Measured Collective

CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests

Scott Dooley — Thu, 10 Sep 2026 15:46:23 +0000

On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to handle candidates’ and former employees’ erasure requests reliably. The underlying decision was made on 21 July 2026. The case is a useful warning for HR and recruitment teams: deleting a record is only one part ...

The post CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests appeared first on Measured Collective.

CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach

Scott Dooley — Thu, 10 Sep 2026 15:37:00 +0000

A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed around the sensitivity and scale of the data being processed. The decision concerns both the controls protecting a computerised patient record and the organisation’s communication with people affected by the breach. For healthcare managers, the ...

The post CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach appeared first on Measured Collective.

P&O Ferries data breach: lessons for customer communications

Scott Dooley — Mon, 31 Aug 2026 21:27:49 +0000

P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and breach response?

The post P&O Ferries data breach: lessons for customer communications appeared first on Measured Collective.

AliExpress and silent audio fingerprinting: what the finding means for online tracking

Scott Dooley — Thu, 27 Aug 2026 10:13:56 +0000

A recent investigation into AliExpress is a useful reminder that online tracking is not limited to cookies or visible consent banners. The marketplace was found running a silent Web Audio routine that could help identify a visitor’s device. It did not record through the microphone. Instead, it generated an inaudible signal and measured small, repeatable ...

The post AliExpress and silent audio fingerprinting: what the finding means for online tracking appeared first on Measured Collective.

Data Protection Training Matrix: How UK Employers Can Map Training by Role

Scott Dooley — Mon, 24 Aug 2026 06:10:20 +0000

A completion spreadsheet can show who finished a course. It cannot, by itself, show that people received training suited to the personal data and decisions in their job. A data protection training matrix closes that gap: it maps role groups to the risks they actually face, the learning they need and the evidence an employer ...

The post Data Protection Training Matrix: How UK Employers Can Map Training by Role appeared first on Measured Collective.

Dutch AP fines Uber €825m: what meaningful human review looks like

Scott Dooley — Sat, 22 Aug 2026 07:05:49 +0000

The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21 August and confirmed to Reuters by the regulator, concerns European incidents from 2018 to 2022. Uber says it will appeal, so the penalty is not final. The amount is eye-catching. The operational lesson is more ...

The post Dutch AP fines Uber €825m: what meaningful human review looks like appeared first on Measured Collective.

Data protection training for staff: a practical UK employer checklist

Scott Dooley — Mon, 17 Aug 2026 06:10:35 +0000

Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic course completed once and forgotten. A practical programme gives each person a clear answer to the questions they face in their role: what counts as personal data, what to do before sharing it, and where ...

The post Data protection training for staff: a practical UK employer checklist appeared first on Measured Collective.

ICO action against the Metropolitan Police: why training and assurance must be demonstrable

Scott Dooley — Sun, 09 Aug 2026 07:09:07 +0000

An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation that handles sensitive personal information: training, monitoring and assurance must work together—and be capable of being demonstrated. A policy or annual reminder is not evidence that people have the knowledge, supervision and checks required for ...

The post ICO action against the Metropolitan Police: why training and assurance must be demonstrable appeared first on Measured Collective.

Agentic AI and GDPR: a practical guide to compliant adoption

Scott Dooley — Thu, 30 Jul 2026 11:42:57 +0000

An agent that can read a customer record, call a tool and write the result back into a system changes the compliance job. The question is no longer whether a model can produce useful text. It is whether the organisation can account for each personal-data use, control the agent’s permissions and explain its decisions when ...

The post Agentic AI and GDPR: a practical guide to compliant adoption appeared first on Measured Collective.

ICO investigation leads to sentence for unlawful council-record access: what employers should do

Scott Dooley — Tue, 28 Jul 2026 07:12:04 +0000

A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external attackers. On 21 July 2026, the ICO announcement reported that a former Herefordshire Council employee received a suspended prison sentence after unlawfully accessing sensitive records. For employers, the practical lesson is to make sure staff ...

The post ICO investigation leads to sentence for unlawful council-record access: what employers should do appeared first on Measured Collective.

CNIL connected-vehicle location rules: what fleet managers and telematics providers should check

Scott Dooley — Mon, 13 Jul 2026 06:08:53 +0000

A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics boxes make that data easy to collect, and easy to over-collect. In June 2026, France’s CNIL published updated recommendations on how professionals may use connected-vehicle location data, following a public consultation and recent press coverage ...

The post CNIL connected-vehicle location rules: what fleet managers and telematics providers should check appeared first on Measured Collective.

ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers

Scott Dooley — Thu, 09 Jul 2026 08:06:36 +0000

On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after both companies made hundreds of thousands of unlawful live marketing calls to numbers registered with the Telephone Preference Service. The linked director Thomas Vickrage, from Bournemouth, was a director of TWLS and suspected of directing ...

The post ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers appeared first on Measured Collective.

AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects

Scott Dooley — Mon, 06 Jul 2026 06:14:47 +0000

A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine it for a new analytics pilot. No breach, no hacker. Just reuse. In May 2026, Spain’s data protection authority closed a cross-border GDPR case against Amadeus with a €14.4 million fine, reduced from €18 million ...

The post AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects appeared first on Measured Collective.

Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained

Scott Dooley — Mon, 29 Jun 2026 06:07:19 +0000

Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for analytics, marketing wants to cross-sell, and someone suggests training an AI model on support tickets. UK GDPR’s purpose limitation principle does not ban reuse outright, but it does require compatibility. The ICO refreshed its purpose ...

The post Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained appeared first on Measured Collective.