24 January 2018
Legal Update: Judicial review of decisions in the Crown Court
The recent decision in Farhia Ali v Crown Court at Kingston [2017] EWHC 2706 (Admin) provides a reminder of the narrow availability of judicial review in relation to decisions of the Crown Court. In Farhia, a decision to refuse bail following the jury’s verdict was found not to be capable of being judicially reviewed as it was not within the supervisory jurisdiction of the High Court.
24 January 2018
The £17 million Question - What will the ICO’s enforcement powers be under the GDPR, and how will they be used?
The General Data Protection Regulation (“GDPR”) coming into force in May 2018 empowers national supervisory authorities to issue fines of up to €20 million, or 4% of an organisation’s annual global turnover for certain data protection infringements. These figures have generated headlines and news stories around the globe, many of them misleading. The Information Commissioner, in her post of December last year, warned of ‘scaremongering because of misconceptions’. We seek to put the headline grabbing figures in context, by examining the range of administrative sanctions available to national supervisory authorities for dealing with infringements of GDPR and the criteria they will use when selecting them. In doing so we shed light on how organisations can prepare for, and react to, any data protection infringements to reduce the risk of a heavy fine.
12 January 2018
Legal update: Administrators’ efforts to realise Monarch’s assets boosted by judicial review victory
In the recent case of R (Monarch Airlines Limited (in administration)) v Airport Coordination Limited [2017] EWCA Civ 1892, the Court of Appeal considered whether an airline that had fallen into administration could still be allocated valuable slots at airports.
15 December 2017
An introduction to contracts between data controllers and data processors under the General Data Protection Regulation
Under the GDPR, when a ‘data controller’ engages a ‘data processor’, the two parties must enter in to a written contract. Article 28 of the GDPR sets out what specific terms, as a minimum, must be included in such contracts. Such terms are required to ensure that the processor complies with the GDPR when processing the personal data in possession of the controller. Article 28 is a new requirement which did not exist under the Data Protection Act 1998 (the “DPA”), meaning that controllers who are currently compliant with the DPA will not necessarily have included these provisions in their processor contracts.
13 December 2017
When is a data controller liable for the criminal acts of a rogue employee?
The acquisition from organisations of large databases of personal data by external parties (usually hackers) is an increasingly modern phenomenon – think Ashley Madison, PlayStation, TalkTalk. Less common, and perhaps of greater concern for employers, is the ‘inside job’ where a trusted employee is responsible for a major breach of data security. The High Court case of Various Claimants v Wm Morrisons Supermarket PLC [2017] EWHC 3113 (QB) has shown that a data controller can be held vicariously liable for the misuse of date by one of its employees even where it has done everything it reasonably can do to prevent such a breach.