Data Protection Commissioner publishes Annual Report for 2018
The Data Protection Commissioner (DPC) has published her final Annual Report covering the period of 1 January 2018 to 24 May 2018. From 25 May 2018, the office of the Data Protection Commissioner ceased, and the new Data Protection Commission was created under the Data Protection Act 2018. The Report includes some interesting case-studies, such as the prosecution of a company for sending marketing emails to work email addresses. It also discusses litigation to which the DPC was a party to this year, including the case of Nowak v DPC, where the High Court followed the CJEU's decision in Y.S. v. Minister voor Immigratie & Ors, finding that a controller exercises some discretion in regard to how to respond to an access request. Although these cases pre-date the GDPR, they remain of interest in the post-GDPR world. This briefing note looks at some of the highlights of the Report.
Date published: 11 December 2018