of information, as the so-called ‘phone hacking’ litigation illustrated.

This Practice Note focuses on the remedies available in respect of misuse of private information (whether it be for an actual or threatened publication or for the method by which personal information has been obtained) and breach of confidence (in the context of the disclosure of personal information). Damages and an injunction are the most common remedies sought. However, since the law relating to misuse of private information/breach of confidence covers a wide range of factual situations, the courts will adopt a flexible approach to remedies. What this means is that, on the facts of one case, an injunction preventing the threatened disclosure of information will be the most important remedy to give effect to the claimant’s right of privacy, whereas in another case the defendant may have already made an unauthorised disclosure of the information and received a commercial benefit from doing so. In the latter case, the appropriate remedies may be damages or an order for an account of the profits, an injunction to restrain any further publication and an order for delivery

Commonly refers to an external-facing data protection notice (or ‘policy’) addressing the information and transparency requirements under data protection and privacy laws.

1 Introduction Date of review [Insert date] Person conducting review [Insert name or job description] 2 Description of the privacy notice Type/description of privacy notice [Insert, eg Privacy policy on customer-facing website] Wording used [Insert or attach wording] Where and when is the notice displayed/provided? [Insert, eg In the ‘Legal notices’ section at the footer of our website. Publicly available at all times] What medium is used? [Insert, eg Electronic written format] Is this a one-off notice or part of a layered approach? ☐ One-off☐ Part of a layered approachIf a layered approach, give more information, eg combined with just-in-time notices, video notices, icons and symbols and/or privacy dashboard Does the notice cover all current or intended uses of the data? ☐ Yes☐ NoIf no, consider what additional purposes are intended and whether the lawful ground for processing needs to be revisited If the data is to be used for more than one purpose, does the notice make this clear? ☐ Yes☐ No Where appropriate, is any request for consent:—presented via opt-in box(es), ie not via pre-ticked boxes?—granular, ie opt-in consent box offered for each different type of processing?—unambiguous?—specific? ☐ Yes☐ No☐ NA Have you tested this privacy notice with potential users? ☐ Yes☐ No If you have tested

We ask that you read this privacy notice carefully as it contains important information about who we are, what personal data (information) we hold about you, how and why we collect, store and use it, how we may share this information and your rights in relation to your personal information. Who we are [[Insert name of trustee company] OR We] as trustees of the [insert name of the pension scheme] (the Scheme) collect, use and are responsible for certain personal information about you. When we do so we are regulated under the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018. We are responsible as ‘controllers’ of that personal information for the purposes of those laws. As controllers, we must provide you with the information contained in this privacy notice. [The [Insert name of trustee company] (company number [Insert company registration number)] has its registered office at [Insert registered office address]]. Personal data we collect about you Personal data is any information relating to an identified

We take your privacy very seriously. Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint. We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR). [We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to individuals [and our wider operations ]in the European Economic Area (EEA)]. Key terms It would be helpful to start by explaining some key terms used in this notice: We, us, our [Insert full legal name of each individual personal representative or the name of the firm if a trust corporation or all the members of a professional firm are acting], as personal representatives of the estate of [insert full name of the deceased],

We take your privacy very seriously. Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint. We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR).[ We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to individuals[ and our wider operations] in the European Economic Area (EEA).] Key terms It would be helpful to start by explaining some key terms used in this notice: We, us, our [Insert full legal name of all the trustees or, if the trustees are a professional firm, insert the firm’s name (if acting as corporate trustees)], as trustees of the [insert full name of the trust] (the Trust),[ and our group

This Precedent can be used to maintain a list of the various privacy notices your business deploys. It encourages you to consider how and where each privacy

In brief In summary, data protection law in the EU is intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly. To help ensure that, the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) imposes a large number of obligations on those ‘processing’ personal data, and on the controllers of such processing, when they are in the scope of the relevant regime. They also grant rights to those whose personal data is processed (the ‘data subjects’). ‘Processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it. It is virtually impossible to operate a business or other organisation without processing personal data. Among other things, the ‘controllers’ of personal data processing are required to provide certain information to data subjects, such as to ensure they know why their personal data is being collected, how it is being used, who it is being shared with, and their own key rights (that is called the ‘right to be informed’). That