Client Alert: Morrisons Data Breach Litigation Succeeds| Cordery

http://www.corderycompliance.com/client-alert-uk-data-protection-bill/</a>.</p> <p><strong>What does this tell us about civil actions under GDPR?</strong></p> <p>It is wrong to suggest that this is the first group action to be brought in the UK for data protection breaches. We have commented before about the rising number of data protection civil actions, for example in our summaries of the <u>Google v. Vidal-Hall</u> case here <a href="http://www.corderycompliance.com/vidal-hall-data-protection-class-action-appeal-settled/">http://www.corderycompliance.com/vidal-hall-data-protection-class-action-appeal-settled/</a>.</p> <p>The solicitors who are handling the Morrisons case are currently advertising for more employees or former employees to join the litigation. In addition, they seem to be planning a number of similar actions including against a bank and an insurer. More litigation against other companies is likely.</p> <p>Additionally, we are currently waiting on judgment from the ECJ in a class action brought by Max Schrems against Facebook. An opinion from the court’s Advocate General on the 14 November suggests restricting the ability of claimants to bring proceedings on behalf of claimants across Europe, although that opinion is not binding on the court. The Schrems action has approximately 25,000 claimants. Final judgment in this case is expected by the beginning of 2018.</p> <p>The issue of compensation is also important under GDPR. Under GDPR, as a general principle, any person who has suffered “<em>material or non-material damage</em>” due to an infringement of GDPR has a right to compensation from the data controller or processor concerned for the damage suffered. There are some defences, as set out in GDPR. Our FAQs and video on the GDPR can be found here <a href="http://www.bit.ly/gdprfaq">www.bit.ly/gdprfaq</a>.</p> <p><strong>What should businesses do now?</strong></p> <p>For most organisations continuing their GDPR planning is a good way of reducing the risk of civil actions like this one. In particular organisations will want to consider:</p> <ol> <li>Taking a close look at security measures and ensuring that access rights etc. are policed;</li> <li>Putting in place appropriate policies and procedures to make sure that data protection principles like data security and data minimization are properly understood;</li> <li>Doing a DPIA for new processes – for example in this case would a DPIA have indicated that the request for data from the auditors was too wide?</li> <li>Making sure that employees in trusted roles are reliable and that their access rights are reviewed if there are concerns – implement monitoring of employees as the business thinks necessary, in compliance with data protection and employee monitoring rules and guidance (see our article here about employee monitoring, data protection and human rights here <a href="http://www.corderycompliance.com/?s=barbelescu">http://www.corderycompliance.com/?s=barbelescu</a>);</li> <li>Putting in place a data breach notification procedure, including detection and response capabilities;</li> <li>Training staff on all of the above; and,</li> <li>Setting up and undertaking regular compliance audits or reviews in order to identify and rectify issues.</li> </ol> <p>There is more information about this and other data protection topics in Cordery’s GDPR Navigator subscription service. GDPR Navigator includes short films, straightforward guidance, checklists and regular conference calls to help you comply. More details are at <a href="http://www.bit.ly/gdprnav">www.bit.ly/gdprnav</a>.</p> <p>You can read a transcript of the case here <a href="http://www.bit.ly/2zLWG2l">www.bit.ly/2zLWG2l</a>.</p> <p>For more information please contact Jonathan Armstrong or André Bywater who are lawyers with Cordery in London where their focus is on compliance issues.</p> <table style="width: 728.01px;"> <tbody> <tr> <td style="width: 328px;"><a href="http://www.corderycompliance.com/our-people/jonathan-armstrong/">Jonathan Armstrong</a>, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH</td> <td style="width: 37px;"></td> <td style="width: 349.01px;"><a href="http://www.corderycompliance.com/our-people/andre-bywater/">André Bywater</a>, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH</td> </tr> <tr> <td style="width: 328px;">Office: +44 (0)207 075 1784</td> <td style="width: 37px;"></td> <td style="width: 349.01px;">Office: +44 (0)207 075 1785</td> </tr> <tr> <td style="width: 328px;">Jonathan.armstrong@corderycompliance.com</td> <td style="width: 37px;"></td> <td style="width: 349.01px;">Andre.bywater@corderycompliance.com</td> </tr> <tr> <td style="width: 328px;"><img class="alignnone" src="http://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2015/03/JA-profile-page-website.jpg" /></td> <td style="width: 37px;"></td> <td style="width: 349.01px;"> <a href="https://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg"><img data-attachment-id="477" data-permalink="https://www.corderycompliance.com/doing-business-in-new-markets/andre-bywater-2/" data-orig-file="https://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg?fit=220%2C150&ssl=1" data-orig-size="220,150" data-comments-opened="0" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":""}" data-image-title="" data-image-description="" data-medium-file="https://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg?fit=220%2C150&ssl=1" data-large-file="https://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg?fit=220%2C150&ssl=1" class="size-full wp-image-477 alignnone" src="https://i1.wp.com/www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg?resize=220%2C150" alt="" width="220" height="150" data-recalc-dims="1" /></a></td> </tr> </tbody> </table> <p> </p> <p> </p> <p> </p> <p><a href="http://www.corderycompliance.com/wp-content/uploads/2014/04/andre-bywater.jpg"> </a></p> </div><footer class="entry-footer"><p class="entry-meta"><span class="entry-categories">Filed Under: <a href="https://www.corderycompliance.com/category/brand-retail-fashion/" rel="category tag">Brand, Retail & Fashion</a>, <a href="https://www.corderycompliance.com/category/cyber-security/" rel="category tag">Cyber Security</a>, <a href="https://www.corderycompliance.com/category/data-protection-privacy/" rel="category tag">Data Protection & Privacy</a>, <a href="https://www.corderycompliance.com/category/product-liability-recall/" rel="category tag">Product Liability & Recall</a>, <a href="https://www.corderycompliance.com/category/safe-harbor-privacy-shield/" rel="category tag">Safe Harbor / Privacy Shield</a></span> </p></footer></article></main><aside class="sidebar sidebar-primary widget-area" role="complementary" aria-label="Primary Sidebar" itemscope itemtype="https://schema.org/WPSideBar"><section id="categories-3" class="widget widget_categories"><div class="widget-wrap"><h4 class="widget-title widgettitle">Categories</h4> <ul> <li class="cat-item cat-item-34"><a href="https://www.corderycompliance.com/category/archived/">Archived</a> </li> <li class="cat-item cat-item-18"><a href="https://www.corderycompliance.com/category/blog/">Blog</a> </li> <li class="cat-item cat-item-23"><a href="https://www.corderycompliance.com/category/brand-retail-fashion/">Brand, Retail & Fashion</a> </li> <li class="cat-item cat-item-32"><a href="https://www.corderycompliance.com/category/brexit/">BREXIT</a> </li> <li class="cat-item cat-item-1"><a href="https://www.corderycompliance.com/category/bribery-corruption/">Bribery & Corruption</a> </li> <li class="cat-item cat-item-33"><a href="https://www.corderycompliance.com/category/compliance-faqs/">Compliance FAQs</a> </li> <li class="cat-item cat-item-42"><a href="https://www.corderycompliance.com/category/covid19/">COVID19</a> </li> <li class="cat-item cat-item-10"><a href="https://www.corderycompliance.com/category/crisis-management/">Crisis Management</a> </li> <li class="cat-item cat-item-11"><a href="https://www.corderycompliance.com/category/cyber-security/">Cyber Security</a> </li> <li class="cat-item cat-item-12"><a href="https://www.corderycompliance.com/category/data-protection-privacy/">Data Protection & Privacy</a> </li> <li class="cat-item cat-item-13"><a href="https://www.corderycompliance.com/category/ecommerce/">ecommerce</a> </li> <li class="cat-item cat-item-19"><a href="https://www.corderycompliance.com/category/events/">Events</a> </li> <li class="cat-item cat-item-29"><a href="https://www.corderycompliance.com/category/financial-services/">Financial Services</a> </li> <li class="cat-item cat-item-27"><a href="https://www.corderycompliance.com/category/healthcare/">Healthcare</a> </li> <li class="cat-item cat-item-25"><a href="https://www.corderycompliance.com/category/internal-investigations/">Investigations</a> </li> <li class="cat-item cat-item-31"><a href="https://www.corderycompliance.com/category/modern-slavery-supply-chain-management/">Modern Slavery and Supply Chain Management</a> </li> <li class="cat-item cat-item-16"><a href="https://www.corderycompliance.com/category/product-liability-recall/">Product Liability & Recall</a> </li> <li class="cat-item cat-item-30"><a href="https://www.corderycompliance.com/category/safe-harbor-privacy-shield/">Safe Harbor / Privacy Shield</a> </li> <li class="cat-item cat-item-24"><a href="https://www.corderycompliance.com/category/sanctions/">Sanctions</a> </li> <li class="cat-item cat-item-28"><a href="https://www.corderycompliance.com/category/social-media/">Social Media</a> </li> <li class="cat-item cat-item-17"><a href="https://www.corderycompliance.com/category/techlaw10/">Techlaw10</a> </li> </ul> </div></section> <section id="recent-posts-2" class="widget widget_recent_entries"><div class="widget-wrap"> <h4 class="widget-title widgettitle">Latest Posts</h4> <ul> <li> <a href="https://www.corderycompliance.com/21acei/">Client Alert: 21st Annual Compliance and Ethics Institute</a> </li> <li> <a href="https://www.corderycompliance.com/ico-fines-dp/">ICO Fines Clearview £7.5 Million for Data Protection Infringements</a> </li> <li> <a href="https://www.corderycompliance.com/eu-nis2-rules/">EU NIS II Proposed Rules Agreed By EU Countries & EU Parliament</a> </li> <li> <a href="https://www.corderycompliance.com/ec100-ukraine-invasion/">Everything Compliance – Episode 100 – The Ukraine Invasion Edition</a> </li> <li> <a href="https://www.corderycompliance.com/eu-dpb-gdpr-fines/">European Data Protection Board Issues Draft EU GDPR Fines Amount Calculation Guidance</a> </li> </ul> </div></section> <section id="text-7" class="widget widget_text"><div class="widget-wrap"> <div class="textwidget"><a class="twitter-timeline" href="https://twitter.com/CorderyUK" data-widget-id="478523385761107968">Tweets by @CorderyUK</a> <script type="text/plain" data-cli-class="cli-blocker-script" data-cli-label="Facebook Pixel Code" data-cli-script-type="targeting-cookies" data-cli-block="true" data-cli-element-position="body">!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+"://platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs");</script></div> </div></section> </aside></div></div><div class="contact"><div class="wrap"><div class="contact-inner"><p>Contact a Cordery Specialist <span>+44(0)207 118 2700</span> <span class="light">|</span> <a href="https://www.corderycompliance.com/contact-us/">Contact Us</a></p></div></div></div><footer class="site-footer" itemscope itemtype="https://schema.org/WPFooter"><div class="wrap"></div></footer><div class="footer-widgets"><div class="wrap"><div class="widget-area footer-widgets-1 footer-widget-area"><section id="text-5" class="widget widget_text"><div class="widget-wrap"> <div class="textwidget"></div> </div></section> <section id="nav_menu-17" class="widget widget_nav_menu"><div class="widget-wrap"><div class="menu-footer-menu-container"><ul id="menu-footer-menu" class="menu"><li id="menu-item-175" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-175"><a href="https://www.corderycompliance.com/terms-and-conditions/" itemprop="url">Terms and Conditions</a></li> <li id="menu-item-176" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-176"><a href="https://www.corderycompliance.com/privacy-policy/" itemprop="url">Privacy Policy</a></li> <li id="menu-item-173" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-173"><a href="https://www.corderycompliance.com/complaints-policy/" itemprop="url">Complaints Policy</a></li> <li id="menu-item-174" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-174"><a href="https://www.corderycompliance.com/equality-and-diversity-policy/" itemprop="url">Equality and Diversity Policy</a></li> </ul></div></div></section> </div><div class="widget-area footer-widgets-2 footer-widget-area"><section id="text-2" class="widget widget_text"><div class="widget-wrap"> <div class="textwidget"><p>Cordery is a trading name of Cordery Compliance Limited. Authorised and regulated by the Solicitors Regulation Authority.<br /> SRA number 608187. Company number 07931532 registered in England and Wales. VAT number: 730859520<br /> Registered office: Lexis House, 30 Farringdon Street, London, EC4A 4HH, United Kingdom</p> <p>Cordery Compliance Limited trading as Cordery provides some products and services which are not regulated by the Solicitors Regulation Authority; we will clearly state this to you if this is the case.</p> <p>We use the word “partner” to refer to a shareowner or director of the company, or an employee or consultant who is a lawyer with equivalent standing and qualifications.</p> <p>Cordery is a registered trademark of RELX (UK) Limited, used under license. The Knowledge Burst logo is a registered trademark of Reed Elsevier Properties Inc., used under license.</p> <p>Copyright © 2021 Cordery. All rights reserved.</p> </div> </div></section> <section id="custom_html-2" class="widget_text widget widget_custom_html"><div class="widget_text widget-wrap"><div class="textwidget custom-html-widget"> <div style="max-width:275px;max-height:163px;"><div style="position: relative;padding-bottom: 59.1%;height: auto;overflow: hidden;"><iframe frameborder="0" scrolling="no" allowtransparency="true" src="https://cdn.yoshki.com/iframe/55845r.html" style="border:0px; margin:0px; padding:0px; backgroundColor:transparent; top:0px; left:0px; width:100%; height:100%; position: absolute;">