Scott Dooley — Data Protection Practitioner | Measured Collective

Xandr fined NOK 92 million over Grindr advertising data

Scott Dooley — Wed, 28 Oct 2026 09:23:50 +0000

Norway’s DPA fined Xandr NOK 92 million over Grindr user data in advertising auctions. The decision explains consent checks and joint-controller duties.

The post Xandr fined NOK 92 million over Grindr advertising data appeared first on Measured Collective.

ICO reprimands Ogi and Data Cymru after ‘Password1’ ransomware breach

Scott Dooley — Tue, 27 Oct 2026 08:05:07 +0000

The ICO reprimanded Ogi Networks and Data Cymru after a test account helped expose 3,300 people’s data. The ICO announced the action on 20 October 2026.

The post ICO reprimands Ogi and Data Cymru after ‘Password1’ ransomware breach appeared first on Measured Collective.

CNIL closes Google injunction after account and Gmail changes

Scott Dooley — Tue, 27 Oct 2026 07:32:22 +0000

CNIL announced the closure on 14 October 2026, following its 23 September decision. The outcome concerns a limited injunction, not blanket compliance.

The post CNIL closes Google injunction after account and Gmail changes appeared first on Measured Collective.

Paper-record security and retention: an audit guide for managers

Scott Dooley — Tue, 27 Oct 2026 07:19:31 +0000

Start a paper-record audit with one storage location and follow a sample file through its life: arrival, access, retrieval, retention review and disposal. HR, compliance, facilities and records managers should be able to show who owns each decision and what evidence proves it happened. Use the audit below to turn a storage policy into checks ...

The post Paper-record security and retention: an audit guide for managers appeared first on Measured Collective.

Irish DPC fines Google €403m: what location-data governance teams should learn

Scott Dooley — Tue, 27 Oct 2026 07:11:35 +0000

The Irish Data Protection Commission (DPC) has fined Google Ireland Limited €403 million after finding failures in the way Google processed location data through Web & App Activity, Location History and Location Accuracy. The decision is a reminder for every organisation using location analytics: a privacy notice and a settings screen are not controls unless ...

The post Irish DPC fines Google €403m: what location-data governance teams should learn appeared first on Measured Collective.

ICO investigates Police Scotland SAR compliance: what organisations should learn

Scott Dooley — Tue, 27 Oct 2026 07:09:51 +0000

The ICO’s investigation into Police Scotland’s handling of subject access requests (SARs) is a useful reminder for every organisation that receives them: a defensible process matters before a regulator asks how it works. The investigation is live, so it is not a finding that Police Scotland has breached the law. It does, however, put SAR ...

The post ICO investigates Police Scotland SAR compliance: what organisations should learn appeared first on Measured Collective.

Who’s who on the new ICO board

Scott Dooley — Fri, 09 Oct 2026 19:18:44 +0000

Seven non-executives and an interim chief executive now run the UK's data protection regulator. Who they are, what each brings, and where the board's expertise is thinner.

The post Who’s who on the new ICO board appeared first on Measured Collective.

ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn

Scott Dooley — Wed, 30 Sep 2026 08:06:30 +0000

The ICO says TikTok’s £12.7m children’s privacy fine is final. Here are the practical controls online-service teams should test.

The post ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn appeared first on Measured Collective.

EU withdrawal pages: what you need to know

Scott Dooley — Fri, 25 Sep 2026 10:07:59 +0000

A practical guide to EU online contract-withdrawal functions from 19 June 2026, with a clear distinction from GDPR cookie-consent withdrawal.

The post EU withdrawal pages: what you need to know appeared first on Measured Collective.

Securitas Direct fined €100,000: why data-subject rights must be genuinely free

Scott Dooley — Wed, 23 Sep 2026 07:10:30 +0000

The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is how managers can audit rights-exercise routes.

The post Securitas Direct fined €100,000: why data-subject rights must be genuinely free appeared first on Measured Collective.

Irish DPC fines HSE €645,000 over insecure paper medical-record storage

Scott Dooley — Fri, 18 Sep 2026 08:12:37 +0000

In late 2023, people got into two disused psychiatric hospitals in Ireland and filmed what they found: boxes of patient medical records, left in buildings the Health Service Executive (HSE) no longer used for care but still used for storage. The videos were posted on social media. On 2 September 2026, the Irish Data Protection ...

The post Irish DPC fines HSE €645,000 over insecure paper medical-record storage appeared first on Measured Collective.

CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests

Scott Dooley — Thu, 10 Sep 2026 15:46:23 +0000

On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to handle candidates’ and former employees’ erasure requests reliably. The underlying decision was made on 21 July 2026. The case is a useful warning for HR and recruitment teams: deleting a record is only one part ...

The post CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests appeared first on Measured Collective.

CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach

Scott Dooley — Thu, 10 Sep 2026 15:37:00 +0000

A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed around the sensitivity and scale of the data being processed. The decision concerns both the controls protecting a computerised patient record and the organisation’s communication with people affected by the breach. For healthcare managers, the ...

The post CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach appeared first on Measured Collective.

P&O Ferries data breach: lessons for customer communications

Scott Dooley — Mon, 31 Aug 2026 21:27:49 +0000

P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and breach response?

The post P&O Ferries data breach: lessons for customer communications appeared first on Measured Collective.