Measured Collective

Agentic AI and GDPR: a practical guide to compliant adoption

Scott Dooley — Thu, 30 Jul 2026 11:42:57 +0000

An agent that can read a customer record, call a tool and write the result back into a system changes the compliance job. The question is no longer whether a model can produce useful text. It is whether the organisation can account for each personal-data use, control the agent’s permissions and explain its decisions when ...

The post Agentic AI and GDPR: a practical guide to compliant adoption appeared first on Measured Collective.

ICO investigation leads to sentence for unlawful council-record access: what employers should do

Scott Dooley — Tue, 28 Jul 2026 07:12:04 +0000

A new ICO case is a useful reminder that personal-data risk is not limited to phishing, lost devices or external attackers. On 21 July 2026, the ICO announcement reported that a former Herefordshire Council employee received a suspended prison sentence after unlawfully accessing sensitive records. For employers, the practical lesson is to make sure staff ...

The post ICO investigation leads to sentence for unlawful council-record access: what employers should do appeared first on Measured Collective.

CNIL connected-vehicle location rules: what fleet managers and telematics providers should check

Scott Dooley — Mon, 13 Jul 2026 06:08:53 +0000

A connected car, van, or scooter generates location data every time it moves. Fleet dashboards, rental recovery tools, and telematics boxes make that data easy to collect, and easy to over-collect. In June 2026, France’s CNIL published updated recommendations on how professionals may use connected-vehicle location data, following a public consultation and recent press coverage ...

The post CNIL connected-vehicle location rules: what fleet managers and telematics providers should check appeared first on Measured Collective.

ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers

Scott Dooley — Thu, 09 Jul 2026 08:06:36 +0000

On 8 July 2026, the ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and Jacksons Marketing Ltd £130,000 after both companies made hundreds of thousands of unlawful live marketing calls to numbers registered with the Telephone Preference Service. The linked director Thomas Vickrage, from Bournemouth, was a director of TWLS and suspected of directing ...

The post ICO fines Thermotech and Jacksons Marketing £370,000 for nuisance calls to TPS numbers appeared first on Measured Collective.

AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects

Scott Dooley — Mon, 06 Jul 2026 06:14:47 +0000

A B2B platform holds years of customer booking data collected for one operational purpose. A product team wants to mine it for a new analytics pilot. No breach, no hacker. Just reuse. In May 2026, Spain’s data protection authority closed a cross-border GDPR case against Amadeus with a €14.4 million fine, reduced from €18 million ...

The post AEPD fines Amadeus €14.4M over traveller profiling: what the booking-data case means for reuse projects appeared first on Measured Collective.

Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained

Scott Dooley — Mon, 29 Jun 2026 06:07:19 +0000

Your team collected customer data for one stated purpose. Six months later, product wants to mine the same database for analytics, marketing wants to cross-sell, and someone suggests training an AI model on support tickets. UK GDPR’s purpose limitation principle does not ban reuse outright, but it does require compatibility. The ICO refreshed its purpose ...

The post Can you reuse customer data for a new purpose? ICO’s 2026 compatibility rules explained appeared first on Measured Collective.

When exactly can UK marketers use the soft opt-in?

Scott Dooley — Mon, 22 Jun 2026 06:18:35 +0000

Unsolicited email and SMS to people based in the UK “individual subscribers” normally needs explicit consent under UK ePrivacy/PECR electronic mail marketing rules. Broadly speaking these rules define the need for consent, and UK GDPR then defines the quality of “consent” required. The rules can feel restrctives especially when compared to the freedoms enjoyed by ...

The post When exactly can UK marketers use the soft opt-in? appeared first on Measured Collective.

GDPR & Slack: How to stay compliant with GDPR

Scott Dooley — Sun, 21 Jun 2026 08:18:22 +0000

Slack is where your team talks. It is not where your GDPR programme lives. Under the UK GDPR Article 28, your organisation is the controller when you decide what personal data goes into Slack, who can see it, and how long it stays. Slack processes that data on your instructions. That split is the starting ...

The post GDPR & Slack: How to stay compliant with GDPR appeared first on Measured Collective.

Can I Request a Copy of All My Employment Data from My Employer Under GDPR?

Scott Dooley — Sun, 21 Jun 2026 08:15:06 +0000

The General Data Protection Regulation (GDPR) gives you the explicit right to request and receive a copy of all personal data your employer holds about you.

The post Can I Request a Copy of All My Employment Data from My Employer Under GDPR? appeared first on Measured Collective.

Garante fines Emirates €180,000 over assisted-travel health data

Scott Dooley — Fri, 19 Jun 2026 08:11:26 +0000

Italy's Garante fined Emirates €180,000 over MEDIF health-data transparency and retention. Practical lessons for accessibility and assisted-travel data.

The post Garante fines Emirates €180,000 over assisted-travel health data appeared first on Measured Collective.

London Clinic ICO caution: what staff medical-record misuse teaches employers

Scott Dooley — Thu, 18 Jun 2026 07:20:18 +0000

The ICO has issued a formal caution to a former healthcare professional after concluding a criminal investigation linked to medical information reported by the London Clinic in March 2024. For employers, the point is direct: insider misuse of personal data can become a criminal data protection matter even when the organisation itself is not fined. ...

The post London Clinic ICO caution: what staff medical-record misuse teaches employers appeared first on Measured Collective.

Irish DPC fines HSE €300,000 after Tullamore ransomware breach

Scott Dooley — Thu, 18 Jun 2026 07:16:30 +0000

The Irish Data Protection Commission has fined the Health Service Executive €300,000 after a ransomware attack on the laboratory information system at Midlands Regional Hospital Tullamore. The DPC notice, published on 15 June 2026, says the breach was detected on 14 November 2018 and affected systems used to store and process patients’ diagnostic-test results. The ...

The post Irish DPC fines HSE €300,000 after Tullamore ransomware breach appeared first on Measured Collective.

Is Employee Data Subject to GDPR? How must it be protected?

Scott Dooley — Tue, 16 Jun 2026 10:28:46 +0000

Yes. Employee data is personal data, so GDPR applies whenever an employer collects, stores, shares, searches, or deletes it. The more useful question is not whether the law applies, but which rules and controls fit the data you actually hold. The ICO’s employment guidance is aimed at employers handling workers’ information under UK GDPR and ...

The post Is Employee Data Subject to GDPR? How must it be protected? appeared first on Measured Collective.

When Do You Need to Conduct a GDPR Risk Assessment/DPIA?

Scott Dooley — Tue, 16 Jun 2026 00:17:09 +0000

In practice, people often say “GDPR risk assessment”, but the legal test under the UK GDPR is whether you need a data protection impact assessment before you start processing. The question is not whether a project feels sensitive. It is whether the processing is likely to create a high risk to people’s rights and freedoms, ...

The post When Do You Need to Conduct a GDPR Risk Assessment/DPIA? appeared first on Measured Collective.