Paying compensation under UK data protection law
First published in Privacy Laws & Business UK January 2026, www.privacylaws.com. The UK Court of Appeal lowers the bar for data protection compensation in Farley v Paymaster. The case now goes to the UK Supreme Court. By Victoria Hordern of Digiphile. In what circumstances is an organisation required to pay compensation to individuals under data protection […]
Ponderings on personal data processing in AI models following the EDPB’s AI Opinion
Phil Lee – Managing Director, Digiphile and IAPP UK Country Leader and Emeritus Fellow. January 05, 2025. Any self-respecting Englishman or woman will tell you that, to make a really good cup of tea, the tea must steep in its teapot for a couple of minutes before pouring. Sometimes the same is true of […]
Joint controller relationships – Why the hate?
Phil Lee – Managing Director, Digiphile and IAPP UK Country Leader and Emeritus Fellow. May 17, 2024. Upon its adoption in 2016, the GDPR introduced a provision specifically focussed on “joint” controllership, in Article 26. While the notion of joint controllership was not new (the Article 29 Working Party discussed joint controllership under the old […]
AI has a governance problem – privacy professionals need to step-up
I’ve found myself wondering lately whether, in years to come, we’ll tell our children where we were and what we were doing when we first learned about ChatGPT.
Could the UK’s data protection reforms create an unintended loophole for commercial AI research?
One of the more notable aspects of the UK’s DP&DI (No. 2) Bill (the “Bill”) is its explicit recognition that the concept of “scientific research” includes “