Data protection

New and updated

• Type:

  Policies and procedures

  Use of CCTV policy

  Updated to include information on López Ribalda and others v Spain, concerning the installation of hidden cameras to monitor employee thefts.

• Type:

  Employment law cases

  Vicarious liability: Employer liable for data breaches by employee with "grudge"

  In WM Morrison Supermarkets plc v Various claimants, the Court of Appeal held that the employer is vicariously liable for the criminal actions of an employee who disclosed the personal data of his fellow employees online.

• Type:

  Tasks

  Draft a privacy notice for a worker under the UK GDPR

• Type:

  Editor's choice

  General Data Protection Regulation: resource round-up

  The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 place strict duties on employers in relation to the processing of personal data.

• Type:

  Letters and forms

  Data protection impact assessment form

  A model form to conduct a data protection impact assessment for potentially high-risk data processing. The form, which complies with the General Data Protection Regulation (GDPR), uses the example of an impact assessment when an employer is proposing to introduce CCTV monitoring in a particular location.

• Type:

  Letters and forms

  Form for individual to provide explicit consent to processing of personal data

  A model form to seek consent from an individual to process their personal data for a specific purpose, where no other legal basis for the processing applies. The form complies with the General Data Protection Regulation (GDPR).

• Type:

  Letters and forms

  Form for individual to request erasure of personal data

  A model form to allow an individual to request the deletion of data about them, in compliance with the General Data Protection Regulation (GDPR).

• Type:

  Letters and forms

  Letter informing individual that personal data has been erased

  A model letter to inform an individual that data about them has been deleted, in compliance with the General Data Protection Regulation (GDPR).

• Type:

  Letters and forms

  Letter extending time to respond to request for erasure of personal data

  A model letter to extend the time limit for responding to an individual's request for the erasure of data about them. The letter complies with the General Data Protection Regulation (GDPR).

• Type:

  Letters and forms

  Letter extending time to respond to request for rectification of incorrect or incomplete personal data

  A model letter to extend the time limit for responding to an individual's request for the rectification of incorrect or incomplete data about them. The letter complies with the General Data Protection Regulation (GDPR).