Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Mac Macmillan
GDPR and scientific research in the UK: what does the Data (Use and Access) Bill have to say?
Back in July I speculated, based on the King's Speech, that the new government's proposals for scientific research were likely to be a cut and paste from the previous government's Data Protection and Digital Information ("DPDI") Bill. This speculation turns out to have been correct, though on the bright side the new Bill does not re-produce the DPDI Bill's attempts to clarify the definition of personal data.
Podcast: Anonymisation
European Union, United Kingdom October 23 2024 Click here to listen to the audio In this episode, Hannah Crowther and Mac Macmillan discuss anonymisation. We cover the latest case law and guidance, and consider how to make that critical assessment of ‘identifiability’. Find all the episodes as we release them here, and don’t forget to subscribe! Follow us on X and LinkedIn to find more interesting content like this. Note: All information was correct at the time of recording.
Podcast: Anonymisation (via Passle)
In this episode, Hannah Crowther and Mac Macmillan discuss anonymisation. We cover the latest case law and guidance, and consider how to make that critical assessment of ‘identifiability’. Find all the episodes as we release them here, and don’t forget to subscribe! Follow us on X and LinkedIn to find more interesting content like this. Note: All information was correct at the time of recording.
DSARs, trade secrets, and automated decision-making: what counts as "meaningful information about the logic involved"?
If an individual is subject to automated decision-making, including profiling, the right of subject access under GDPR includes a right to “meaningful information about the logic involved”. The scope of this obligation is going to become increasingly important as the rise of AI introduces more automated decisions. Many companies are concerned that the obligation will require them to reveal commercially sensitive information about the functioning of their algorithms.
ICO takes enforcement action on cookies - under GDPR
As the next stage in its campaign to “crack down” on websites which aren't complying with the law around advertising cookies the ICO has publicised its enforcement action against an on-line gambling website, as “a warning that there will be consequences if organisations breach the law”.
GDPR and scientific research in the UK: what are the new government's plans?
The King's Speech yesterday (which, for readers not in the UK, sets out the government's legislative plans) promises that the new Digital Information and Smart Data Bill will “help our scientists make better use of data for world-class research by reflecting the realities of modern interdisciplinary science research in our data laws.
GDPR and scientific research in the UK: what are the new government's plans? (via Passle)
The King's Speech yesterday (which, for readers not in the UK, sets out the government's legislative plans) promises that the new Digital Information and Smart Data Bill will “help our scientists make better use of data for world-class research by reflecting the realities of modern interdisciplinary science research in our data laws.
Podcast: Scientific Research
Click here to listen the audio In this episode of Legitimately Interesting, , and discuss what the GDPR has to say about scientific research, the divergent approaches of the EU and UK in this area, the feasibility of anonymising data, and the role of consent when doing research.
GDPR: more CJEU decisions on compensation for non-material damage
Two CJEU decisions in June cover very similar ground to last year's decisions in Austrian Post and VB v Natsionalna agentsia za prihodite. Both these new decisions involved claims for compensation for non-material damage where no actual mis-use of personal data had been demonstrated. Judging by the regular flow of decisions from the CJEU in this area, it is an aspect of GDPR which national courts find challenging.
Subject Access Requests: High Court looks at the meaning of recipients
A judgment handed down recently by the High Court looks at the “purely personal” exception under the UK GDPR, whether article 15(1)(c) entitles data subjects to know the identity of recipients, and the application of paragraph 16 of Schedule 2 of the DPA (the “rights of others” exception).
Podcast: Data retention and deletion
Click here to listen the audio In this episode of Legitimately Interesting, Jamie Drucker and Mac Macmillan cover the thorny topic of data retention and deletion. They discuss some of the challenges organisations face in implementing retention policies, look at recent regulatory decisions and give a few practical best practice tips. Find all the episodes as we release them here, and don’t forget to subscribe! Follow us on X and LinkedIn to find more interesting content like this.
Podcast: Data retention and deletion (via Passle)
In this episode of Legitimately Interesting, Jamie Drucker and Mac Macmillan cover the thorny topic of data retention and deletion. They discuss some of the challenges organisations face in implementing retention policies, look at recent regulatory decisions and give a few practical best practice tips. Find all the episodes as we release them here, and don’t forget to subscribe! Follow us on X and LinkedIn to find more interesting content like this.
Sometimes a pot plant isn't enough. (via Passle)
The Spanish data protection authority, the AEPD, has fined a health clinic €30,000 for making patients take their temperature on a device located in the reception and waiting area and “within sight of third persons”. As health data, the temperature data was special category.
Sometimes a pot plant isn't enough.
The Spanish data protection authority, the AEPD, has fined a health clinic €30,000 for making patients take their temperature on a device located in the reception and waiting area and “within sight of third persons”. As health data, the temperature data was special category.
Do you need to take data deletion out of the "too difficult" box?
Back in 2016, when GDPR was a mere blot on the horizon, I had a client who already had a data retention policy for their organisation. It was a thing of beauty, setting category by category retention periods, and specifying the legal requirements from which each retention period was derived. The only problem was that their legacy systems couldn't delete data.
Do you need to take data deletion out of the "too difficult" box? (via Passle)
Back in 2016, when GDPR was a mere blot on the horizon, I had a client who already had a data retention policy for their organisation. It was a thing of beauty, setting category by category retention periods, and specifying the legal requirements from which each retention period was derived. The only problem was that their legacy systems couldn't delete data.
EU Regulators taking action on vehicle tracking
Telematics services for connected vehicles offer massive benefits for fleet managers, with the potential to increase vehicle uptime and productivity, reduce maintenance costs, and improve efficiency. This has led to vehicle tracking becoming widespread in the past few years, at least in the commercial sphere.
European decision on the boundary between pseudonymisation and anonymization
A recent decision by the EU General Court has held that where a data controller discloses data which it has pseudonymised, this will not count as a disclosure of personal data where the individuals concerned are not identifiable by the recipient of the data.
Subject Access Requests - the CJEU rules on the meaning of a “copy”
The right of subject access was not invented by the GDPR, but the right seems to have acquired a higher profile under the GDPR, judging by the number of requests for clarification of the scope of the right. One of the latest CJEU decisions is on the precise scope of the right to “a copy of the personal data undergoing processing”.
Largest ever UK research programme to collect personal data from 5 million volunteers
An ambitious new project is currently underway with the goal of becoming the UK’s “largest ever health research programme”.[1] Up to 5 million volunteers will donate samples and health information to the programme, called “Our Future Health”, in order to enable researchers to find ways to detect, prevent and treat diseases earlier.
Podcast: Drawing Comparisons – The US Approach To Privacy - Privacy - UK
UK: Podcast: Drawing Comparisons – The US Approach To Privacy 18 January 2021 by Mac Macmillan and Charlie Hawes Bristows To print this article, all you need is to be registered or login on Mondaq.com. Mac Macmillan and Charlie Hawes explore how effectively (or not) the USA protects the data privacy of its citizens despite a "smorgasbord of privacy legislations" compared to Europe and how the tables are turned when it comes to children's data.
ICO Issues Fine for Marketing Emails Disguised as Service Messages | Global Media and Communications Watch
The Information Commissioner’s Office (ICO) has issued a £70,000 fine against Flybe and a £13,000 fine against Honda Motor Europe Ltd for breaching Regulation 22 of the Privacy and Electronic Communications Regulations (PECR) by sending emails requesting individuals to update their marketing preferences. The two cases confirm that: Flybe sent emails with the subject line “Are your details correct?” and advised individuals to update out-of-date information and marketing preferences.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Mac
Contact Mac, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack