Anna Cook

UK Information Commissioner's Office publishes and debunks 9 popular myths about "cookies and similar technologies" Myth 1: The rules only apply to personal data The rules cover any information stored or accessed on a device, not just personal data. Myth 2: The ICO has changed what ‘strictly necessary’ means ‘Strictly necessary’ still means only what is essential to provide the service the user requests, not what is just useful for the business. Myth 3: ‘Strictly necessary’ should be judged from the service’s perspective What is ‘strictly necessary’ is decided from the user’s point of view, not the service provider’s. Myth 4: The ICO is too focused on online advertising Online advertising is a major area for tracking, but the ICO’s focus is on protecting people’s privacy and giving them control. Myth 5: The ICO hasn’t completed an impact assessment The ICO has done an impact assessment and will publish the final version after consultation feedback. (initial version is here: https://lnkd.in/ecW9yehv) Myth 6: We can rely on legitimate interests for non-exempt purposes If consent is required under the law, you cannot use legitimate interests as a reason instead. Legitimate interests may be appropriate in cases where PECR doesn’t require you to get someone’s consent. But you must still go through the three-part test. Myth 7: We can use legitimate interests to process data we obtained on the basis of consent You cannot switch from consent to legitimate interests for processing data collected with consent. Myth 8: PECR is only about cookies and the ICO is expanding the definition The rules apply to all technologies that store or access information on devices, not just cookies. Myth 9: The ICO wants online services to stop using storage and access technologies for advertising The ICO wants these technologies used in a way that is fair, transparent, and gives people real choice and control. Pic by ChatGPT https://lnkd.in/eYKtDKkb

32

We're pleased to share that we have purchased an enterprise-wide licence for Legora, a collaborative AI platform that will support the strengths of our people and technology across both the business and practice of law.   Following an extensive pilot, this investment supports our people to focus on what they do best - practising law at the highest level - while providing intelligent support for complex work, with Legora's capabilities aligning well with how we serve our clients and operate our business.   Our commitment extends beyond technology adoption to embedding digital fluency across the firm. Read more about our partnership with Legora: https://lnkd.in/ehB5kfA8 #LegalTech #LegalInnovation #AIinLaw #Legora

303

5 Comments

Introducing Mishcon de Reya's latest guide, providing a concise overview of the key competition law principles under UK law relevant to start-ups and growing companies. Download your copy for practical guidance to help new businesses operate legally and ethically while fostering innovation and growth, from Gwen Ballin-Reeler and Chanelle Cattin: https://lnkd.in/gZQay-35

48

1 Comment

A recent video game AND gambling regulatory development for the UK may have slipped your radar... DCMS has published the findings of its rapid evidence review of 'skins gambling' - the use of virtual items obtained in online video games as stakes in gambling offerings. This will be of particular interest to game developers and publishers with games that feature in-game purchases and/or user-to-user trading. In short, the report's conclusion recommends the explicit classification of skins gambling "as a distinct form of gambling, ensuring it falls under appropriate regulatory oversight" - although the details on this classification are light and it is not clear how this would differ from existing statutory definitions of gambling. Other recommendations include: 🔨 more robust enforcement of compliance requirements (such as operating licences); 📰 the launch of national awareness campaigns targeting parents and young people; and 🛡️ age-based safeguards for mechanics such as loot boxes and in-game trading systems. You can find more detailed analysis from Nick and me on the report's implications for both the gambling and games sectors in the link below. https://lnkd.in/e3NgttVh

34

3 Comments

Reflecting on the EDPS v SRB decision (https://lnkd.in/ek8KMzUA) over the weekend, here are my key practical takeaways: 🤓 For students and practitioners of privacy, it's a great decision to read simply because it provides a pretty comprehensive recap of both statutory and case law guidance on determining when data qualifies as personal, pseudonymous or anonymous. ❓Perspective matters. Pseudonymised data is not personal "in all cases and for every person". If a recipient of data does not have "access to the means reasonably likely to be used" to re-identify a data subject, then pseudonymisation may "effectively prevent" them "from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable." This is a nail in the coffin of the absolutist view that pseudonymised data should always be considered personal, even when the recipient has no realistic means to re-identify anyone. 🆕 While it's nice to see this stated so clearly, practically the result is likely to be that parties who disclose pseudonymised data to recipients will have them sign DPAs and SCCs "to be on the safe side". In other words, plus ça change. Vendors will keep trying to argue the data they process isn't really personal, customers and regulators will assume it is. 📃 As far as privacy notices go, data controllers will need to mention their disclosures of pseudonymised data to third parties. We'll probably see a resurrection of language along the lines of "We may disclose your data in deidentified form to third parties who cannot identify you from it". This type of language was fairly common some years back but had started to disappear from more recent privacy notices - usually on grounds that you didn't need to disclose when data sharing with third parties if the data was anonymous in their hands. However, I suspect this type of language will now become commonplace once again...

329

11 Comments

📈 Two of the UK’s fastest-growing legal tech startups, Definely (founded by two ex-Freshfields lawyers) and Wordsmith AI, have been selected for Future Fifty - the high-profile programme for tech scale-ups on the path to IPO or major expansion. The programme is widely seen as a springboard for international growth. Alumni include Revolut and Wise. Previous legal tech inductees include Juro and Lawhive, the AI-powered legal services marketplace that recently made headlines by acquiring a law firm in an industry first. https://lnkd.in/e8vzVBxx

20