“Data breaches… Armageddon…” – Morrisons v Various Claimants,  EWCA Civ 2339 at para 78. Caveat: I confess at the outset that this quotation, though technically accurate, fails truly to reflect the tenor of the Court of Appeal’s judgment. But are the consequences for employers so different? Not so clear. Bear with me while I try to dig myself out of this hole. To recapitulate, circa 100,000 employees of Morrisons (a UK supermarket chain) suffered a data breach when one of [...]
ABSTRACT: must Controllers inform processors of the legal bases of processing? Prima facie no: but from a legal and business-strategic perspective the answer is very, very much more complex.
Masochists, who ipso facto and ex officio collectively may approach 100% of my audience, will be aware of my flogging Vidal-Hall v Google (lower court judgment) to death on Linkedin and elsewhere. However, after 37 months it may be time for a quick overview of Vidal-Hall‘s impact on subsequent cases. The contagion has just spread to Scotland. Bottom line: data protection distress awards in England/Wales and Scotland alike are up by circa 4-5,000% in three years. Before Tugendhat J struck down s.13(2) Data Protection Act 1998 in Vidal-Hall, courts could [...]