Search results

No fine too small: ICO fines Mermaids £25,000 for personal data breach Last week, the ICO fined the charity Mermaids £25,000 for failure to implement an appropriate level of organisational and technical security measures, in contravention of its obligations under Articles 5(1)(f) and 32(1) and (2) of the UK GDPR. While this ...

NCSC says think twice about using DLT The UK’s National Cyber Security Centre (NCSC) recently published a short whitepaper on distributed ledger technology (DLT) to help decisions makers in organisations decide whether it is an appropriate technology for their use case. Key benefits of DLT in...

Reporting ransomware payments and regulating cryptocurrencies: international task force publishes new plan to tackle ransomware As a new international action plan calls for urgent action to tackle ransomware, the NCSC reminds organisations of what steps they can take now to protect themselves from this growing threat The ransomware threat is increasing – both in terms of scale an...

Close collaboration: operational resilience and cyber resilience Last week the Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA) and the Bank of England published long-awaited policy statements and supervisory materials setting out their final rules and guidance on operational resilience. The...

Ofcom updates NIS guidance Ofcom has updated its guidance for those in the digital infrastructure subsector who are caught by The Network and Information Systems Regulations (the “NIS Regulations”). The NIS Regulations set out measures to “boost the overall level of security (both ...

When should you notify a data breach? New EDPB guidance provides practical examples New guidelines published on 14 January provide both practical examples of when to notify a data breach and “advisable measures” which organisations can take to mitigate their cyber risk. Since the introduction of GDPR, the ICO has received over 30,000 da...

Combatting cybercrime: the new Nominet and PIPCU landing pages for suspended criminal domains What happens when Nominet suspends a domain name for fraudulent activity? Does it go back for sale? Does the affected brand owner buy it and maintain it as a defensive registration? What should happen? In what is reportedly the first registry-led initiat...

ENISA issues guidelines on securing the IoT supply chain On 9 November 2020, the European Union Agency for Cybersecurity (ENISA) published its guidelines for securing the Internet of Things (IoT) supply chain (see the full report here). The report is relevant to all those developing, selling and using IoT devic...

Relief for British Airways, but not for businesses facing fines in the future On Friday 16th October, the Information Commissioner’s Office (ICO) announced its long awaited fine of British Airways plc (BA) for breach of the GDPR following a cyber-attack in 2018. The final fine of £20 million is the second and largest fine issued by...

“Prepare to jump to lightspeed!” – hyperspace, hyperlinks and the Copyright Directive The mention of Star Wars and copyright together often conjures to mind the well-known Stormtrooper helmet case. But that may be about to change now that AG Szpunar has opened his recent Opinion in VG Bild-Kunst v Stiftung Preußischer Kulturbesitz (Case C...