Blog – GDPR360

03Nov03/11/2018

GDPR engagement of 30+ additional jurisdictions – automated pleadings

Abstract: (1) The GDPR arguably, either directly or indirectly, could engage in a relatively straightforward fashion circa 30 jurisdictions apart from EU and EEA nations; plus some special jurisdictions such as places in northwest Africa, as implied by the Polisario jurisprudence. Pleadings for several such jurisdictional scenarios are explained. (2) My post on Brexit-proofing software contained an example of how jurisdictions might be embedded into a legal architecture artefact. That same example is reused to demonstrate how such pleadings can be...

By Stuart RitchieArticle 3 Engagement, Brexit-proofing, Data breach, Domicile, GDPR, IT Implementation, Jurisdiction, Legal Architecture, Location, Misuse of private information, Monitoring, Nationalities, Profiling, Public international law, Remedies, Residence1 Comment

01Nov01/11/2018

Brexit-proofing software – without programming for specific dates, jurisdictions, etc

Abstract: Simple methods to inoculate data protection (or any other) multi-jurisdictional software from Brexit and similar events, before their possibility can be known or even contemplated. International software blues A general problem for lawyers - and for all their clients dealing with multiple jurisdictions - is how to ensure seamless transition of processes and systems (IT and otherwise) between different jurisdictions, in which different legal systems apply and unpredictable new rules can come into effect at any moment and, in the case...

By Stuart RitchieApplicable Law, Brexit, Brexit-proofing, GDPR, IT Implementation, Jurisdiction, Legal Architecture1 Comment

26Oct26/10/2018

“Data Breaches… Armageddon…” – as announced by the Three Horsemen

"Data breaches... Armageddon..." - Morrisons v Various Claimants, [2018] EWCA Civ 2339 at para 78. Caveat: I confess at the outset that this quotation, though technically accurate, fails truly to reflect the tenor of the Court of Appeal's judgment. But are the consequences for employers so different? Not so clear. Bear with me while I try to dig myself out of this hole. To recapitulate, circa 100,000 employees of Morrisons (a UK supermarket chain) suffered a data breach when one of their...

By Stuart RitchieDamages, Data breach, Data Protection Act 1998, Distress, GDPR, Misuse of private information, Vicarious liability0 Comments

05Apr05/04/2018

Identifying Recipients of GDPR personal data – Theory and Reality

Under the GDPR, a data subject must be informed of the recipients or the categories of recipient of their personal data. These two choices are genuine alternatives. The controller can choose. But can that choice resist circumstances? Under the old regime, likewise it was necessary only to specify non-particularized categories. Hence the semantically meaningless rubbish filling up the non-statements of processing held in various supervisory authorities' existing "registration" databases. So, under the GDPR, can we still get away with it? After all,...

By AlanAccess, Cambridge Analytica, Data recipients, Disclosure, Discovery, Facebook, Notification0 Comments

01Dec01/12/2017

GDPR: must controllers declare legal bases to processors?

ABSTRACT: must Controllers inform processors of the legal bases of processing? Prima facie no: but from a legal and business-strategic perspective the answer is very, very much more complex.

By AlanCNIL, Damages, Data Protection Act 1998, Distress, DPIA, DPO, GDPR, ICO, Misuse of private information, Supervisors0 Comments