jonbainesdata.bsky.social @jonbainesdata.bsky.social · 07/08/2026This morning I dropped out of a plane at 15,000 feet above North Oxfordshire, strapped to a lovely man called Keith. Thanks - huge thanks - to those who sponsored me, and if you still wish to, you can www.justgiving.com/page/mishcon... 253
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 20/07/2026Hahaha - it seemed amusing when I first contemplated it. Now, less so (but thank you for amplifying it x) 111
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 20/07/2026I’m hurling myself out of an aeroplane in a couple of weeks. It’s not entirely without context, so if you’d like to sponsor me, well, that would just be lovely informationrightsandwrongs.com/2026/07/20/s...informationrightsandwrongs.comShameless begging bowl stuffThe last time I did a personal fundraising appeal was several years ago. I’m still fundraising for the same reason. Within a relatively short period of a few years both my parents suffered fr… 130
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 26/06/2026This time last week, all we really knew about Information Commissioner John Edwards’ conduct was what he was telling us. Truth is now coming out, thanks to courageous people who stood up to him. But how was the disgraceful behaviour tolerated for so long? www.thetimes.com/article/0f7e...thetimes.comData watchdog boss ‘made jokes about paedophiles and sex with Smurfs’Staff describe John Edwards as being ‘unusually powerful and unaccountable’ as an internal investigation reveals evidence of bullying and innapropriate language 030
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/06/2026Information Commissioner John Edwards has resigned informationrightsandwrongs.com/2026/06/19/i...informationrightsandwrongs.comInformation Commissioner John Edwards resignsMany will be aware that there has been a recent “independent workplace investigation” into the conduct of John Edwards, Information Commissioner. A few days after news was announced tha… 216
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 29/05/2026How Scotland's men's football team's performance has potentially afforded data controllers all across the UK (and wider) an extra day to comply with some data subject access requests. By me, on the @mishcondereya.bsky.social website www.mishcon.com/news/dsar-ti...mishcon.comDSAR time limits, and an extra Bank HolidayIf you are a data controller anywhere in the UK, in receipt of a data subject access request under Article 15 of the UK GDPR (or any of the other data subje 011
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 11/05/2026Is the Information Commissioner’s Office exploring ways to gut the FOI Act? By me, on the @mishcondereya.bsky.social website www.mishcon.com/news/is-the-...mishcon.comIs the ICO exploring ways to gut the FOI Act?The Information Commissioner's Office (ICO) appear to be exploring how to restrict the public’s rights under the Freedom of Information Act 2000 (FOIA). 011
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 23/04/2026I don’t think it will be a policy shift - I believe it’s regression to a default of secrecy. Open justice requires constant vigilance, because it’s very easy for bad habits to creep in and become general practice/assumptions 110
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 23/04/2026Thanks Andrew. Even though I’d have disagreed, for obvious reasons, if the Tribunal had said the post-holder *couldn’t* be named, I think it’s actually worse/more insidious for the T to decline to name them because the name of a witness isn’t *relevant*. 100
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 23/04/2026In which I get pompous and hyperbolic about some minor withholding of information in a First-tier Tribunal judgment informationrightsandwrongs.com/2026/04/23/o...informationrightsandwrongs.comOpen Justice and the Information TribunalWe need to talk about open justice in the Information Rights jurisdiction of the First-tier Tribunal. The Tribunal has just handed down a decision rejecting an appeal by the National Archives again… 232
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 22/04/2026I think it failed because the Policy doc was robust and well drafted. Much of the evidence the claimants tried unsuccessfully to get admitted was aimed at the LFR itself, and not the Policy. The courts are very careful not to allow a JR claim to become an activist weapon (see paras 4 and 5) 110
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 22/04/2026The High Court has refused the an application for judicial review of the Met Police’s policy on deployment of live facial recognition. Another on my personal blog: informationrightsandwrongs.com/2026/04/22/j...informationrightsandwrongs.comJR of Met’s Live Facial Recognition Policy dismissedIn Thompson & Anor, R (On the Application Of) v Commissioner of Police of the Metropolis [2026] EWHC 915 (Admin) the Divisional Court has roundly dismissed an application for judicial review of… 132
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 22/04/2026The Court of Appeal has restored some calm, and business certainty, by overturning the prior decision of the High Court in RTM v Bonne Terre: a data subject’s consent is to be assessed objectively, not subjectively. On my personal blog informationrightsandwrongs.com/2026/04/22/c...informationrightsandwrongs.com“Consent” must be assessed objectively, says Court of AppealThe Court of Appeal has handed down an important judgment (RTM v Bonne Terre Ltd & Anor [2026] EWCA Civ 488) on the meaning of “consent” in the context of data protection and ePrivacy law, and … 031
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 21/03/2026Oh you have got to be kidding me. What service is that from? 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 13/02/2026The ICO has declined to suggest in its guidance how long controllers should normally take to respond to data subject complaints. I think this is a missed opportunity. On my personal blog: informationrightsandwrongs.com/2026/02/13/d...informationrightsandwrongs.comData protection complaints – a missed opportunityHas the Information Commissioner’s Office ducked an opportunity to improve data subjects’ rights and provide regulatory clarity to data controllers? Section 103 of the Data (Use and Access) A… 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 12/02/2026The ICO no longer has to establish that cookie contraventions are likely to cause significant damage or distress before issuing a fine. Will it lead to flurry of fines? (Hint: not under the current regime). Still a noteworthy change though @mishcondereya.bsky.social www.mishcon.com/news/unlawfu...mishcon.comUnlawful cookies: a new avenue for the ICO to issue fines?The ICO can now fine for any unlawful cookie use under PECR. Discover how DUAA reforms and rising penalties could affect compliance strategies. 021
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 05/02/2026I've written for the @mishcondereya.bsky.social website on some of the more significant changes wrought by the Data (Use and Access) Act 2025 which commence today (5 February) www.mishcon.com/news/data-pr...mishcon.comData protection and electronic privacy reform: what’s hot and what’s not?Various aspects of data protection and eprivacy reforms take effect in the UK on 5 February 2026. 022
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 29/11/2025I’m happy to confess I assumed the absoluteness extended to NCND. I’d imagine the ICO’s position would be that s40(5) is a subordinate part of s40(2), and so NCND carries across, but the reference to Coppel in the judgment indicates that there’s been this contrary view for some time 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 29/11/2025On my personal blog: FTT rather dismantles @ICOnews on both the facts and the law in this remarkable FOI judgment. Will the ICO have to rewrite their section 40 NCND guidance? informationrightsandwrongs.com/2025/11/29/n...informationrightsandwrongs.comNCND for personal data – a qualified exemption?[reposted from my LinkedIn Account] I’ve been known to criticise First-tier Tribunal (FTT) judgments in the freedom of information jurisdiction. By contrast, this one is superb. In it, the FTT dism… 173
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 13/11/2025It’s not my area at all, but see CPR 81, and 81.9 in particular - the court has the power to commit to prison or issue an (unlimited) fine www.justice.gov.uk/courts/proce...justice.gov.ukPART 81 – Applications and Proceedings in Relation to Contempt of Court – Justice UK 110
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 13/11/2025One of those initialisms that is almost a standard word for those practising in data protection and privacy, so much so that it didn’t occur to me to spell it out (but will edit to do so now) 000
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 13/11/2025After all these years, I see that a social media post by @davidallengreen.bsky.social can have a remarkable booster effect on the visits to one’s blog 170
Reposted by @jonbainesdata.bsky.socialAlistair Sloan @alistairsloan.bsky.social · 13/11/2025Incredible story. The ICO should absolutely now be paying the force some real attention given the potential wider implications for FOI requests and subject access requests. 162
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 13/11/2025I’ve written on my personal blog about an extraordinary CoA judgment in which the Chief Constable of Northants Police has been found in contempt over egregious BWV disclosure failings informationrightsandwrongs.com/2025/11/13/c...informationrightsandwrongs.comChief Constable in contempt over BWV footage disclosure failuresThe Court of Appeal has handed down an extraordinary judgment (Buzzard-Quashie v Chief Constable of Northamptonshire Police [2025] EWCA Civ 1397) in which the Chief Constable of Northamptonshire wa… 22816
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 07/11/2025The MoD has said it cannot say whether it has had any spreadsheet-based data breaches following the catastrophic Afghan citizen one, because it would take >237 hours to find out. On my personal blog informationrightsandwrongs.com/2025/11/07/m...informationrightsandwrongs.comMoD: “too costly” to find out if there have been further spreadsheet data breachesResponse to FOI request says it would take 237 hours to find out. How can ICO have confidence lessons have been learnt? Anyone who’s ever had been responsible for compiling or overseeing a data bre… 012
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 25/08/2025And to this day no one knows where that guitar disappeared to at the end 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 11/08/2025I’m especially ticked off that he likes Au Hasard, Balthazar, as that’s been my go-to pseuds-cornerish answer to “what’s your favourite film?” for 35 years. Now I have to find another one 220
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 29/07/2025I’ve written on my personal blog on the still-unclear question of why one very large charity received “public sector” lenience from the ICO - and a 97.5% reduction in proposed fine - while a few months later a tiny charity didn’t informationrightsandwrongs.com/2025/07/29/i...informationrightsandwrongs.comICO fines: are you certain?In his inaugural speech as Information Commissioner, in 2022, John Edwards said my focus is on bringing certainty in what the law requires of you and your organisations, and in how the regulator ac… 020
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 16/07/2025I’ve written up my thoughts for the @mishcondereya.bsky.social website, on the baffling decision by the ICO to take no action in response to the most catastrophic data breach in UK history, which exposed many thousands of people to immediate risk to their lives. www.mishcon.com/news/data-pr...mishcon.comData Protection risks to life: Should more be done?The Secretary of State for Defence announced on 16 July, a significant data protection breach relating to the Afghan Relocations and Assistance Policy 1119
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 15/07/2025Kate, I don’t even mind (all that much) the lack of holding to account - it’s the failure to take the opportunity to educate the public about something that has happened much too often, and puts lives at risk 100
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 15/07/2025Today we heard about the most catastrophic data breach in UK history. And the ICO’s response? No need for any action. Not. Good. Enough. www.linkedin.com/posts/jon-ba...linkedin.comToday, after the High Court discharged a super-injunction preventing anyone from knowing about it, or even knowing about the existence of the injunction, we’ve learnt about possibly the most… | Jon Ba...Today, after the High Court discharged a super-injunction preventing anyone from knowing about it, or even knowing about the existence of the injunction, we’ve learnt about possibly the most catastrop... 192
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 02/07/2025A largely overlooked but significant change wrought by the Data (Use and Access) Act 2025 means that, in principle, it will be *much* easier for the ICO to issue fines for cookies contravention I've written about this for the @Mishcon_de_Reya website www.mishcon.com/news/fines-f...mishcon.comFines for cookie contraventions more likely as a result of law changeThe Data (Use and Access) Act 2025 (DUAA) will make some significant changes to the enforcement regime for cookies and direct electronic marketing. 021
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 30/06/2025I’ve written for the Mishcon de Reya website on the Data (Use and Access) Act 2025 and the changes it will make to the UK’s data protection laws www.mishcon.com/news/how-wil...mishcon.comHow will the Data (Use and Access) Act reshape data protection?On 19 June, the Data (Use and Access) Act (DUAA) received Royal Assent. We consider what changes it will bring in terms of data protection law. 000
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 29/06/2025A man on remand for assaulting his ex-partner duped former employer, JD Wetherspoon, into orally disclosing her mother’s mobile phone number, which he then used to continue his abuse. I’ve written on my personal blog about the case which has resulted informationrightsandwrongs.com/2025/06/29/o...informationrightsandwrongs.comOral disclosure of personal data: a new domestic case“Pretexting” and “blagging” are forms of social engineering whereby someone attempts to extract information from a source by deception. One (unethical) example is when a journalist purports to be s… 001
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 20/06/2025The Data (Use and Access) Act 2025 has now been published. NB that most of the operative data protection provisions still need secondary legislation to commence them www.linkedin.com/posts/jon-ba...linkedin.comFrom what I can see, the only major operative "data protection" provision that comes immediately into effect is the section 78 "reasonable and proportionate searches" one (and that...From what I can see, the only major operative "data protection" provision that comes immediately into effect is the section 78 "reasonable and proportionate searches" one (and that... 013
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 20/06/2025A blogpost on what the Data (Use and Access) Act 2025 will do. It’s essentially an amending statute: practitioners should look mostly to how it changes UK GDPR, DPA 2018 and PECR informationrightsandwrongs.com/2025/06/20/w...informationrightsandwrongs.comWhat the DUAA 2025 will doSection 1(2) of the Data Protection Act 2018 tells us that Most processing of personal data is subject to the UK GDPR Despite the attention given to the progress of the Data (Use and Access) Act 20… 030
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 17/06/2025The Data (Use and Access) Bill is due to receive Royal Assent on 19 June: bills.parliament.uk/bills/3825/s...bills.parliament.ukData (Use and Access) Bill [HL] Royal Assent - Parliamentary Bills - UK ParliamentData (Use and Access) Bill [HL] Royal Assent sittings 000
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 14/06/2025For the want of a nail the shoe was lost. For the want of a signature the €4.3m GDPR fine against VW was lost. themunicheye.com/volkswagen-e... 011
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 14/06/2025Next week the Court of Appeal will hear the claimants’ appeal in the case of Farley and Others v. Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB). See my short primer on the issues www.linkedin.com/posts/jon-ba...linkedin.comNext week the Court of Appeal will hear the claimants’ appeal in the case of Farley and Others v. | Jon BainesNext week the Court of Appeal will hear the claimants’ appeal in the case of Farley and Others v. Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB). This is an important case when i... 000
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 09/06/2025To what extent do rules in defamation carry over to data protection claims about publication of personal data? There’s some interesting analysis in a recent judgment, striking out a claim by Dale Vince against Associated Newspapers. On my personal blog: informationrightsandwrongs.com/2025/06/09/d...informationrightsandwrongs.comDefamation rules are applied to UK GDPR claimAn interesting recent judgment in the High Court considers the extent to which rules in defamation law might also apply to data protection claims. In July 2024 His Honour Judge Lewis struck out a c… 021
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 06/06/2025The @goodlawproject.bsky.social is suing Reform, as a representative body (the first such case brought under Article 80(1) of the UK GDPR. GLP have published both its particulars of claim and Reform’s defence. I’ve written about it on my personal blog informationrightsandwrongs.com/2025/06/06/g...informationrightsandwrongs.comGood Law Project v ReformIn the run-up to last year’s General Election, the campaigning group The Good Law Project (GLP) actively encouraged people to make subject access requests (under Article 15 of the UK GDPR) to polit… 030
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 06/06/2025The Information Tribunal has ruled that the Hinkley Point C construction company is a public authority for the purposes of the Environmental Information Regulations (a parallel access regime to the FOI Act). On my personal blog: informationrightsandwrongs.com/2025/06/06/h...informationrightsandwrongs.comHinkley Point C construction company is a public authority under the EIRThe Information Tribunal has ruled that the Nuclear New Build Generation Company, a subsidiary of EDF Energy, created to construct s new nuclear power plant at Hinkley Point C (HPC), is a public au… 022
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 04/06/2025For some reason @familoo.pinktape.co.uk @juliedoughty.bsky.social I can’t reply to this post, so having to repost it: these are my initial thoughts on the data protection aspects of the guidance informationrightsandwrongs.com/2025/06/04/c...informationrightsandwrongs.comCovert recordings in family law proceedings – some slightly flawed guidanceThe issue of the legality of the making of, and subsequent use of, covert audio and/or visual recordings of individuals is a complex one – even more so when it comes to whether such recording… 212
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 04/06/2025The Family Justice Council has produced guidance on covert recordings in family law proceedings - some of its references to data protection law are misguided. On my personal blog: informationrightsandwrongs.com/2025/06/04/c...informationrightsandwrongs.com 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 27/05/2025When Liz Truss was elected leader of the Tory Party (and thus recommended to and appointed by the Queen as her PM) was it an exercise of a public function amenable to JR? Unsurprisingly, the Court of Appeal says “no”. On my personal blog informationrightsandwrongs.com/2025/05/27/l...informationrightsandwrongs.comLiz Truss leadership election not amenable to JRWas the leadership election in which Liz Truss was elected as leader of the Conservative Party (and as a result of which she was recommended to the Queen by the outgoing Boris Johnson, and appointe… 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/05/2025Yes, the LAA (or, strictly, the MoJ, given that the former is an executive agency of the latter) will be a controller 120
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/05/2025Certainly in the event of a regulatory investigation, or a legal claim by an affected individual, they would need to justify the retention, and if they couldn’t do so, they would be in breach of UK GDPR storage limitation principle 010
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/05/2025As to why they were still holding the old data, that’s less a data protection question (there, the law just says “don’t hold for longer than you need to”) and one around any specific legal aid laws/guidance or LAA’s own policies 110
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/05/2025As a matter of law, if the LAA assesses that this presents a likely high risk to data subjects it must inform them itself, “in clear and plain language”, giving them a contact point, describing likely consequences and the measures being taken to address and mitigate the breach’s adverse effects 220
jonbainesdata.bsky.social @jonbainesdata.bsky.social · 19/05/2025This looks very nasty - a cyber attack has apparently compromised the Legal Aid Agency’s online digital services, involving a "significant" amount of personal data from those who applied online for legal aid since 2010 www.gov.uk/government/n...gov.ukLegal Aid Agency data breachAn update following a cyber-attack on the Legal Aid Agency’s online digital services. 035
