Data Protection, Privacy & Information Law
We are information law specialists and provide pragmatic and effective advice on data protection and privacy law.
In addition to our advisory work, we have a track record of successfully defending clients in information law litigation and when facing regulatory scrutiny from the Information Commissioner's Office (ICO).
Often, the overall approach and strategy to a data protection matter is as important as the detail. With this in mind, we will work closely with you to ensure that we understand your organisation and your objectives.
We can advise on a wide range of data protection and information law topics, including complex subject access requests, marketing, fundraising, information security, cyber security, data sharing, data protection documentation, data protection impact assessments and international data transfers.
Our data protection solicitors work collaboratively with other teams at VWV to ensure a joined-up approach and the best outcome for you as our client. For example, if an employee is looking to bring a claim, they will often make a subject access request to obtain information that supports their claim. We work closely with our employment team to ensure that our approach to a subject access request is consistent with the employer's wider employment strategy.
We advise on the Freedom of Information Act and the Environmental Information Regulations. Our practice extends to wider privacy compliance, such as duties of confidentiality and some of the more niche areas of information law, such as the Network and Information Systems Regulations.
Our expertise
Our team draws on many years' experience of advising clients across a broad range of sectors. The vast majority of the lawyers in the team advise exclusively on data protection and information law. This has helped us to become genuine experts and leaders in our field and demonstrates VWV's commitment to data protection.
We act for a significant number of clients in the education, charity, pharmaceutical, healthcare, technology and public sectors, all of whom have complex and often urgent data protection needs. This helps to ensure that we remain at the forefront of data protection compliance issues and can apply our experience and expertise to all our clients.
We can arrange and provide data protection training, both in person and online. The team has also written data protection e-learning content available through VWV Plus.
Data protection documentation requirements can be onerous. At VWV, we can provide a suite of data protection compliance documentation (with accompanying guidance). This includes privacy notices, data protection policies, data sharing agreements and data protection impact assessments.
Our work highlights
We acted for a charity that had suffered a significant ransomware attack that resulted in highly confidential personal data being compromised. We supported with all aspects of breach management, including regulatory notification requirements (for example, ICO and Charity Commission notification), informing affected individuals, liaising with IT forensic experts and the client's insurers and advising the client on risks and remedial measures.
Assisted a school respond to a subject access request (SAR) from a former member of staff. Prepared all correspondence with the requester, and the response to the request. Advised on relevant exemptions and data protection law risks, alongside colleagues in our employment team due to the ongoing employment dispute with the requester. We assisted the School with its response to the requester's complaint about the SAR response, resulting in the matter being dropped by the requester.
Acting for the respondent on a FOIA challenge through the information law tribunal. The applicant sought the release of various documents which was resisted on the grounds of i) the information having been provided in confidence; and ii) commercial interests. The ICO had upheld our client's decision not to disclose. The applicant therefore issued a First Tier Tribunal application against the ICO (to which our clients were added). The matter was appealed to the Upper Tribunal twice, ultimately concluding in favour of our client: [2024] UKUT 195 (AAC).
