Data Protection

Our data protection team understands that in some cases, individuals wish to see what personal information is held about them by a company or organisation – a right awarded to them through The Data Protection Act. We advise organisations on the necessary procedures involved in dealing with such requests.

Our experts fully appreciate the fact that as one of the leading users of CCTV, the UK has a record number of cameras on the streets which can raise a number of privacy legal issues. We assist organisation using CCTV, whether recording personal images or vehicle registration numbers, to comply with the legal requirements governing how these images are gathered, stored and used.

Most children are more competent when it comes to the use of the web and social media than their parents. And our team understands the safety and security issues that may bring for a family household. Few children are actually aware of how the information that they place online is used. Therefore, they are simply unable to make informed decisions as to how they share their data online. Our experts advise organisations on how best to comply with data protection obligations when providing on-line services including social media services used by youngsters.

Our team of highly skilled data protection experts work closely with organisations to help them develop compliant procedures for the collection, storing and processing of personal data. We regularly work closely with businesses to give guidance on the legal compliance duties placed upon them through the data protection laws and regulations including in relation to how they collect, store, use, disclose or transfer personal data and on how to manage regulatory enquiries and audits and claims from individuals.

Our team of data protection lawyers are perfectly placed to guide clients through the plethora of duties placed upon them, under The Data Protection Act 2018 (the Act) which controls the use of ‘personal data’. We can advise on registration requirements of the UK Information Commissioner’s Office (ICO) (the body tasked with enforcing the Act) and on other regulations under the Act, for example in relation to how personal data can be lawfully obtained, stored, disclosed and shared including transfers of personal data outside of the UK. We are also experienced in assisting organisations with their interactions with the ICO on all matters including development and approval of Binding Corporate Rules, ad-hoc data transfer agreements and on data subject complaints and any enforcement actions.

With extensive experience in advising organisations in all areas involving human resources including transfers of employees on the sale or purchase of a business, our privacy team together with the experience of our employment team, is fully aware of the statutory obligations imposed on organisations in relation to collection, storage and use of employee data including transfers of such data to headquarters outside of the UK and outside of the EEA. Our team is also able to advise on disclosures of personal data as part of transferring employees in an acquisition scenario. We work closely with organisations to ensure compliance with both the data protection regulations and employment regulations and laws, and regularly assist clients in understanding what personal data of employees needs to be disclosed, when and what limitations there may be in making disclosures.

As the world of business becomes increasingly global, it’s crucial that international law keeps up with the pace. Our data protection team is skilled at dealing with all matters, in relation to the General Data Protection Regulation (GDPR) which regulates the processing of personal data within the EEA. The GDPR is an important component of EU privacy and human rights law and we ensure that our clients are equipped, in their knowledge, to deal with any issues that may arise. Even in a post-Brexit world many clients will need to ensure that they are complying with the relevant EU data protection legislation which will apply where they collect and process personal data of EEA individuals even if the collection, storing and processing of that personal data occurs in the UK.

Many businesses routinely transfer data overseas, whether to another group company, to a third party for sub-processing or for other reasons. This process can be fraught with legal compliance issues as the UK Data Protection Act and the EU Data Protection Regulations do not allow the transfer of personal data outside of the EEA to countries that are not deemed by the EU Commission as affording the same safeguards for personal data as those under the EU Data Protection Directive. We are well placed to advise organisations of all sizes on legitimising these overseas transfers of personal data and on the requirements for on-ward transfer.

The value of personal data, collected by an organisation, can be hugely significant, as long as it has been collected in a legally compliant way. Whether such data can be used for future marketing activities, either by the business that collected it or by others, is often overlooked and can have negative connotations. The regulators, not only in the UK but globally, are cracking down on direct marketers who flout the law and we are seeing an increase in enforcement action and some huge fines levied against perpetrators. We regularly work with businesses to ensure that personal data is collected in a way that facilitates best practice in future marketing activities and advise on how to comply with direct marketing regulations so as to run legally compliant marketing campaigns.

We currently assist companies in reviewing their existing privacy notices and other relevant internal policies concerning personal data, and help them draft appropriate policies and notices to ensure that they will remain compliant. With the implementation of the new GDPR which replaces the current EU Directive on data processing, many organisations will need to update their privacy notices and policies and revamp their internal policies concerning collection and handling of personal data. The team is already working with organisations to assess current policies and procedures and to being the updating process and is well placed to guide both large and small organisations in this area.

The team is also experienced in providing training programmes for organisations that assist in bringing staff and management up to speed on their privacy rules and regulations.

The retention of communications data, in the UK, has long been recognised as a valuable measure. Our team of data protection lawyers understand the importance of regulation, such as The Regulation of Investigatory Powers Order 2015 and the Retention of Communications Data (Code of Practice) Order 2015, and the Freedom of Information Act 2001, in regards to businesses concerned with providing telecommunications and other data services and government organisations providing public services and holding public data. We guide these businesses and government regulations through the miasma of their obligations on all retained data and requests for disclosure – working closely with them to ensure that they have appropriate policies and procedures in place relating to such retained data. We can also advise on the making of applications for access to such data and are on hand should any application be refused.