Phil Lee

UK Information Commissioner's Office publishes and debunks 9 popular myths about "cookies and similar technologies" Myth 1: The rules only apply to personal data The rules cover any information stored or accessed on a device, not just personal data. Myth 2: The ICO has changed what ‘strictly necessary’ means ‘Strictly necessary’ still means only what is essential to provide the service the user requests, not what is just useful for the business. Myth 3: ‘Strictly necessary’ should be judged from the service’s perspective What is ‘strictly necessary’ is decided from the user’s point of view, not the service provider’s. Myth 4: The ICO is too focused on online advertising Online advertising is a major area for tracking, but the ICO’s focus is on protecting people’s privacy and giving them control. Myth 5: The ICO hasn’t completed an impact assessment The ICO has done an impact assessment and will publish the final version after consultation feedback. (initial version is here: https://lnkd.in/ecW9yehv) Myth 6: We can rely on legitimate interests for non-exempt purposes If consent is required under the law, you cannot use legitimate interests as a reason instead. Legitimate interests may be appropriate in cases where PECR doesn’t require you to get someone’s consent. But you must still go through the three-part test. Myth 7: We can use legitimate interests to process data we obtained on the basis of consent You cannot switch from consent to legitimate interests for processing data collected with consent. Myth 8: PECR is only about cookies and the ICO is expanding the definition The rules apply to all technologies that store or access information on devices, not just cookies. Myth 9: The ICO wants online services to stop using storage and access technologies for advertising The ICO wants these technologies used in a way that is fair, transparent, and gives people real choice and control. Pic by ChatGPT https://lnkd.in/eYKtDKkb

32

Legal teams are losing credibility fast. And it has nothing to do with your legal expertise. A General Counsel confided in me recently: "The board trusts my legal judgement completely. They just don't trust me to run an efficient operation." We've perfected the art of legal analysis whilst completely neglecting the basics of business operations. The evidence is everywhere. Finance directors demanding justification for every legal pound spent. Chief executives bypassing legal because "it takes too long." Board papers questioning whether legal adds value or just adds delay. Here's the brutal reality - exceptional legal advice delivered through dysfunctional operations equals irrelevance. You might draft the perfect contract, but if it takes three weeks to turn around, that's what gets remembered in the boardroom. The legal functions that command real respect have cracked something the rest haven't - they run like businesses, not academic departments. They measure what matters. They eliminate waste ruthlessly. They deliver predictably and professionally. They've recognised a fundamental truth: credibility comes from operational excellence as much as legal excellence. Their stakeholders don't just trust their legal judgement - they trust their ability to deliver results efficiently and cost-effectively. The transformation isn't complicated. Start treating your legal function like the business operation it actually is. Track performance metrics that matter to the business. Optimise processes that create value. Manage resources like every pound counts. Because in today's environment, legal competence without operational competence equals professional suicide. The question isn't whether you're a good lawyer - it's whether you're running a credible business function. #legalops #generalcounsel #legalleadership

104

4 Comments

LexisNexis report: Over 60% of UK lawyers now ‘use GenAI’, but law firm culture slows progress Sixty-one percent of lawyers say they are now using generative AI in their work, according to a new report out today (2 September) from LexisNexis, but two-thirds say slow organisational cultures risk undermining progress. Despite headline adoption clearly escalating, it is important to note that 11% of lawyers said they are using GenAI heavily for day-to-day work and that number drops to 7% at large and medium-sized firms. There are some interesting and wide-ranging findings in here, take a look. I haven't reported on how lawyers would use the time they save from using GenAI (more work or work/life balance) because I'm not clear on whether a significant amount of time is yet being freed up. #legaltech #legalservices #generativeai https://lnkd.in/e4dR3N7C

27

5 Comments

Reflecting on the EDPS v SRB decision (https://lnkd.in/ek8KMzUA) over the weekend, here are my key practical takeaways: 🤓 For students and practitioners of privacy, it's a great decision to read simply because it provides a pretty comprehensive recap of both statutory and case law guidance on determining when data qualifies as personal, pseudonymous or anonymous. ❓Perspective matters. Pseudonymised data is not personal "in all cases and for every person". If a recipient of data does not have "access to the means reasonably likely to be used" to re-identify a data subject, then pseudonymisation may "effectively prevent" them "from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable." This is a nail in the coffin of the absolutist view that pseudonymised data should always be considered personal, even when the recipient has no realistic means to re-identify anyone. 🆕 While it's nice to see this stated so clearly, practically the result is likely to be that parties who disclose pseudonymised data to recipients will have them sign DPAs and SCCs "to be on the safe side". In other words, plus ça change. Vendors will keep trying to argue the data they process isn't really personal, customers and regulators will assume it is. 📃 As far as privacy notices go, data controllers will need to mention their disclosures of pseudonymised data to third parties. We'll probably see a resurrection of language along the lines of "We may disclose your data in deidentified form to third parties who cannot identify you from it". This type of language was fairly common some years back but had started to disappear from more recent privacy notices - usually on grounds that you didn't need to disclose when data sharing with third parties if the data was anonymous in their hands. However, I suspect this type of language will now become commonplace once again...

329

11 Comments

A recent video game AND gambling regulatory development for the UK may have slipped your radar... DCMS has published the findings of its rapid evidence review of 'skins gambling' - the use of virtual items obtained in online video games as stakes in gambling offerings. This will be of particular interest to game developers and publishers with games that feature in-game purchases and/or user-to-user trading. In short, the report's conclusion recommends the explicit classification of skins gambling "as a distinct form of gambling, ensuring it falls under appropriate regulatory oversight" - although the details on this classification are light and it is not clear how this would differ from existing statutory definitions of gambling. Other recommendations include: 🔨 more robust enforcement of compliance requirements (such as operating licences); 📰 the launch of national awareness campaigns targeting parents and young people; and 🛡️ age-based safeguards for mechanics such as loot boxes and in-game trading systems. You can find more detailed analysis from Nick and me on the report's implications for both the gambling and games sectors in the link below. https://lnkd.in/e3NgttVh

34

3 Comments