The GDPR and Fines

The Article 29 Data Protection Working Party recently issued guidelines on fines for the purposes of the General Data Protection Regulation (‘GDPR’). Article 83(1) of the GDPR states that supervisory authorities should identify corrective measures that are “effective, proportionate and dissuasive”. Article 83(2) is the starting point for assessing a case for the purpose of […]

The GDPR and Personal Data Breach Reporting

The Article 29 Data Protection Working Party (‘A29WP’) recently issued guidelines on personal data breach reporting under the General Data Protection Regulation (‘GDPR’). The GDPR obliges data controllers to report personal data breaches to data protection authorities within 72 hours unless the breach is ‘unlikely to result in a risk to the rights and freedoms’ […]

R (on the application of Ingenious Media Holdings Plc) v Commissioners for Her Majesty’s Revenue and Customs [2016] UKSC 54

This was an appeal in the Supreme Court concerning the scope of the duty of confidentiality that HMRC owes to taxpayers. Patrick McKenna founded Ingenious Media Holdings Plc (“Ingenious Media”), an investment and advisory group that specialised in the media industry. The group utilised tax relief schemes relevant to the industry; HMRC were investigating these […]

The GDPR: what’s all the fuss?

The General Data Protection Regulation, or ‘GDPR’, has been created to provide stronger protection of personal data than that contained in the EU Directive 95/46/EC. The Directive, dating from 1995, introduced a framework that is now inadequate given the enormous changes in digital information and the way in which we use technology. The GDPR will […]