HR Articles

This week the Information Commissioner’s Office (ICO) handed Interserve a £4.4 million fine for failing to put appropriate measures in place to prevent unauthorised access of private data.

The European Data Protection Board has opened a public consultation in relation to one of its guidelines on personal data breach notification under the GDPR.

The Data Protection and Digital Information Bill (“DPDI Bill”) was due to have its second reading in Parliament on 5 September 2022. The aim of the Bill was to update the UK’s data protection framework. However, this was halted due to the appointment of Liz Truss as the new Prime Minister.

In September 2021, the government launched a consultation – ‘Data: a new direction’ – as part of its proposals to reform the UK’s data protection laws following Brexit, the responses to which were published in June this year. 

There have been many developments relating to how data flows are governed, ranging from the standard contractual clauses (SCCs) to the notable Schrems II decision; following this, the UK was deemed an ‘adequate’ country by the EU in respect of personal data transfers. Earlier this year, the Secretary of State laid before Parliament the International Data Transfer Agreement (IDTA), the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions.

On 25 July 2022, the Information Commissioner’s Office (ICO) published guidance and revised application forms and tables to simplify the UK Binding Corporate Rules (UK BCRs) approval process for controllers and processors.

There have been many developments in data protection over the last few years, ranging from the implementation of the GDPR, the result of the decision in the case of Schrems II and new agreements and processes for international data transfers.

Under the General Data Protection Regulation (GDPR), in both the EU and UK versions, employees have the right to request access to their personal data from their employer called a Data Subject Access Request (DSAR).   

A controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data.

On 10 May 2022, Prince Charles confirmed, as set out in the Queen’s Speech, that there would be a new data protection regime in the UK, with some measures extending and applying to England and Wales only.