The ICO has declined to suggest in its guidance how long controllers should normally take to respond to data subject complaints. I think this is a missed opportunity. On my personal blog: informationrightsandwrongs.com/2026/02/13/d...

The ICO no longer has to establish that cookie contraventions are likely to cause significant damage or distress before issuing a fine. Will it lead to flurry of fines? (Hint: not under the current regime). Still a noteworthy change though @mishcondereya.bsky.social www.mishcon.com/news/unlawfu...

I've written for the @mishcondereya.bsky.social website on some of the more significant changes wrought by the Data (Use and Access) Act 2025 which commence today (5 February) www.mishcon.com/news/data-pr...

On my personal blog: FTT rather dismantles @ICOnews on both the facts and the law in this remarkable FOI judgment. Will the ICO have to rewrite their section 40 NCND guidance? informationrightsandwrongs.com/2025/11/29/n...

After all these years, I see that a social media post by @davidallengreen.bsky.social can have a remarkable booster effect on the visits to one’s blog

Incredible story. The ICO should absolutely now be paying the force some real attention given the potential wider implications for FOI requests and subject access requests.

I’ve written on my personal blog about an extraordinary CoA judgment in which the Chief Constable of Northants Police has been found in contempt over egregious BWV disclosure failings informationrightsandwrongs.com/2025/11/13/c...

The MoD has said it cannot say whether it has had any spreadsheet-based data breaches following the catastrophic Afghan citizen one, because it would take >237 hours to find out. On my personal blog informationrightsandwrongs.com/2025/11/07/m...

I’ve written on my personal blog on the still-unclear question of why one very large charity received “public sector” lenience from the ICO - and a 97.5% reduction in proposed fine - while a few months later a tiny charity didn’t informationrightsandwrongs.com/2025/07/29/i...

I’ve written up my thoughts for the @mishcondereya.bsky.social website, on the baffling decision by the ICO to take no action in response to the most catastrophic data breach in UK history, which exposed many thousands of people to immediate risk to their lives. www.mishcon.com/news/data-pr...

Today we heard about the most catastrophic data breach in UK history. And the ICO’s response? No need for any action. Not. Good. Enough. www.linkedin.com/posts/jon-ba...

A largely overlooked but significant change wrought by the Data (Use and Access) Act 2025 means that, in principle, it will be *much* easier for the ICO to issue fines for cookies contravention I've written about this for the @Mishcon_de_Reya website www.mishcon.com/news/fines-f...

I’ve written for the Mishcon de Reya website on the Data (Use and Access) Act 2025 and the changes it will make to the UK’s data protection laws www.mishcon.com/news/how-wil...

A man on remand for assaulting his ex-partner duped former employer, JD Wetherspoon, into orally disclosing her mother’s mobile phone number, which he then used to continue his abuse. I’ve written on my personal blog about the case which has resulted informationrightsandwrongs.com/2025/06/29/o...

The Data (Use and Access) Act 2025 has now been published. NB that most of the operative data protection provisions still need secondary legislation to commence them www.linkedin.com/posts/jon-ba...

A blogpost on what the Data (Use and Access) Act 2025 will do. It’s essentially an amending statute: practitioners should look mostly to how it changes UK GDPR, DPA 2018 and PECR informationrightsandwrongs.com/2025/06/20/w...

The Data (Use and Access) Bill is due to receive Royal Assent on 19 June: bills.parliament.uk/bills/3825/s...

For the want of a nail the shoe was lost. For the want of a signature the €4.3m GDPR fine against VW was lost. themunicheye.com/volkswagen-e...

Next week the Court of Appeal will hear the claimants’ appeal in the case of Farley and Others v. Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB). See my short primer on the issues www.linkedin.com/posts/jon-ba...

To what extent do rules in defamation carry over to data protection claims about publication of personal data? There’s some interesting analysis in a recent judgment, striking out a claim by Dale Vince against Associated Newspapers. On my personal blog: informationrightsandwrongs.com/2025/06/09/d...

The @goodlawproject.bsky.social is suing Reform, as a representative body (the first such case brought under Article 80(1) of the UK GDPR. GLP have published both its particulars of claim and Reform’s defence. I’ve written about it on my personal blog informationrightsandwrongs.com/2025/06/06/g...

The Information Tribunal has ruled that the Hinkley Point C construction company is a public authority for the purposes of the Environmental Information Regulations (a parallel access regime to the FOI Act). On my personal blog: informationrightsandwrongs.com/2025/06/06/h...

For some reason @familoo.pinktape.co.uk @juliedoughty.bsky.social I can’t reply to this post, so having to repost it: these are my initial thoughts on the data protection aspects of the guidance informationrightsandwrongs.com/2025/06/04/c...

The Family Justice Council has produced guidance on covert recordings in family law proceedings - some of its references to data protection law are misguided. On my personal blog: informationrightsandwrongs.com/2025/06/04/c...

When Liz Truss was elected leader of the Tory Party (and thus recommended to and appointed by the Queen as her PM) was it an exercise of a public function amenable to JR? Unsurprisingly, the Court of Appeal says “no”. On my personal blog informationrightsandwrongs.com/2025/05/27/l...

This looks very nasty - a cyber attack has apparently compromised the Legal Aid Agency’s online digital services, involving a "significant" amount of personal data from those who applied online for legal aid since 2010 www.gov.uk/government/n...

For data subjects considering complaints to the ICO, or for controllers faced with such complaints, you might want to know there is a current 16-week wait just to get allocated to a caseworker. A tub-thumping post by me on LinkedIn www.linkedin.com/posts/jon-ba...

The Data (Use and Access) Bill was returned to the Lords yesterday, and once again, on three key votes - on sex data and DVS, the definition of “scientific research”, and AI & copyright, the Government lost. My LinkedIn post: www.linkedin.com/posts/jon-ba...

The First-tier Tribunal has certified to the Upper Tribunal an offence of contempt by the University of Exeter, in respect of “wilful” and “flagrant” failure to comply with an order by the FTT under FOIA to disclose information. On my personal blog informationrightsandwrongs.com/2025/05/07/f...

The Information Commissioner has ruled, in two important recent decisions, that BT and Openreach are public authorities for the purposes of the Environmental Information Regulations 2004 www.mishcon.com/news/bt-is-s...

A duty to provide context when responding to data subject access requests - a new data protection duty in domestic law? By me, on my personal blog informationrightsandwrongs.com/2025/03/27/a...

In what world would FOI disclosure of the blank forms ministers must use to declare interests be prejudicial to the conduct of public affairs? Well, it’s a world that the Cabinet Office inhabits. Post on my personal blog informationrightsandwrongs.com/2025/02/19/t...

NHS England will not publish the full report into the health services’ role in the treatment of Valdo Calocane in part because of data protection concerns. I’ve written on my personal blog about this informationrightsandwrongs.com/2025/02/04/n...

Judicial review of a regulator (especially one entrusted to bring prosecutions) is exceptionally hard. I’ve written on my personal blog about a recent unsuccessful application for JR of the Information Commissioner informationrightsandwrongs.com/2025/01/30/e...

Quote tweet with a bridge from your gallery

I’ve written on my personal blog about the judgment in RTM v Bonne Terre, on cookies, consent and targeted advertising. I suspect there will be a lot of misunderstanding and misrepresentation of its significance informationrightsandwrongs.com/2025/01/24/c...

I’ve written for the @mishcondereya.bsky.social website on the news that a government amendment to the Data (Use and Access) Bill will allow charities to use the PECR “soft opt in” to send direct marketing and text messages to individuals www.mishcon.com/news/data-us...

Data protection claim against persons unknown gets (very) short shrift from Mr Justice Nicklin On my personal blog informationrightsandwrongs.com/2024/12/12/d...

Interesting data protection case in the High Court, where a private investigator firm appears to be arguing it was a mere processor when helping prepare a report for use in family proceedings www.linkedin.com/posts/jon-ba...

Could the right to be forgotten break generative AI? On my personal blog informationrightsandwrongs.com/2024/12/07/c...

Banks to be required to snoop on customers’ accounts to check for benefit fraud, under proposed “DWP Fraud, Error and Debt Bill” On my personal blog informationrightsandwrongs.com/2024/12/06/b...

On my personal blog, an extraordinary, and - I think - unfair costs decision against a freedom of information requester informationrightsandwrongs.com/2024/12/05/f...

The former and current Information Commissioners appear to disagree on the efficacy of data protection fines, with Liz Denham reported as saying some companies are dismissive of enforcement because “there's no fines coming our way” www.linkedin.com/posts/jon-ba...

A recent FOI decision of the Information Tribunal has the potential to lead govt to classify certain types of info as “always exempt”, but I believe the judgment contains a plain legal error informationrightsandwrongs.com/2024/12/03/i...