Tom Webb

Really interesting to see the FT publish this article on outsourced investigations, with a focus on London firms. I won't try to summarise it but would offer some thoughts based on my own experiences and discussions on how to approach this complex topic. A starting point is to appreciate that relevant public regulatory / investigative / prosecution authorities have limited budgets, but the scope and complexity of relevant issues has increased massively in recent decades as a result of more 1. laws of a criminal or regulatory nature (i.e. not just civil liability) 2. pressure (for various reasons) to address scandals and wrongdoing 3. complex evidence to review as a result of the digital information explosion 4. global business, raising more complex interactions between systems The basic resolution to this quandary has been for public authorities to outsource a lot of detail to law and other firms instructed and paid for by the company under investigation but expected to operate independently. This can broadly work - with some element of compromise - where the public authority is forceful and switched-on to the ways that it can go wrong. Indeed, in such situations it can create problems of budget control for the company as the investigating firms are in some sense answerable to the public body for defects. A different kind of problem can arise where 1. the authority or 'authority' requiring the investigation is a little lame, or 2. the company is 'voluntarily' undertaking the investigation. The risk of a lack of independence and rigour then arises, as noted in the article. Most of the process here inevitably goes on outside the public gaze, but if unfamiliar with the topic the PO/Horizon inquiry provides some unusually public examples. - See this month's witness evidence for an example of a chair and CEO seeking to stifle an investigation. - And see previous evidence for examples of an authority figure (the chair of the current inquiry) requiring the company and advisers to explain and fix various problems with the digital evidence disclosure process. One other topic that comes through from the article is the various options for carrying out such investigations - - large corporate law firms - boutique / individual lawyers - forensic accountants - specialist investigators of various types, depending on the issues in the case Suffice to say, there can be some tensions between these camps - indeed, you can see some positioning going on in various quotations. The topic of legal professional privilege is also significant here. As noted in the article, this is sometimes waived to a greater or lesser extent, a topic of some delicacy.

24

5 Comments

What lies in store for litigation funders? My Gazette column looks at some of the issues the CJC will be addressing in its review: https://lnkd.in/eZPA6YKV (Now with a direct web link) #litigationfunding #litigationfinance

13

1 Comment

In a recent opinion, the European Data Protection Board (EDPB) tackled the thorny issue of "consent or pay" models implemented by large online platforms. These models require users to either consent to have their personal data processed for behavioural advertising or pay a fee to access the platform's services without such tracking. The EDPB made it clear that in most cases, these "consent or pay" approaches will not meet the GDPR's stringent requirements for valid, freely given consent. Specifically: 🔵 Consent cannot be "freely given" if users face exclusion from a service or significant financial detriment for refusing to consent. 🔵 Platforms must offer a genuine, no-cost alternative to the "pay" option, not just a paid version without data tracking. 🔵 Any fees charged for the non-tracking alternative must not be so high as to effectively coerce users into consenting. Furthermore, the EDPB emphasized that consent must be specific, granular, and truly informed - platforms cannot use deceptive design patterns to obtain consent. 𝐊𝐞𝐲 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬: 📌 "Pay or Okay" models likely violate GDPR consent requirements 📌 Platforms must provide a free, non-tracking alternative service option 📌 Fees for non-tracking options cannot be prohibitive or coercive 📌 Consent must be freely given, specific, and fully transparent While the EDPB's opinion is an important step, the debate around "pay or okay" models is far from over. Expect further guidelines from the EDPB later this year that go beyond just large online platforms. Ultimately, the fundamental question is whether these models can ever truly uphold users' right to freely decide the fate of their personal data. #dataprivacy #gdpr #consentorpay #onlineplatforms #edpb

29

The third entry into the Legal Business Magazine Pride series covers my discussion with Daniel Gerring at Travers Smith, who discussed his coming out journey, how the firm has improved its allyship efforts, and the importance of policies when supporting LGBTQ+ employees. Give it a read below. #pride #diversity #legalbusiness https://lnkd.in/gqHj2YXY

48

I'm really enjoying reading LexisNexis UK Bellwether Report 2024. HOWEVER I'm noticing a change of style which sees the report start to promote some of Lexis' products and technologies. LexisNexis people - this is a mistake. The report has always sold itself on being an independent piece of advisory content on the state of the legal market in England and Wales. The moment you start to promote your own content, you lose the independence angle. We all know you invest in the research for longer term goals which are presumably to increase your market share and sell more. Which is fine. But you are muddying your pond here. Please revert next year! Link to the report in the comments. Still a good read but the self-promo is jarring. Also, as in previous years, I'll be writing my own observations on the Report, and what I think it says about the legal market in England and Wales. Available soon via the LexRex Communications Ltd blog and newsletter.

6

3 Comments

We will be releasing further podcasts over the coming weeks which will focus on different parts of the DMCC to help you assess the steps you might need to take to help prepare for its implementation. We are still waiting for the final text, but that is expected very soon! #consumerlaw #dmcc

3

I don’t listen to many DP / privacy podcasts. I enjoy a few - hello ‘Grumpy GDPR’ - but my taste mainly veers towards movies and politics. I listened to a privacy one recently because it supposedly featured a topic that I was interested in (ironically, it was barely covered), but then one of the hosts said something that I disagreed with so much, I had to write this. Data Protection is not a job, they said, it’s a calling. Allow me to retort. I think Data Protection is a job. It can be more, but that’s the foundation. Of course, some do feel a calling. Some want to change the DP (or wider) world for the better. Some plainly see themselves as human rights activists. I don’t doubt their sincerity. That's them and it's none of my business. There are admittedly a few cosplayers along for the ride but they’re easier to spot than they think they are. But at the same time, it’s not necessary to feel or advertise a passionate vocation to be an effective, valuable and valued DP professional. You can do the job well, then knock off and play with your kids, watch movies, play the ukulele, or make extremely complicated cakes. I repeat my origin story often because it’s true and it annoys the right people. I got into DP and FOI because I needed a permanent job. That’s all it was. I stayed because I enjoy it, and the job allows me to do good for both individuals and (whisper it) organisations. But I’m not on a crusade. I’m doing a job that I hope I do well, but I would’ve done as much good if I had stayed in libraries and tried my best there. I don’t think I’m alone. I think a lot of people are here to do a job: they want to do it diligently and effectively but it’s a job. The fact that - done right - data protection helps and supports people is part of most people’s job satisfaction but there’s nothing wrong with doing a job well and then clocking out. It’s wrong to characterise thousands of people as being any one thing. I’ve met dedicated and thoughtful DP folk, and people who just need work. I know purists, sometimes showing the zeal of being a recent convert, sometimes with Old Testament Prophet vibes. But there are also bullshitters and shameless grifters. That’s a wide mix of people. Not all of them have a calling or need one. I don’t like purity tests. I don’t want people who do a good job to be looked down on or made to feel inauthentic because they’re insufficiently pure. What matters to me is impact, not passion. Heresy though it might be to say so, but the two are less closely tied than some may think. I’ve said it before and I will say it again: I am not a rock star or a ninja and I am most certainly not a monk. I’m a data protection plumber. I’ll help you put the right system in, but I’m also available when… you can fill in the blanks here. And after this proud celebration of grafting, I’m taking a couple of weeks off. The DPO Daily will return on June 29th with a themed ELECTION WEEK! Try to contain your excitement.

97

21 Comments

It is surprising how many cross-border deals involving UK PLCs, but with little or no connection with the UK public markets, start with the question, "Could the Takeover Code apply?" The Takeover Panel is consulting on changes to the Code that would "refocus" its scope and provide welcome certainty that UK companies listed outside of the UK (such as on NYSE and NASDAQ) will not be subject to the Code, irrespective of their directors' residency. While transitional arrangements will mean that these changes will not take effect for some time, we could see this unlock value for affected companies, particularly if the application of the Code was previously seen as an obstacle to a deal. More detail below.

33

Labour's manifesto, released today, has only one mention of gambling policy: "Labour is committed to reducing gambling-related harm. Recognising the evolution of the gambling landscape since 2005, Labour will reform gambling regulation, strengthening protections. We will continue to work with the industry on how to ensure responsible gambling." As no detail is included of what that reform and strengthening of protections will involve, my working assumption is that this means continuing with the proposals as laid out in the White Paper and subsequent consultations. This doesn't appear to be a particular priority in the manifesto, so we should expect some delay to those reforms that require legislation, including online slots stake limits and increased machines for land-based premises. https://lnkd.in/eiBjDfZf

18

1 Comment

JROC has published its proposals for the design of the Future Entity (“FE”) for UK open banking (19 April 2024). https://lnkd.in/erNGX83K The FE follows on from the work undertaken by the Implementation Entity (Open Banking Limited aka OBL) and will “in due course take on the development and delivery”. JROC is now consulting on various recommendations about that journey as well as a new recommendation for the immediate creation of an Interim Entity (to follow the consultation) to cover an interim regulatory phase which will takeover the 5 workstreams currently being progressed by OBL. This will precede the full transition to FE. Part 2 covers the proposed shape of FE Part 3 covers the creation of the Interim Entity Annex 3 provides a useful, concise summary of JROCs proposals for both new entities. Have you got a view on what the future funding options should be (in terms of the impact to your organisation perhaps)? Do you think the Interim Entity should be a subsidiary of OBL? (See Q3) If you want to have your say, the deadline for responding is 20 May 2024.

7

Following today's election, the data and marketing industry will have many questions for the new government, in particular its approach to AI and reforming data protection legislation. Join the DMA's CEO, Chris Combemale next week Thursday 11 July, for an insightful online session the new government's plans and how the DMA will ensure the data protection regime promotes productivity, growth and innovation. Experian Marketing Services will explore how the UTT ruling in favour of Experian established powerful case law in support of legitimate interests as a lawful bases for third party data in direct marketing and the importance of proportionality to transparency requirements. You can read more about the Experian case here: https://ow.ly/oXmP50SvvpR. This week the DMA also published an open letter in which we appeal the new Government’s commitment to prioritise a new Data Reform Bill. We will be launching a major engagement campaign with incoming ministerial team and government officials team at the Department of Science, Innovation and Technology starting on Friday morning as soon as the election result is known. You can read Campaign Live's coverage on the Letter on here: https://ow.ly/yG5k50SvvpP Join Chris next week at the Virtual Legal Update as they discuss all this and more by registering here: https://ow.ly/vml950SvvpQ

4

Earlier this year, the Information Regulator issued an enforcement notice to FT Rams Consulting for direct marketing without consent. It is important to remember that the Protection of Personal Information Act requires companies to obtain consent from data subjects to receive direct marketing. #POPIA also provides data subjects with the right to opt out of receiving direct marketing and places an obligation on the marketing company to cease communication with the data subject should it choose to exercise this right. Failing to abide by POPIA's requirements could result in a complaint being laid with the Information Regulator and ultimately a fine of up to R10 million or imprisonment or both. POPIA does not prohibit direct marketing, however, it does create requirements for doing so lawfully. Every company must have a readily available privacy policy preferably published on their website. Every company should also have POPIA compliance framework. To ensure POPIA compliance, regular gap analysis and POPIA audits must also take place to safe guard the company. Should you need any assistance in this regard, please contact me. #dataprotection #personalinformation #privacylaws

2

A well written UK decision on data protection and subject access requests (SARs) - with the additional spice of the judge calling the claimant untruthful and dishonest. The judge’s reasoning starts from paragraph 59 (the case can be found here: https://lnkd.in/ewfxwayK). Their key decisions were: 📌 an individual does not benefit from the ‘personal or household activity exemption’ in disclosing information to friends and family where the information has been collected by their employer in a business context 🆚 but the exemption could apply where the sharing was more limited and made as part of ‘general chat’ 📌 data subjects are entitled to know the identity of the recipients of their information where it has been disclosed by the controller unless it would be impossible or manifestly excessive for the controller to identify those recipients 📓 addresses the ambiguity in article 15 UK GDPR, which refers to the controller identifying either recipients or *categories* of recipients. It also aligns with the post-Brexit decision of the CJEU in RW v Österreichische Post AG (C-154/21) https://lnkd.in/evcijWqe 📌 confirmation of a controller’s wide margin of discretion under paragraph 16 of Schedule 2 DPA 2018 in balancing the interests of a data subject who submits a SAR with the interests of other data subjects whose information could be disclosed in response to that SAR 📓 follows the Court of Appeal in DB v General Medical Council https://lnkd.in/eBh6mqvN 📌 confirmation that directors are not to be treated as controllers where they are acting in their capacity as directors 📓 follows a High Court decision in In re Southern Pacific Personal Loans https://lnkd.in/eMEBhX_5. #dataprotection #sars #gdpr #ukgdpr

6

Should foreign judgements be considered as analogous to English Law? The decision of Re A Company [2024] EWHC 1070 (CH) decides that for winding up petitions they are. In this decision unregistered Lebanese judgements were allowed to be used as exceptions to the statutory limitation period in English law. This is an interesting case for Comparative lawyers on the status of foreign law upon English law. Even unregistered foreign case law can be used in English Law as a exception to statutory limitation periods. When the use of foreign law in US Constitutional Law cases is such a contentious issue, it is interesting to see that foreign law continues to be a major deciding factor in English private law cases.

7

I've been pretty open that I think that to really do well in disputes at the UKIPO you need to be the one "at the coal face" rather than leaving it to others: if you're not appearing in hearings you aren't getting the best appreciation of what evidence is needed (and how much) and so are less effective in gathering evidence. I've been collecting data on which firms and which fee earners have appeared most since 2009. The top 5 people and firms for 2023 and the last 5 years (in order) by number of appearances in in-person hearings are as follows: 2023 (Firms) - A&O Shearman, Dentons, Stobbs, Brandsmiths, Murgitroyd 2023 (Individuals other than barristers) - David Stone, Julius Stobbs, Aaron Wood (me), Phil Harris, Ian Bartlett 2023 (Barristers) - Daniel Selmi, Jamie Muir Wood, Guy Tritton, Sam Carter, Kendal Watkinson 5 years (firms) - Stobbs, Brandsmiths, Murgitroyd, HGF, Wilson Gunn 5 years (individuals other than barristers) - Julius Stobbs, Aaron Wood (me), Phil Harris, Alan Fiddes, Andrew Marsden 5 years (barristers) - Charlotte Blythe, Jamie Muir Wood, Daniel Selmi, Jonathan Moss, Guy Tritton It's given me data on over 400 firms and almost 600 lawyers.. old school big data!

33

1 Comment

Will free dataflows between the UK and EU endure? I was honoured to give oral evidence to the House of Lords' European Affairs committee for its inquiry into UK-EU data adequacy. Key points from me were: - The consequences of losing adequacy are more serious than ever, given how courts and data protection authorities are interpreting GDPR's rules on cross-border data transfers. - UK law enforcement/intelligence gathering practices are, in my view, a bigger risk to adequacy than the UK's proposed domestic amendments to GDPR: although the Commission is prepared to overlook issues with these practices, the CJEU will not. - The UK might be excited about alternative multilateral 'networks' of cross-border transfers, like the Cross Border Privacy Rules. But they all have a very long way to go before they can challenge the GDPR's 'Brussels effect' + it is unclear how much the UK economy will benefit in practice, given how many firms will need to stick with GDPR standards in any event. Video below! 👇 https://lnkd.in/eyzXWjKz

42

3 Comments

An interesting blog from my colleague Edward Elwyn Jones about the preliminary findings of Jonathan Fisher KC’s review of disclosure in criminal cases, in particular his observation of the need for better training and resources for those on the front line dealing with disclosure issues - it is critical to a fair and efficient process . As Mr Fisher KC notes “Many of those with whom I have spoken have referred to a poor culture around disclosure and the insufficient value placed upon its work in different parts of the system.” #dueprocess #fairtrial #criminaljuatice

11

🤖 🖥️ This week our latest Data Download webinar hosted by Niall O'Brien and myself spoke about the latest EDPB Opinion which in effect threw cold water over Meta’s “consent or pay” model for accessing their platforms where you either consent to behavioural advertising or pay for access without being targeted. 🏙️ I referred to the Opinion like a massive skyscraper in a city landscape that draws your attention and casts a shadow over the view. Mainly because the Opinion only applies to large online platforms in Europe. However it will have repurcussions for online operators like retailers who rely on social media platforms for targeted advertising. For those who rely on social media for marketing and sit in privacy compliance, it’s worth engaging with your digital marketing teams now to talk about: ✅ consent practices in the business - what consents do you get now what do you actually do with the consent - eg do you rely on that for targeted social marketing 🍪 cookie banners and what do you rely on in practice for marketing engagement 📉 what impact will there be if you rely on behavioural advertising and instead have to rely on contextual advertising. The Opinion doesn’t apply in the UK with the ICO considering their position in a call for views. Watch this space for more in this ever changing landscape… …. and gives me a chance to post a pic from my favourite city in the world. Addleshaw Goddard

13

Great to see StructureFlow featured in The Times and included in the discussion on how AI is changing the legal sector. As Katie Prescott writes, "a generation of smart lawyers has emerged questioning the status quo. Tim Follett, 40, a former Slaughter and May lawyer, founded StructureFlow, which raised $6 million in May. He said his cohort looked around and wanted to fix “archaic ways of working, things that hadn’t changed for decades, lots of manual and repetitive work, late nights and high stress”. The StructureFlow team is doing incredible work providing clarity to complexity with technology and making a difference to people and businesses. AI is changing every industry, and the legal sector is no exception. Check out the full article below. #AI #LawTech #Innovation #StructureFlow #SeriesAFunding #LegalIndustry #TechTransformation #Resonance

2

1 Comment