Information, Technology & Media (ITM)

The Court of Appeal considered the first challenge to a GDPR fine. The Court of Appeal clarified the burden of proof in such appeals and the weight to be afforded to the Commissioner’s reasons in setting the fine under challenge.

The Supreme Court settled the longstanding question of whether different FOIA exemptions could be aggregated in the public interest balance, concluding that they could.

These proceedings involved an unprecedented global super-injunction preventing disclosure of a data leak involving the details of people who applied for relocation to the UK from Afghanistan following the Taliban takeover of the country in 2021.

The Supreme Court’s judgment is the leading case on the threshold of seriousness of non-material damage for data breaches, with significant implications for group litigation in respect of data breaches.

Apple’s claim and complaint in the Investigatory Powers Tribunal regarding the Secretary of State’s powers to make Technical Capability Notices under the Investigatory Powers Act 2016.

The Administrative Court considered a challenge brought by the Wikimedia Foundation and an anonymous Wikipedia contributor to categorisation regulations made under the Online Safety Act 2023.

In a landmark decision, the CJEU invalidated the EU-US Privacy Shield and defined the standards of protection required for international data transfers.

The Court of Appeal considered the scope of the data security duty in the Data Protection Act 1998. The Court’s reasoning establishes a data controller will not necessarily comply with the duty simply by “pseudonymising” personal data.

The Court of Appeal determined how courts should assess whether a data subject has validly given their consent to the processing of their personal data.

In this judgment, the High Court provided authoritative guidance on a number of issues in relation to subject access requests, including the approach to requests, the scope of personal data, the extent of the obligation to search, and the communication of the response.

The Divisional Court considered the legality of the Metropolitan Police’s policy governing the use of live facial recognition.

The Upper Tribunal found that the Information Commissioner had jurisdiction to issue a Monetary Penalty Notice and an Enforcement Notice against Clearview AI, in an important judgment on the territorial scope and material scope of the GDPR.