Data breaches, sanctions and enforcement

This subtopic discusses managing a data security breach involving personal data as well as sanctions and enforcement actions by the Information Commissioner’s Office (ICO) under the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). This Overview provides a high-level introduction to the subtopic and signposts more detailed guidance housed within it.

Assimilated law is the name given to retained EU law (REUL) which remains in force after the end of 2023, such as the UK GDPR. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles. From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under the European Union (Withdrawal) Act 2018). For more information, see Practice Note: Assimilated law and News Analysis: Implications of the move to ‘assimilated’ law, and the Retained EU Law (Revocation and Reform)

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Information Law weekly highlights—21 November 2024

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

PECR—a serious but non-deliberate breach still warrants a substantial penalty (Monetise Media Ltd v Information Commissioner)

Information Law analysis: In this full-merits review of a monetary penalty notice (MPN), the First-Tier Tribunal (FTT) considered an appeal by Monetise Media Ltd (MML) against the Commissioner's decision to levy a £125,000 MPN in response to a contravention of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The FTT substituted a lower penalty of £85,000, having found that (i) MML 'instigated' the sending of unsolicited marketing messages by third-party affiliates; (ii) MML did so negligently, but not deliberately; and (iii) the Commissioner had erred in the MPN by using too high a starting point and giving excess weight to aggravating factors. Written by Edward Rees, associate at Stephenson Harwood LLP.

ICO and DSIT launch tool to assess Privacy Enhancing Technologies

The Information Commissioner's Office (ICO) and the Department for Science, Innovation and Technology (DSIT) have jointly published a Privacy Enhancing Technologies (PETs) Cost-Benefit Awareness Tool. This resource is designed to help organisations evaluate the costs and benefits of adopting emerging PETs, such as homomorphic encryption and secure multi-party computation. Accompanied by a checklist, the tool aims to support responsible data use and innovation while safeguarding privacy. The initiative addresses the low uptake of PETs due to challenges in assessing their value, and includes guidance on compliance costs and benefits. A repository of real-world PETs use cases has also been released to illustrate practical applications across various sectors.

ICO invites participation in DSIT's call for evidence on Cyber Security and Resilience Bill

The Information Commissioner's Office (ICO) has called on stakeholders to participate in the Department for Science, Innovation and Technology's (DSIT) call for evidence on its proposals to update the Network and Information Systems (NIS) Regulations 2018, SI 2018/506, through the Cyber Security and Resilience Bill (the Bill). The call for evidence seeks to assess the impact the changes would have on those regulated under the NIS Regulations or who will be regulated under the forthcoming Bill. This survey will be open until 21 November 2024.

View Information Law by content type :

News