UK & EU Data Protection Bulletin: February - April 2017

The highlights this month are:

• New “Guidance for Consent in the GDPR” published by the ICO: On 2 March 2017, the ICO published draft guidance on consent under the GDPR. The consultation period for the guidance closed on 31 March 2017. The Guidance is helpful in demonstrating the ICO’s thinking on unclear provisions in the GDPR but is repetitive, and potentially misleading for those who are less familiar with data protection jargon. The ICO announced that the final guidance would be published in June.
• New Discussion Paper on “Big data, artificial intelligence, machine learning and data protection” published by the ICO: The paper is not formal guidance or a code of practice, but rather gives views on the implications of big data analytics for data protection law, and suggests some potential routes to compliance. Worth a read.
• Court of Appeal hands down judgments in Dawson-Damer v Tayor Wessing LLP and Deer v University of Oxford: On the scope of subject access rights under the Data Protection Act 1998.
• Article 29 Working Party publishes final guidelines on:
  • DPOs;
  • Data Portability;
  • Lead Supervisory Authority; and
  • Data Protection Impacts Assessments.