Year: 2024

Advanced Certificate in GDPR Practice: Revised Syllabus and Assessment Format 

Act Now is pleased to announce a revised syllabus and assessment format for the Advanced Certificate in GDPR Practice. 

Since its launch in 2020, this innovative course has attracted DPOs from across the public and private sectors. Feedback has been consistently positive with many participants commenting on how the course has given them the confidence and skills to be able to dissect complex data protection scenarios and give clear and practical compliance advice. 

Our Commitment 

Act Now Training is committed to promoting the recognition of Information Governance as a profession. We believe that anyone in the profession can gain a solid foundation in interpreting and applying the law as part of their skillset. We are committed to not only teaching with a non-complex jargon free philosophy, but also ensuring our delegates are supported in building these skills for themselves and their organisations. 

Our winning the IRMS Supplier of Year award (3 times in 4 years), as well as our involvement in the success of the DP and IG Apprenticeship, demonstrates our dedication to nurturing new entrants into the IG profession through quality training.  

Our Course Development Journey  

As part of our ongoing development as a leading provider of education and training in the Information Governance field, we have continued to develop the way in which we deliver and assess our courses. Having collaborated with leading global educational experts, as well as specialists in progressive pedagogy and curriculum design, we have redesigned and enhanced all our GDPR certificate courses including the Practitioner Certificate and Intermediate Certificate.  

We have gone back to basics to analyse all the skills and competencies required by a DPO. These have then been baked into our courses, taking care to ensure that the case studies and exercises give delegates the best opportunity to practice and showcase these skills. We believe that these refinements will enhance the delegate experience and help us to be at the forefront of innovation and experiential learning.  

Our assessment design has been revamped across all of our certificate courses. We are particularly proud of our unique new assessment format which takes account of advances in technology and ensures our assessments are robust, rigorous and appropriate to the skills and knowledge assessment that we are seeking. 

Revised Syllabus 

Act Now consistently updates its courses to ensure it is always current and at the cutting edge of IG issues. In 2019 we launched an AI and Machine Learning course as well as a course on Data Ethics. At the time these were novel concepts in the IG world.  

Last year, we updated the Advanced Certificate and now we have done a full refresh. Further advances in technology, especially in AI, has led us to revise the syllabus to ensure participants are engaging with the most up to date data protection issues and ICO/Tribunal decisions to inform their day to day work.  

In each masterclass participants will first analyse recent Tribunal decisions and/or ICO enforcement action to further their understanding of the complexities and nuances of the UK GDPR. This will be followed by working through a multi-faceted case study in which they will consider and apply a number of aspects of the UK GDPR simultaneously. By not simply covering single issues in a linear fashion, this course will provide a holistic view of GDPR implementation. Participants will be challenged to think laterally allowing them to achieve a much higher level of knowledge depth and understanding. 

New Assessment Format 

Based on extensive feedback from delegates over our suite of certificate programmes, we learned that delegates would prefer not to have to write extensive reports and would prefer to have the opportunity to showcase their critical thinking and communication skills. 

The new assessment consists of two parts. The first part requires participants to submit a personal development plan about how their learning from the course will inform and improve their practice as a data protection practitioner. The second part requires them to draft an executive summary setting out the issues and recommendations in relation to the fictional case study discussed in Masterclass 4. This summary will then be presented by participants in an oral examination, known as a Viva.  

We have conducted extensive research with previous delegates believe that the changes made to the Advanced Certificate in GDPR Practice will substantially improve our provision. Our goal has been to adapt and elevate all our programmes to meet the growing needs of IG officers, whilst ensuring that as an organisation we are meeting global educational standards including those within the DfE, Ofqual, and Ofsted here in the UK.  

We have a special introductory price of £2,795 plus VAT for this four- day course. In 2025 the price will be £2995 plus vat. There are just three places left on the course starting on 25th September 2024.  


Enjoy reading our blog? Help us reach 10,000 subscribers by subscribing today!

How Generative AI’s Data Appetite is Fuelling Privacy Battles

Like the monster plant in Little Shop of Horrors, Generative AI has an insatiable appetite; for data though rather than food. Generative AI applications, like ChatGPT and Midjourney, need a constant supply of data to train (and improve) their output algorithms. In the early days of AI development, this data came from public sources especially the internet. However, this “data scraping” was not without legal obstacles.

Where personal data is used to train AI models, of course GDPR applies. The transparency provisions and the requirement for a legal basis are of particular importance. In 2022, the Information Commissioner’s Office (ICO) issued a fine of more than £7.5 million to Clearview AI for GDPR breaches in the way it compiled its online database containing 20 billion images of people’s faces and data scraped from the internet.  The company did manage to successfully appealthe fine but the ICO, and other GDPR regulators in the EU, have issued clear warnings to AI companies to ensure they comply with GDPR.

To satisfy Generative AI’s demand for more data, AI developers have been striking deals with tech companies for access to the latter’s user data. This includes data generated by users whilst using popular websites and apps. In February it was reported that Tumblr and WordPress.com are preparing to sell user data to Midjourney and OpenAI. And (surprise surprise) Meta and Alexa have exploited user data, in the past, to train their AI models.

Elon Musk’s X (formerly Twitter) came under fire recently after it started collecting and using its users’ data, including their posts, to train X’s Grok AI model. This was allegedly done without notifying X users or asking for their consent. In June, the Irish Data Protection Commission (DPC), X’s Lead Supervisory Authority, made an urgent application under Section 134 of the Irish Data Protection Act 2018. This allows the DPC, where it considers there is an urgent need to act to protect the rights and freedoms of data subjects, to request the High Court for an order requiring the data controller to suspend, restrict or prohibit the processing of personal data.

This was the first time that any Lead Supervisory Authority has taken such action, and the first time that the DPC has sought to utilise its powers under Section 134. The DPC said the application was made to protect the rights and freedoms of X’s EU/EEA users, and came after extensive engagement between the DPC and X regarding its AI model training.  Last week, the DPC announced that X had agreed to suspend its processing of the personal data contained in the public posts of X’s EU/EEA users which it processed between 7 May 2024 and 1 August 2024, for the purpose of training its AI model.   

But this agreement is not the end of X’s privacy woes. Noyb, a privacy advocacy group headed by Max Schrems, has filed nine more GDPR complaints with regulators across Europe alleging that X appears to have breached a number of other GDPR provisions including the GDPR principles and the transparency rules. Several other major tech firms have also faced regulatory setbacks in Europe over privacy issues raised by their AI plans. In June Meta announced that it was pausing its plan to process user posts and images on Facebook and Instagram to train its AI tools after a number of GDPR complaints. LinkedIn was also the subject of a similar complaint by consumer organisations.

AI is a priority for the ICO. It’s existing guidance on AI explains how to apply the concepts of data protection law when developing or deploying AI and the AI toolkit helps organisations identify and mitigate risks during the AI lifecycle. The ICO consultation series on generative AI and data protection closed in June.

The training of Generative AI does not just pose GDPR compliance issues. In December last year, the New York Times announced it was suing OpenAI and Microsoft for copyright infringement. The lawsuit claimed the “unlawful use” of the paper’s “copyrighted news articles, in-depth investigations, opinion pieces, reviews, how-to guides, and more” to create AI products “threatens The Times’s ability to provide that service”.

Please subscribe to this blog and help us to get to 10,000 subscribers.

Join our Artificial Intelligence and Machine Learning, How to Implement Good Information Governance workshop for hands-on insights, key resource awareness, and best practices, ensuring you’re ready to navigate AI complexities fairly and lawfully.

GDPR International Transfers in the High Court

Chapter 5 of the UK GDPR mirrors the international transfer arrangements of the EU GDPR. There is a general prohibition on organisations transferring personal data to a country outside the UK, unless they ensure that data subjects’ rights are protected. This means that, if there is no adequacy decision in respect of the receiving country, one of the safeguards set out in Article 46 must be built into the arrangement. These include standard contractual clauses and binding corporate rules.

In May last year the largest ever GDPR fine of €1.2bn was issued by Ireland’s Data Protection Commission to Facebook’s owner, Meta Ireland. The DPC ruled that Meta infringed Article 46 of the EU GDPR in the way it transferred personal data of its users from Europe to the USA.

In the absence of an adequacy decision or appropriate safeguards pursuant to Article 46, a transfer of personal data to a third country or an international organisation can still take place if one of the conditions in Article 49 are satisfied. These conditions include, amongst others, where the data subject has explicitly consented to the proposed transfer and where the transfer is necessary for the establishment, exercise or defence of legal claims.

A recent judgment by the English High Court judgement addressed a case involving JSC Commercial Bank Privatbank (JSC), which sought the court’s permission to disclose two schedules from its particulars of claim in English legal proceedings to the Ukrainian Bureau of Economic Security (BES). These schedules contained personal data about a co-founder of JSC, who was a defendant in the English proceedings and was accused of embezzlement. A Ukrainian court had ordered the disclosure of these schedules to BES as part of its investigation into potential fraud committed against JSC by another co-founder and defendant in the same English proceedings.

JSC applied for approval from the English High Court to disclose the two schedules. This application was necessary because the defendants in the English proceedings opposed the disclosure. Among other considerations, the court had to determine whether one of the derogations under Article 49 of the GDPR applied.

The relevant derogations in this case were Article 49(1)(d) (“the transfer is necessary for important reasons of public interest”) and Article 49(1)(e) (“the transfer is necessary for the establishment, exercise, or defence of legal claims”). The defendants argued that neither derogation was applicable.

The Judge ruled that the Article 49(1)(e) derogation was applicable, as the Ukrainian proceedings constituted a relevant “legal claim,” and the transfer of data was a necessary, targeted, and proportionate means of establishing or exercising that claim.

In reaching his conclusion, it is notable that the judge gave significant weight to the ICO’s guidance on international transfers. The guidance states that Article 49(1)(e) applies if (1) “you or another person involved in the legal claim have received a request for information from an overseas regulator with a view to it potentially taking formal action,” and (2) even if the transfer is not “absolutely essential,” it is a “targeted and proportionate way of achieving a specific purpose” that could not reasonably be achieved by other means.

Given the conclusion on Article 49(1)(e) and the urgency with which the case was argued and decided, the Judge did not make a determination on the applicability of the Article 49(1)(d) derogation.

Robert Bateman will be discussing this and related developments  in his forthcoming International Transfers workshop.

Please subscribe to this blog and help us to get to 10,000 subscribers.

£6m Potential Fine for NHS IT Supplier

The Information Commissioner’s Office (ICO) has announced today that it has issued a GDPR Notice of Intent to an NHS IT supplier, Advanced Computer Software Group Ltd (Advanced), following a significant data breach in 2022.

The ICO’s preliminary decision is to impose a £6.09 million fine on Advanced.
This comes after its findings that the company failed to adequately protect the personal data of 82,946 individuals in breach of Article 32 of the UK GDPR.
As a key IT and software provider for the NHS and other healthcare organisations across the country, Advanced often holds role of Data Processor for many of its clients.

The breach in question occurred during a ransomware attack in August 2022.
Hackers exploited a vulnerability through a customer account that lacked multi-factor authentication, gaining access to multiple health and care systems operated by Advanced. The compromised data included phone numbers, medical records, and even details on how to access the homes of 890 individuals receiving at-home care.

The cyber-attack caused widespread disruption, with NHS 111 services impacted and some GPs resorting to pen and paper as electronic systems went offline. At the time, doctors warned that it could take months to clear the backlog of paperwork created by the incident.

This Notice of Intent serves as a reminder that Data Processors, like Advanced, have a duty to implement robust technical and organisational measures to safeguard personal data. This includes regularly assessing risks, applying multi-factor authentication, and keeping systems updated with the latest security patches. Data Processors cannot shift the responsibility to Data Controllers; their GDPR security obligations are independent of those of the Data Controller.

It is important to note that a Notice of Intent is not a fine — yet. It is a legal precursor, outlining the ICO’s provisional stance. Advanced now has the opportunity to make representations that could influence the final decision. This process is not without precedent: in 2018, British Airways faced a Notice of Intent for a £183 million fine due to a cybersecurity breach, but the actual fine  issued in 2020 was reduced to £20 million. Similarly, Marriott International Inc.’s fine dropped from £99 million to £18.4 million after a Notice of Intent in 2020.

It will be interesting to see how the ICO’s final decision on Advanced compares with its approach in other cases, such as the Police Service of Northern Ireland (PSNI) incident. The PSNI was issued a Notice of Intent for £750,000 earlier this year after mistakenly releasing sensitive information about every police officer and staff member in response to a Freedom of Information request.

The Act Now Advanced Certificate in GDPR Practice is designed for experienced Data Protection Officers seeking to develop their skills and confidence to tackle the most challenging data protection projects within their organisation.

Please subscribe to this blog and help us to get to 10,000 subscribers. 

Act Now Strengthens its Cyber Security Team

The global chaos, caused by the defective software update by CrowdStrike, alongside recent high profile cyber-attacks has put cyber security firmly in the spotlight.  Act Now Training is pleased to announce that leading cyber security expert, Andy Compton,has joined its team of associates.

Andy is a popular Cyber Security consultant with many years’ experience and a proven track record in security, risk management, audit and implementation of international security standards. He has significant experience across retail, technology and private member organisations and has on led high profile ISO 27001 projects for Telecommunication providers. Andy conducted one of the UKs first gap analysis against NCSC standards for Telecommunication providers.

Andy is a popular choice for information and cyber security risk assessment projects due to his strong understanding of people, process, technology controls and an ability to work with key stakeholders across public and private organisations. He has an excellent blend of commercial and technical skills and is particularly well suited to working with business leaders, identifying and implementing governance frameworks and evolving security cultures through training and awareness activities. The repeated demand for Andy has been the result of demonstrable technical excellence, critical thinking and an ability to align with individuals at every level.

Andy joins Olu Odeniyi and Steven Cockroft as part of our teams of associates specialising in cyber security. He will be developing and delivering innovative cyber certifications and courses as well as delivering in house training.

Ibrahim Hasan, director of Act Now Training, said:

“I am delighted that Andy is joining our team. His cyber security expertise as well as his impressive list of clients will enable us to offer more cyber security courses to our clients as well as help deliver our expanding training programmes in the UAE and Saudi Arabia.”

We have two workshops coming up (How to Increase Cyber Security in your Organisation and Cyber Security for DPOs) which are ideal for organisations who wish to up skill their employees about cyber security. See also our Managing Personal Data Breaches Workshop


Electoral Commission Reprimanded for Data Breach Affecting 40 Million People

Last week the Information Commissioner’s Office(ICO) issue a GDPR reprimand to the Electoral Commission.

In August 2023 the Electoral Commission revealed, in a public notice issued under Article 33 and 34 of the UK GDPR, that it had been the victim of a “complex cyber-attack” potentially affecting millions of voters. It had discovered in October 2022 that unspecified “hostile actors” had managed to gain access to copies of the electoral registers, from August 2021. Hackers also broke into its emails and “control systems”.

The Commission said the information it held at the time of the attack included the names and addresses of people in the UK who registered to vote between 2014 and 2022. This included those who opted to keep their details off the open register, which is not accessible to the public but can be purchased. The data accessed also included the names, but not the addresses, of overseas voters.  The Commission further explained that it was difficult to predict exactly how many people could be affected, but it estimated the register for each year contains the details of around 40 million people. 

The ICO reprimand reveals that the Commission did not take basic security steps to ensure the protection of personal data. The ICO said:

“If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened.”

Many have criticised the ICO for issuing a “slap on the wrist” rather than a fine for an entirely preventable cyberattack that exposed the personal data of 40 million UK voters. But the reprimand is in line with the ICO’s approach to public sector enforcement which has been the subject of a two year trial since June 2022. 
Explaining the approach at the time, the Information Commissioner wrote:

“I am not convinced large fines on their own are as effective a deterrent within the public sector. They do not impact shareholders or individual directors in the same way as they do in the private sector but come directly from the budget for the provision of services. The impact of a public sector fine is also often visited upon the victims of the breach, in the form of reduced budgets for vital services, not the perpetrators. In effect, people affected by a breach get punished twice.”

In June the ICO announced that it will now review the two-year trial before making a decision on the public sector approach in the Autumn.

The Act Now Advanced Certificate in GDPR Practice is designed for experienced Data Protection Officers seeking to develop their skills and confidence to tackle the most challenging data protection projects within their organisation.

Please subscribe to this blog and help us to get to 10,000 subscribers. 

New Dates for KSA Data Protection Officer Certificate Course

Act Now is pleased to announce new public dates for the KSA Data Protection Officer Certificate. This is a unique course curated by data protection experts designed to train individuals to fulfil the role of data protection officer under Saudi Arabia’s new Data Protection law. The new law becomes fully enforceable on 14th September 2024.

The Personal Data Protection Law (PDPL) regulates the collection, handling, disclosure and use of personal data. Like many data protection laws around the world, including the UK GDPR, the PDPL contains a requirement for some Data Controllers to appoint a Data Protection Officer (DPO). On 8th July 2024 the Saudi Arabian Authority for Data and Artificial Intelligence (SDAIA), which will initially enforce the new law, published draft rules for the appointment of a DPO under the PDPL.

Article 5 of the draft rules states the following Data Controllers need to appoint a DPO:

  • A Public Entity that provides services involving processing of personal data on a large scale
  • A Controller whose core activities are based on processing operations that, by their nature, require regular and systematic monitoring of data subjects
  • A Controller whose core activities are based on processing of sensitive personal data.

Whilst there is no requirement for others to appoint a DPO, in our view, it is good practice to do so as it will help drive compliance forward especially in the initial phases of implementing the new law. The draft rules places great importance on training for and by the DPO. Article 9(4) states:

“The Controller shall work on training and developing DPO’s in the fields of Personal Data protection and support them in obtaining professional certificates in this field to ensure raising their efficiency.”

This has to be read alongside Article 4 and Article 8 (above). The latter states that one of the roles of the DPO is:

“Participating in awareness activities, training and transfer of knowledge to Controller personnel regarding Personal Data protection and compliance with provisions of the Law, Regulations and ethics of data handling.”

Organisations doing business in the Middle East need to carefully consider the impact of the new rules on. Thought must be given to the appointment and training of a suitably qualified DPO. Through our KSA Data Protection Officer Certificate, Act Now Training offers comprehensive and cost-effective training for the DPO enabling them to ready to implement the new law.

This course has been offered as in in house course previously with a requirement of a minimum of 8 delegates. Our new public courses  will allow organisations  to train any number of employees making it easier for them to start their compliance journey.

The EU AI Act Comes into Force Today

The EU AI Act comes into force today although not all the provisions will become enforceable straight away. 

The Act sets out comprehensive rules for AI applications, including a risk-based system to address potential threats to health and safety, and human rights. It will ban certain AI applications that pose an “unacceptable risk,” including real-time and remote biometric identification systems such as facial recognition. Additionally, it will impose strict obligations on those considered “high risk,” encompassing AI used in
EU-regulated product safety categories, for example, cars and medical devices.
These obligations include adherence to data governance standards, transparency rules, and the incorporation of human oversight mechanisms. 

Detailed guides have been produced by lawyers Stephenson Harwood and Bird and Bird.

Here are the key dates for your diary:

  • August 1st, 2024: The AI Act enters into force
  • February 2025: Chapters I (general provisions) & II (prohibited AI systems) will apply
  • August 2025: Chapter III Section 4 (notifying authorities), Chapter V (general purpose AI models), Chapter VII (governance), Chapter XII (confidentiality and penalties), and Article 78 (confidentiality) will apply, except for Article 101 (fines for General Purpose AI providers)
  • August 2026: the whole AI Act applies, except for Article 6(1) & corresponding obligations (one of the categories of high-risk AI systems)
  • August 2027 – Article 6(1) & corresponding obligations apply.

In the UK, despite media reports, the King’s Speech did not include a bill to regulate AI. The King said that the government would “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. Expect a government consultation to be announced soon.

Our AI Act workshop will help you understand the new law in detail and its interaction with the UK’s objectives and strategy for AI regulation.

ICO Issues Two FOI Enforcement Notices

Under the Freedom of Information Act 2000, an Enforcement Notice may be served where the Information Commissioner is satisfied that a public authority has failed to comply with any of the requirements of Part I of the Act. If a public authority fails to comply with a Notice, the Commissioner may commence court proceedings under section 54 of the Act, which may be dealt with as contempt of Court.

The ICO recently served an Enforcement Notice on both Devon and Cornwall Police and Barking, Havering and Redbridge Hospitals NHS Trust for their ongoing FOI failings which have seen hundreds of information requests go unanswered.

Devon and Cornwall Police

In 2023, as part of the ICO’s routine work to monitor public authorities’ compliance, the ICO found that between 2022 and 2024 the percentage of requests responded to by Devon and Cornwall Policewithin the statutory FOI timeframe (20 working days) was consistently low (between 39% and 65%). Their rate of response to internal review requests was also poor, averaging between 0% and 22%. The Force had a backlog of older FOI requests which had increased from 77 in December 2023 to 251 in June 2024.

The ICO Enforcement Notice orders the Force to devise and publish an action plan in the next 30 days which must detail how they will comply with their duties to respond to information requests in a timely manner. It has also been given six months to clear the existing backlog.

Barking, Havering and Redbridge Hospitals NHS Trust

The ICO first contacted the Trust in June 2023 due to a number of complaints received about its late compliance with FOI requests. The ICO found that, over 12 months, the Trust had only responded to 29% of requests during the statutory timeframe, with January 2024 seeing just 2.5% of requests responded to in a timely manner.

The Trust had a backlog of 589 requests in April 2024, which increased to 785 by June 2024. The ICO Enforcement Notice gives the Trust 35 days to devise and publish an action plan to clear this backlog by the end of the year.

Since last year, the ICO has pursued a tougher FOI enforcement policy. Recently it issued Enforcement Notices against three other police forces for poor FOI performance which has led to significant backlogs in their responses.

Our FOI Intermediate Certificate strengthens the foundations established by our FOI Practitioner Certificate. It will help you become an adept FOI practitioner by delving deeper into the intricacies of the FOIA, equipping you with the skills and confidence to navigate its complexities.

A Minister for Data Protection

Data Protection Officers will need to add a question to this year’s Christmas Quiz.; “Who is the Minister for Data Protection?”

On 7th July 2024, Sir Chris Bryant was appointed Minister of State for Data Protection and Telecoms. This is the first time we have a minister specifically for this role. Alongside data protection, Sir Chris will have responsibility for:

One of the first tasks for Sir Chris will be to guide the Digital Information and Smart Data Bill through Parliament. 

This and other data protection developments will be discussed in detail on our forthcoming  GDPR Update  workshop.