Transparency, privacy policies and notices

The United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) provides various requirements concerning data transparency.

The terms ‘privacy policy’, ‘data protection policy’, ‘privacy notice’, ‘privacy statements’, ‘fair processing notices’ and ‘data protection notice’ are interchangeable.

For an introduction to the UK GDPR, see Practice Notes: Introduction to the EU GDPR and UK GDPR and The UK General Data Protection Regulation (UK GDPR).

Assimilated law is the name given to retained EU law (REUL) which remains in force after the end of 2023. The re-categorisation of REUL (and associated terms) to assimilated law reflects a change in its status and treatment under UK law, in that it is generally to be interpreted according to ordinary domestic law and principles.

From 1 January 2024, REUL is ‘assimilated’ into domestic law by virtue of the fact it is generally stripped of EU-derived interpretive effects (eg supremacy of EU law, directly effective rights, and general principles previously retained under the To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Information Law weekly highlights—19 December 2024

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

ICO warns against Google's fingerprinting policy change, issues draft guidance

The Information Commissioner's Office (ICO) has responded to Google's announcement permitting fingerprinting techniques from February 2025, warning that businesses must still comply with data protection laws. The ICO has published draft guidance on how data protection law, including PECR, applies to storage and access technologies such as fingerprinting. The ICO emphasises that organisations must provide transparency, obtain consent, and ensure fair processing when using fingerprinting for advertising purposes. The regulator plans to release a comprehensive strategy in the new year to give users meaningful control over personalised advertisement. A consultation on this guidance opens on Friday, 20 December 2024.

MI5 wins case against lawyer accused of being Chinese spy

Law360, London: A solicitor accused of being a Chinese spy has lost her legal challenge against MI5, after a tribunal found 17 December 2024 that the UK security service acted lawfully when it warned parliamentarians that she was trying to interfere with the political process.

OpenAI, X, Google can use legitimate interest for AI models, EDPB says

MLEX: OpenAI, X, Google and Meta will be able to use legitimate interests as a legal basis for processing personal data for developing and deploying AI models provided that adequate mitigation measures are in place, the European Data Protection Board (EDPB) said in an influential opinion today. The EDPB opinion also touched upon how to address unlawful data processing for AI model development, and in what circumstances AI models can be considered anonymised.

View Information Law by content type :

News