Data Protection: A Practical Guide To UK and EU Law 5th Edition Peter Carey
Data Protection: A Practical Guide To UK and EU Law 5th Edition Peter Carey
https://ebookmass.com
https://ebookmass.com/product/data-protection-a-
practical-guide-to-uk-and-eu-law-5th-edition-
peter-carey/
https://ebookmass.com/product/eu-law-beyond-eu-borders-the-
extraterritorial-reach-of-eu-law-marise-cremona-editor/
testbankdeal.com
https://ebookmass.com/product/practical-guide-to-clinical-data-
management-3rd-edition-ebook-pdf-version/
testbankdeal.com
https://ebookmass.com/product/eu-law-beyond-eu-borders-the-
extraterritorial-reach-of-eu-law-joanne-scott/
testbankdeal.com
Health Measurement Scales: A practical guide to their
development and use 5th Edition, (Ebook PDF)
https://ebookmass.com/product/health-measurement-scales-a-practical-
guide-to-their-development-and-use-5th-edition-ebook-pdf/
testbankdeal.com
https://ebookmass.com/product/protecting-genetic-privacy-in-
biobanking-through-data-protection-law-dara-hallinan/
testbankdeal.com
https://ebookmass.com/product/spss-statistics-a-practical-
guide-5e-5th-edition-kellie-bennett/
testbankdeal.com
https://ebookmass.com/product/arias-practical-guide-to-high-risk-
pregnancy-and-delivery-5th-edition-glennis-zilm/
testbankdeal.com
i
D ATA P ROT E C T I O N
ii
iii
Data Protection
A Practical Guide to UK and EU Law
Fifth Edition
Edited by
PETER CAREY
1
iv
1
Great Clarendon Street, Oxford, OX2 6DP,
United Kingdom
Oxford University Press is a department of the University of Oxford.
It furthers the University’s objective of excellence in research, scholarship,
and education by publishing worldwide. Oxford is a registered trade mark of
Oxford University Press in the UK and in certain other countries
© Peter Carey 2018
The moral rights of the author have been asserted
Fourth Edition published in 2015
Fifth Edition published in 2018
Impression: 1
All rights reserved. No part of this publication may be reproduced, stored in
a retrieval system, or transmitted, in any form or by any means, without the
prior permission in writing of Oxford University Press, or as expressly permitted
by law, by licence or under terms agreed with the appropriate reprographics
rights organization. Enquiries concerning reproduction outside the scope of the
above should be sent to the Rights Department, Oxford University Press, at the
address above
You must not circulate this work in any other form
and you must impose this same condition on any acquirer
Crown copyright material is reproduced under Class Licence
Number C01P0000148 with the permission of OPSI
and the Queen’s Printer for Scotland
Published in the United States of America by Oxford University Press
198 Madison Avenue, New York, NY 10016, United States of America
British Library Cataloguing in Publication Data
Data available
Library of Congress Control Number: 2017960259
ISBN 978–0–19–881541–9
Printed and bound by
CPI Group (UK) Ltd, Croydon, CR0 4YY
Links to third party websites are provided by Oxford in good faith and
for information only. Oxford disclaims any responsibility for the materials
contained in any third party website referenced in this work.
v
Foreword
It’s a great honour to be introducing the new edition of Peter Carey’s practical guide
to data protection.
This is a pivotal time for data protection and privacy. The laws we regulate are con-
verging globally, consumer trust is ever more central to both business and the public
sector, and a rapidly expanding digital economy is asking more questions of us all.
UK citizens are better informed about their information rights than ever before.
But alongside that increased awareness of the law, a lot of people feel they’ve lost
control of their own data—and that impacts their trust in organizations.
For me, the end game in the data protection field is always about increasing public
trust and confidence in how their personal data are used.
And the way our personal information is handled has never been more important.
Which of us doesn’t consider ourselves a citizen of the digital world today?
Whether it’s the digital services we see every day on our phones and tablets, or the
digital infrastructure that underpins everything from banking to manufacturing.
Technology is moving so fast. And consumer trust needs to follow it. That’s why
a new law was needed. And that’s what we’re getting with the Data Protection Bill,
which will include the provisions of the General Data Protection Regulation within
its broader scope.
The GDPR builds on the previous legislation; it provides more protections for
consumers, and more privacy considerations for organizations. But this is a step-
change. It’s evolution, not revolution.
There are specific new obligations for organizations, for example around report-
ing data breaches and transferring data across borders. But the real change for organ-
izations is understanding the new rights for consumers.
They’ll have the right to request that personal data be deleted or removed if there’s
no compelling reason for an organization to carry on processing it, and they’ll enjoy
new rights around data portability and how they give consent.
It’s vital that organizations are prepared to comply; but they can also prosper in
the new regulatory landscape.
If your organization can demonstrate that good data protection is a cornerstone
of your business policy and practices, you’ll see a real business benefit.
An upfront investment in privacy fundamentals offers a payoff down the line,
not just in better legal compliance, but a competitive edge. Whether that means
attracting more customers or more efficiently meeting pressing public policy needs,
I believe there is a real opportunity for organizations to present themselves on the
basis of how they understand and respect the privacy of individuals.
I hope this new edition helps you be transparent, be accountable, and give people
back control of their data.
Elizabeth Denham
Information Commissioner
vi
vi
Contents—Summary
Table of Cases xv
Table of UK Legislation xvii
Table of UK Secondary Legislation xxiii
Table of European and International Legislation xxv
Contributing Authors’ Biographies xxvii
List of Abbreviations xxxi
Introduction xxxiii
Contents
Table of Cases xv
Table of UK Legislation xvii
Table of UK Secondary Legislation xxiii
Table of European and International Legislation xxv
Contributing Authors’ Biographies xxvii
List of Abbreviations xxxi
Introduction xxxiii
x Contents
2. Data Protection Principles 32
Peter Carey
Introduction 32
Lawfulness, Fairness, and Transparency 33
Purpose Limitation 34
Data Minimization 35
Data Accuracy 37
Storage Limitation 38
Integrity, Confidentiality, and Security 39
Exemptions 40
Accountability 40
Data Protection by Design and by Default 41
Processors 41
3. Fair, Lawful, and Transparent Processing 42
Estelle Dehon and Peter Carey
Introduction 42
Obtaining Data—Duty Not to Mislead 43
Obtaining Data in a Transparent Manner—Information to Be Supplied
to the Data Subject 44
Other Unfair Processing 50
The Lawfulness Conditions 50
Other Unlawful Processing 59
Cases of Significance 61
Summary 65
4. Special Categories of Data 66
Nicola Fulford and Peter Carey
Introduction 66
The Conditions for Processing 69
Personal Data Relating to Criminal Convictions and Offences 81
Advice on Processing Special Category Personal Data 83
5. Data Security and Breach Notifications 88
Ann Bevitt and Peter Carey
Introduction 88
Obligations of the Controller and Processor 91
Privacy by Design and Privacy by Default 95
Pseudonymization 96
Privacy Enhancing Technologies 97
ISO 27001 97
Security and Outsourcing 98
Security and Exports 98
Security Breaches 98
Notifying Security Breaches 100
Advice on Breach Notification 104
xi
Contents xi
xii Contents
Appeals 173
Powers of Entry and Inspection 173
9. Outsourcing Personal Data Processing 175
Suzanne Rodway and Peter Carey
Introduction 175
The Nature of a Processor 177
Obligations on Processors 178
Choice of Processor 179
Ongoing Assurance 179
The Written Contract 180
Pre-GDPR Arrangements 181
Sub-processors 181
Processor Versus Controller 182
Cloud Services 183
Foreign Processors 183
10. Electronic Communications 184
Peter Given and Peter Carey
Introduction and Historical Background 184
Definitions 186
Email Marketing 189
Text Message Marketing 194
Telephone Marketing 195
Fax Marketing 196
Location Data 197
Cookies and Similar Devices 198
Limitations on Processing of Traffic Data 200
Calling and Connected Line Identification 200
Telephone Directories 202
Non-itemized Bills 202
Termination of Unwanted Call Forwarding 202
Security 202
Breach Notification 203
Enforcement 203
11. Data Protection Impact Assessments 205
Olivia Whitcroft
Introduction 205
What Is a DPIA? 206
When to Carry Out a DPIA 207
Identifying Whether a DPIA Is Required 210
Who Should Carry Out a DPIA 211
How to Conduct a DPIA 212
Reporting and Publication of the DPIA 221
xi
Contents xiii
12. Accountability and the Role of the Data Protection Officer 223
Jenai Nissim
Introduction 223
The Accountability Requirement 224
The Role of the DPO 226
When Is a DPO Mandatory? 226
Accessibility 231
Expertise and Skill of the DPO 233
Involvement of the DPO 234
Necessary Resources 235
Independence 236
Security of Tenure 236
Conflict of Interest 237
Data Protection Impact Assessments 238
Record Keeping 238
Policies and Procedures 239
13. Creating a Data Protection Compliance Programme 240
Jenai Nissim
Introduction 240
Stage 1—Assessing Data Processing Activities 241
Stage 2—Creating Data Protection Policies 242
Stage 3—Data Protection Training and Raising Awareness 244
Stage 4—Implementing Controls to Reduce and Monitor Risk 246
Stage 5—Monitoring Compliance 248
Stage 6—Reporting 249
Stage 7—Annual Review Process 249
Table of Cases
AB v Ministry of Justice [2014] EWHC 1847 (QB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152–153
Baronetcy of Pringle of Stichill [2016] UKPC 16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Brown (Andrea) v Commissioner of Police for the Metropolis and Chief Constable of
Greater Manchester Police (2016) Claim No. 3YM09078 & A53YP250
(CC, Central London). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Campbell v Mirror Group Newspapers [2004] UKHL 22; [2002] EWHC 299;
[2002] All ER (D) 448 (Mar). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15, 57, 63, 64, 68
Chief Constable of Humberside Police and Others v Information Commissioner
[2009] EWCA Civ 1079. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Coco v A N Clarke (Engineeers) Ltd [1968] FSR 415. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59–60
College van burgemeester en wethouders van Rotterdam v Rijkeboer [2009] C-553/07. . . . . . . . . 128
Common Services Agency v Scottish Information Commissioner [2008] UKHL 47. . . . . . . . . . . . 12
Dawson Damer and Others v Taylor Wessing LLP [2017] EWCA Civ 74. . . . . . . . . . . . . . . 128, 129
Deer (Dr Cécile) v The University of Oxford [2017] EWCA Civ 121 . . . . . . . . . . . . . . 129, 130, 136
Dunn v Durham County Council [2012] EWCA Civ 1654 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Durant v Financial Services Authority [2003] EWCA Civ 1746 . . . . . . . . . . . 11–13, 16, 17–18, 128
Edem v IC & Financial Services Authority [2014] EWCA Civ 92. . . . . . . . . . . . . . . . . . . . . . . 12–13
Elliott v Lloyds TSB Bank plc and Another [2012] EW Misc 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Esch and Others v European Central Bank (2004) T-320/02. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Ezsias v Welsh Ministers [2007] All ER (D) 65. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Google Inc. v Vidal Hall and Others [2014] EWHC 13 (QB). . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Google Spain SL & Google Inc. v Mario Costeja Gonzalez [2014] C-131/12 . . . . 7, 15–16, 146–147
Gurieva and Another v Community Safety Development (UK) Ltd [2016]
EWHC 643 (QB). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124, 128
Halliday v Creation Finance Ltd [2013] EWCA Civ 33. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Huber v Germany [2009] CMLR 49 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Iesni v Westrip Holdings [2011] 1 BCLC 498. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd [2017] EWCA Civ 121. . . . . . . . . . . 13, 129
Johnson v Medical Defence Union [2004] EWHC 347. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Johnson v Medical Defence Union [2007] EWCA Civ 262. . . . . . . . . . . . . . . . . . . . . . . . 50, 64, 128
Kololo v Commissioner of Police for the Metropolis [2015] EWHC 600 (QB). . . . . . . . . . . . . . . 128
Law Society and Others v Kordowski [2011] EWHC 3185 (QB) . . . . . . . . . . . . . . . . . . . . 50, 64–65
Lin v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB). . . . . . . . . . . . . . . . . 128
Lindqvist, Bodil v Kammaraklagaren (C-101/01) [2004] 1 CMLR 20 (ECJ). . . . . . . . 63–64, 68, 108
Netherlands Immigration Minister v M & S (17 July 2014) C-141/12 & C-372/12 . . . . . . . . . . . . 13
R (Kelway) v The Upper Tribunal (Administrative Appeals Chamber) and Northumbria
Police and R (Kelway) v Independent Police Complaints Commission [2013]
EWHC 2575. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
R (on the application of B) v Stafford Combined Court [2006] EWHC 1645. . . . . . . . . . . . . . . . . 75
R v Secretary of State for the Home Department, ex p Lord [2003] EWHC 2073
(Admin). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131, 135–136
Robertson (Brian Reid Beetson) v Wakefield Metropolitan Council, Secretary of State
for the Home Department [2001] EWHC 915 (Admin). . . . . . . . . . . . . . . . . . . . . . . . . . 61, 62
Smith v Lloyds TSB plc [2005] EWHC 246. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14, 17, 130
Southern Pacific Personal Loads Ltd [2013] EWHC 2485 (Ch) . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Stone v South East Coast SHA (formerly Kent and Medway SHA) [2006] EWHC 1668. . . . . . . . . 77
xvi
Table of UK Legislation
Please note that page numbers in bold refer to actual text (in Appendix 1). Please refer to Index for
references to Working Parties, e.g. Article 29 Working Party.
Personally, I do not quite share the opinion that the Darma Shokas
came from the plains or from [223]Tibet by way of the plains. They
resemble quite closely the Kam-par or Tibetans from Kam, with whom
they are to this day in constant communication. In fact, it is chiefly with
the Kam-par tribe and Gyanema that the Darma Shokas do all their
trading. The more massive features and stronger facial characteristics of
the Darma Shokas have been acquired, I think, more through their
frequent intercourses with Jumlis and other tribes of Western Nepal,
which gives them a wilder appearance than the more purely Mongolian
stolid types, such as the Bias Shokas.
In many ways the Darma Shokas do not possess the refined and
gentlemanly feelings so strikingly common among Bias Shokas, nor are
they quite so honest and reliable. But they, too, possess good hearts,
are somewhat impetuous and excitable, and occasionally addicted to
murder. [224]
[Contents]
CHAPTER XXI
From Khela on the Nepalese boundary, where I found my men and pony—the
latter had been safely taken back across the dangerous Nerpani road—I
proceeded in all haste to Almora. I varied my journey slightly, travelling by way of
Thal.
The roar of British officials had been very great while I was distant, so I halted
several days both in Almora and Naini-Tal, the summer seat of the Provincial
Government, in order to give them opportunity of carrying out some of their
threats. Nothing happened.
Perhaps the journey, requiring as it did more than ordinary endurance, did more
to strengthen my former theories about travelling attendants than any journey I
had taken before. I invariably [225]found that thoughtful and tactful kindness with
my men and with strangers always paid better than harsh treatment. It is all very
well for the leader of an expedition not to mind this, and not to feel that, and, if
anything, rather enjoy the fun of roughing it. The interest which he—if of even
moderate intelligence—must take in the study of the country, the natives,
recording his scientific observations, surveying, photographing, writing up his
notes, etc., leave him but little time to worry over climatic conditions or the
cooking. But not so with the native followers, who after their day’s work is
finished—and pretty tedious their day’s work is—have nothing to employ their
minds except the thought that another day of hardship is to follow. The mind
preys a good deal upon the entire system, and when to mental depression you
add every possible bodily inconvenience you can think of, it is not unnatural that
the men are inclined to break down.
First of all, naturally, I took great care to have my men well fed and clothed, then
the next and most important was to prevent them getting depressed when great
difficulties were facing them. Many evenings, when we did not make night
marches, I used to collect my men round my tent [226]and entertained them with
long descriptions of things in Europe they had never seen, such as ocean
steamers, “sky-scrapers,” railways, electric light, etc.
I am rather sorry that, this publication being illustrated entirely by drawings done
by hand, I am not able to give an interesting photograph of a group of my
followers whom I snapshotted as I was describing to them the wonders of
civilisation. The expressions of wonderment and keen interest were quite
intense, and show clearly in the photograph.
The men always looked for these nightly lectures, and no matter how tired they
were they generally collected round for me to tell them more. This, I think,
helped more to keep my men in good spirits—in very exasperating
circumstances—than anything I could think of. Every topic would lead to endless
discussions among them, and most amusing controversies, which enlivened
their spirits, anyhow till the next lecture.
Yaks and Ponies conveying Wool across the Frontier
Natives always take the keenest interest in firearms and anything connected
with them. Also in telescopes, which they love. I happened to possess a little
camera which was not unlike a spy-glass. I had given it to one of my men to
carry—by the [227]way, to the fellow who saved my life on the top of Lumpa
Mountain. He could not get it out of his head that it was a glass, and once or
twice I caught him trying to survey the landscape with it.
One evening, on my way down to Almora, we had reached camp, and as I was
sitting outside my tent I perceived the fellow walking away with my camera
towards a cluster of trees some way off on the top of a hillock. I watched him
with the corner of my eye. When he got there he climbed right to the top of the
highest tree, and as he clung with his folded legs to the branch, swinging to and
fro in the wind, he unslung the camera and pulled it out of its case. Next, as I
expected, he brought it up to his eyes and proceeded to scan the landscape.
Unhappily for the camera, the branch, having swung rather too far beyond its
limit of elasticity, gave way, and down came the man and precious instrument,
bounding from branch to branch until they bumped with some might upon the
solid ground—the man, of course, on the top of the camera. The camera he
picked up in fragments, besides destroying eighteen excellent negatives it
contained.
“What on earth did you do that for?” I asked of the Shoka. [228]
“Sahib,” he said, rubbing his aching side, “I have longed for many a day to look
through the durbin; we Shokas are to leave you to-morrow, and I thought I would
have no other opportunity. You can kill me, sahib, because I deserve it!”
When I thought of the deep debt of gratitude I owed this man, I preferred to
spare him. I handed him a real and powerful telescope, properly focussed, for
him to have the treat he wished. When he gazed through it and saw the distant
snows and a village some miles off appear quite close, his excitement had no
bounds, and when he recognised people coming out of the houses his
amazement was very curious to watch.
We had many, many amusing incidents of this kind, and they served to pass
away the time.
I cannot end this book without paying a tribute to the faithfulness, endurance,
and bravery of all my men. A more devoted lot of fellows could nowhere have
been procured. I never had the slightest trouble in any way with them even, as
we have seen, under most trying circumstances. The work demanded of them
was of the most severe nature, and the constant strain and bodily sufferings so
great, that I rather doubt whether I know of any white man who could have stood
it—not as [229]they did, but even half as well. As it was, after the strain was over
—but not before—the poor fellows all broke down, except one. Most of them
were pitiably footsore and exhausted, and only their strong will carried them
through. The only exception was the young boy, frail and delicate, almost girlish-
looking—but with a determined little face—to whom I have referred at the
beginning of the book. As stipulated when I employed him, he always carried the
heaviest load, and when physically stronger men lay down tired at the end of a
march, he was ever ready to run about to collect fuel, took endless pleasure in
helping to pitch the tents, and assist in the cooking. The endurance and courage
of that little fellow were quite marvellous. He did more work than two men taken
together, and at the end of the journey he was the only one who returned in
excellent condition, and as fresh as possible.
So that, remember, it is not always the big, bulky, muscular fellows who can
stand more hardships,—the strongest and most muscular fellow I had was the
only one who succumbed; on the contrary, down to a certain limit, for very hard
work, the smaller the men you employ the better. Wiriness, suppleness, agility—
and intelligence—are [230]essential, and always to be preferred to brutal,
uncontrollable strength; but, above all, use your judgment, and never take with
you on expeditions of this sort a man who does not possess a strong will. [231]
[Contents]
INDEX
Almora, 3, 11
Aneroids, 205
Askote Valley, 30
Bahling, 219
Bedang, 212
Bhimden, 12
Cannibalism, 170
Cave-dwellings, 119
Channer, G. K., 61
Chela, the, 17
Chess, 163
Chinese passport, 40
Chökti, 214
Chongur, 62, 64
Circumambulations, 143
Clouds, 106–109
Crevasses, 73
Dongan, 188
Dukti, 219
Dunes, 97
Ear-piercing, 128
Gankan, 198
Garbyang, 38
Gurkha district, 50
Himahlyas, 1 [232]
Horse-races, 150
House of Commons, 35
Katmandu, 50, 54
Kew Observatory, 7
Khela, 220
Kumaon, 50
Kumaonis, the, 24
Landslides, 102
Loads, 3
Lohagart, 25
Lumpa basin, 78
peaks, 48
ascent of, 80
River, 64, 72
Lumpiya Pass, 43
Lynching, 24
Mahatmas, 145
Mongolian origin, 51
Mountaineering, 4
Murmis, the, 54
Nagling, 219
Nattalì, 190
Nepalese-Shoka half-castes, 48
Nepalese soldiers, 45
women, 49
Newars, the, 53
Non-Gurkha tribes, 54
Pachisi, 14
Persecution, 40
Photography, 74, 79
Pilgrimages, 16
Pithoragarh, 28
Prayer-wheels, 143
Processions, 17
Ransila, the, 13
Raots, the, 30
Sacrifices, 16
Sah-tal, 35, 37
Scientific instruments, 7
Sculptors, 183
Sela, 219
Serju River, 25
Sheldon, Miss, 31
Sirka, 31
Snakes, 23, 28
Stars, 66
Stone-throwing, 161
Strawberries, wild, 65
Sturt, Mr., 36
Sutlej River, 50
Suttee, 50
Tampering of mails, 40
Tents, 8
Vishnu, 218
War-dances, 164
Weaving-looms, 120
Wrestling, 161
Yaks, 116
[Contents]
Sketch Map of Glaciers and Peaks in Nepal