Tim Hickman

The Court of Justice of the European Union has held that IP addresses are "personal data" in certain circumstances. This decision is significant because it means that the collection and further processing of IP addresses may be subject to EU data protection law, creating potential compliance difficulties for businesses.

After an unexpectedly long legislative process, the EU has published Regulation 2016/679 (the General Data Protection Regulation or “GDPR”). But what are the future implications of this new legislation?

The High Court recently held (obiter) that employers can be vicariously liable for data breaches caused by rogue employees. The decision highlights the importance to businesses of ensuring that data protection compliance requirements are properly addressed.

The High Court has ruled that a company conducting an investigation may be compelled to give effect to requests for information made under data protection legislation. The case serves as a stark reminder that data protection law is increasingly being used as a weapon by individuals affected by corporate investigations.

The European Parliament has voted on the General Data Protection Regulation. The vote marks the end of a four-year legislative process and makes the GDPR a reality.

EU Data Protection Authorities met in Brussels this week to deliver their eagerly anticipated opinion on the proposed EU-US Privacy Shield. They set out significant criticisms of the current proposals, dealing a blow to those who had hoped that the difficulties affecting trans-Atlantic data transfers would be resolved quickly.

Following the conclusion in early February of negotiations for the Privacy Shield (the replacement for Safe Harbor), the European Commission has published draft documents providing the full detail of the Privacy Shield program. This news is of significant importance to all organizations that transfer personal data from the EU to the US.

The progress of the EU-US Privacy Shield has been uncertain for the last few months. However, recent developments have clarified the situation somewhat, and it appears that a formal Adequacy Decision could be issued by the European Commission as early as June, barring any objections or procedural delays.

One of the more controversial portions of the EU's forthcoming General Data Protection Regulation is a provision restricting the ability of EU businesses to comply with demands from non-EU courts for the production of documents containing personal data. However, following a recent announcement by the UK government, these restrictions will not apply to businesses in the UK.

The EU’s Article 29 Working Party has published an Opinion that seeks to clarify the application of EU data protection law in relation to businesses based outside the EU.

The United States and the European Union Commission have agreed upon a revised and updated version of the U.S.-EU Safe Harbor, providing a new framework for transfers of personal data from the EU to the U.S. The updated framework has been re-branded as the EU-U.S. "Privacy Shield". The framework potentially provides a mechanism to avoid a significant disruption in digital commerce.

The EU Court of Justice's Schrems decision essentially declared the US-EU Safe Harbour to be invalid. However, the immediate practical consequences of Schrems remain unclear.

The European Court of Human Rights has confirmed that employers may, in some circumstances, monitor employees' personal communications in the workplace.

Proposed UK legislation governing UK law enforcement investigatory powers (together with differences in approach by the UK and rest of Europe to law enforcement access to personal data) will have a deep and far reaching impact on technology and communications businesses, and not just those in the UK. Businesses in technology centres like the San Francisco Bay area, as well as in Taiwan, Singapore and other hubs in Asia will also be impacted. So much so in fact that US technology giants are… Show more

Proposed UK legislation governing UK law enforcement investigatory powers (together with differences in approach by the UK and rest of Europe to law enforcement access to personal data) will have a deep and far reaching impact on technology and communications businesses, and not just those in the UK. Businesses in technology centres like the San Francisco Bay area, as well as in Taiwan, Singapore and other hubs in Asia will also be impacted. So much so in fact that US technology giants are already voicing concerns over the Bill and, rather unusually, are even attempting to intervene in the UK parliamentary process. Show less

The EU is close to finalising the Cybersecurity Directive, which will place significant security and incident reporting obligations on operators of essential services and digital service providers.

The EU institutions have completed ‘trilogue’ negotiations on the text of the General Data Protection
Regulation.

The EU-US Privacy Shield remains a hotly debated issue. At a meeting at the European Parliament last week, it became evident that significant areas of disagreement remain between the European Commission, the European Parliament, privacy activists and businesses.

Tim Hickman and Dr. Detlev Gabel review the various rights granted under the GDPR, consider how they differ from the current set of rights set out in the Directive and go on to consider the impact that each such right is likely to have on organisations that act as data controllers.

It’s time to worry about outages in cloud computing and the consequences for company data stored in the cloud. That means it’s time to understand exactly how cloud service contracts, which tend to be highly standardized, allocate the risks and costs of outages—and how to negotiate or renegotiate cloud agreements to better suit a company’s particular needs.