EU withdrawal pages: what you need to know
A practical guide to EU online contract-withdrawal functions from 19 June 2026, with a clear distinction from GDPR cookie-consent withdrawal.
Scott Dooley
Securitas Direct fined €100,000: why data-subject rights must be genuinely free
The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is…
Irish DPC fines HSE €645,000 over insecure paper medical-record storage
The Irish Data Protection Commission has fined the Health Service Executive (HSE) €645,000 after finding serious weaknesses in the storage…
CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests
On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to…
CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach
A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed…
P&O Ferries data breach: lessons for customer communications
P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and…
AliExpress and silent audio fingerprinting: what the finding means for online tracking
A recent investigation into AliExpress is a useful reminder that online tracking is not limited to cookies or visible consent…
Data Protection Training Matrix: How UK Employers Can Map Training by Role
A completion spreadsheet can show who finished a course. It cannot, by itself, show that people received training suited to…
Dutch AP fines Uber €825m: what meaningful human review looks like
The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21…
Data protection training for staff: a practical UK employer checklist
Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic…
ICO action against the Metropolitan Police: why training and assurance must be demonstrable
An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation…
Agentic AI and GDPR: a practical guide to compliant adoption
An agent that can read a customer record, call a tool and write the result back into a system changes…
ICO investigation leads to sentence for unlawful council-record access: what employers should do
A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external…
CNIL connected-vehicle location rules: what fleet managers and telematics providers should check
A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics…
ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers
On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after…
AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects
A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine…
Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained
Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for…
When exactly can UK marketers use the soft opt-in?
Unsolicited email and SMS to people based in the UK “individual subscribers” normally needs explicit consent under UK ePrivacy/PECR electronic…
GDPR & Slack: How to stay compliant with GDPR
Slack is where your team talks. It is not where your GDPR programme lives. Under the UK GDPR Article 28,…
Can I Request a Copy of All My Employment Data from My Employer Under GDPR?
The General Data Protection Regulation (GDPR) gives you the explicit right to request and receive a copy of all personal…