Measured Collective

Bye bye ICO, hello IC: What’s changed beyond the name

Measured Collective — Wed, 30 Sep 2026 16:17:22 +0000

On 30 September 2026 the ICO formally became the Information Commission. What the new board changes, who sits on it, and what organisations need to do.

The post Bye bye ICO, hello IC: What’s changed beyond the name appeared first on Measured Collective.

ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn

Scott Dooley — Wed, 30 Sep 2026 08:06:30 +0000

The ICO says TikTok’s £12.7m children’s privacy fine is final. Here are the practical controls online-service teams should test.

The post ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn appeared first on Measured Collective.

EU withdrawal pages: what you need to know

Scott Dooley — Fri, 25 Sep 2026 10:07:59 +0000

A practical guide to EU online contract-withdrawal functions from 19 June 2026, with a clear distinction from GDPR cookie-consent withdrawal.

The post EU withdrawal pages: what you need to know appeared first on Measured Collective.

Securitas Direct fined €100,000: why data-subject rights must be genuinely free

Scott Dooley — Wed, 23 Sep 2026 07:10:30 +0000

The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is how managers can audit rights-exercise routes.

The post Securitas Direct fined €100,000: why data-subject rights must be genuinely free appeared first on Measured Collective.

Irish DPC fines HSE €645,000 over insecure paper medical-record storage

Scott Dooley — Fri, 18 Sep 2026 08:12:37 +0000

In late 2023, people got into two disused psychiatric hospitals in Ireland and filmed what they found: boxes of patient medical records, left in buildings the Health Service Executive (HSE) no longer used for care but still used for storage. The videos were posted on social media. On 2 September 2026, the Irish Data Protection ...

The post Irish DPC fines HSE €645,000 over insecure paper medical-record storage appeared first on Measured Collective.

CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests

Scott Dooley — Thu, 10 Sep 2026 15:46:23 +0000

On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to handle candidates’ and former employees’ erasure requests reliably. The underlying decision was made on 21 July 2026. The case is a useful warning for HR and recruitment teams: deleting a record is only one part ...

The post CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests appeared first on Measured Collective.

CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach

Scott Dooley — Thu, 10 Sep 2026 15:37:00 +0000

A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed around the sensitivity and scale of the data being processed. The decision concerns both the controls protecting a computerised patient record and the organisation’s communication with people affected by the breach. For healthcare managers, the ...

The post CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach appeared first on Measured Collective.

P&O Ferries data breach: lessons for customer communications

Scott Dooley — Mon, 31 Aug 2026 21:27:49 +0000

P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and breach response?

The post P&O Ferries data breach: lessons for customer communications appeared first on Measured Collective.

AliExpress and silent audio fingerprinting: what the finding means for online tracking

Scott Dooley — Thu, 27 Aug 2026 10:13:56 +0000

A recent investigation into AliExpress is a useful reminder that online tracking is not limited to cookies or visible consent banners. The marketplace was found running a silent Web Audio routine that could help identify a visitor’s device. It did not record through the microphone. Instead, it generated an inaudible signal and measured small, repeatable ...

The post AliExpress and silent audio fingerprinting: what the finding means for online tracking appeared first on Measured Collective.

Data Protection Training Matrix: How UK Employers Can Map Training by Role

Scott Dooley — Mon, 24 Aug 2026 06:10:20 +0000

A completion spreadsheet can show who finished a course. It cannot, by itself, show that people received training suited to the personal data and decisions in their job. A data protection training matrix closes that gap: it maps role groups to the risks they actually face, the learning they need and the evidence an employer ...

The post Data Protection Training Matrix: How UK Employers Can Map Training by Role appeared first on Measured Collective.

Dutch AP fines Uber €825m: what meaningful human review looks like

Scott Dooley — Sat, 22 Aug 2026 07:05:49 +0000

The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21 August and confirmed to Reuters by the regulator, concerns European incidents from 2018 to 2022. Uber says it will appeal, so the penalty is not final. The amount is eye-catching. The operational lesson is more ...

The post Dutch AP fines Uber €825m: what meaningful human review looks like appeared first on Measured Collective.

Data protection training for staff: a practical UK employer checklist

Scott Dooley — Mon, 17 Aug 2026 06:10:35 +0000

Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic course completed once and forgotten. A practical programme gives each person a clear answer to the questions they face in their role: what counts as personal data, what to do before sharing it, and where ...

The post Data protection training for staff: a practical UK employer checklist appeared first on Measured Collective.

ICO action against the Metropolitan Police: why training and assurance must be demonstrable

Scott Dooley — Sun, 09 Aug 2026 07:09:07 +0000

An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation that handles sensitive personal information: training, monitoring and assurance must work together—and be capable of being demonstrated. A policy or annual reminder is not evidence that people have the knowledge, supervision and checks required for ...

The post ICO action against the Metropolitan Police: why training and assurance must be demonstrable appeared first on Measured Collective.

Agentic AI & GDPR: a practical guide to GDPR compliant adoption of AI

Scott Dooley — Thu, 30 Jul 2026 11:42:57 +0000

AI agents such as a support bot that can read customer records, update customer orders and provide customers with the information they need from your internal systems in seconds, can be a very powerful business tool. It can lead to improved operating margins, and also when deployed properly can improve customer satisfaction – customers don’t ...

The post Agentic AI & GDPR: a practical guide to GDPR compliant adoption of AI appeared first on Measured Collective.