David Erdos
banner
daviderdos.bsky.social
David Erdos
@daviderdos.bsky.social

Trinity Hall Fellow, Professor of Law & Open Society & CIPIL Co-Director Cambridge University. Interested in #dataprotection #GDPR information law, legal history & public and private international law. Viewpoints personal & RT≠endorsement .. more

Political science 54%
Law 28%

Reposted by David Erdos

The Commission will introduce the Digital Omnibus on November 19, simplifying of the implementation of AI Act.

Here's the text shared by netzpolitik.org:
lnkd.in/dCTW36pS.
Fantastic lecture by @ukandeu.bsky.social Prof @anandmenon.bsky.social for the annual @eulegalstudies.bsky.social Mackenzie Stuart Lecture @cambridgelaw.bsky.social, chaired by Prof @cbarnard.bsky.social reflecting on the 2015 general election and inequality in the run up to the Brexit.

Disappointing to see that the UK ICO has declined to submit any evidence to the Commons Defence Committee Inquiry into the circumstances behind, and consequences of, the #Afghan #spreadsheet #databreach, the most serious ever in UK public sector history: committees.parliament.uk/work/9327/af...
Afghan Data Breach and Resettlement Schemes - Committees - UK Parliament
This inquiry will examine the circumstances behind and the consequences of a major data breach in February 2022 from the Ministry of Defence. The breach involved the personal data of thousands of Afghan applicants for resettlement to the UK and their families, potentially putting these people at risk of reprisals. The inquiry aims to understand how this breach could have been allowed to happen, and, once it had happened, whether successive Governments took well-informed and sensible decisions under cover of an unprecedented super-injunction. The inquiry will also examine the Government’s wider arrangements for the resettlement of eligible Afghans in the UK. While lived experience can inform the Committee's work, please be aware that the Committee does not consider or assist with individual cases.
committees.parliament.uk

Reposted by David Erdos

Reposted by David Erdos

1984: We're behind schedule.

Couple sues because NYPD aims cameras into their bedroom and living room, perhaps due to their history of activism.

I hope they win but the precedents are mixed.
www.law360.com/cybersecurit...
NYC Sued Over 'Voyeuristic' Police Surveillance System - Law360
A Brooklyn couple has filed a federal lawsuit alleging New York City uses a "voyeuristic" police surveillance system on all visitors and residents, which includes two police cameras that are aimed at ...
www.law360.com

Beyond #Afghan #databreach, the UK ICO faces increased scrutiny due to need to renew #dataprotection #adequacy. The European DP Board is urging much greater scrutiny of the robustness of its complaints handling & effectiveness of UK #GDPR sanctions and remedies: www.edpb.europa.eu/system/files...

The ICO claim #UKGDPR complaints are arising "as people become more aware of their #dataprotection rights" & now propose to refuse investigation of many of these. In fact, complaints have been stable since #GDPR & but with ↓↓ regulatory action by ICO have ↑ since 2023: inforrm.org/2025/10/28/c...

The approach would inevitably lead to many noncompliant controllers, especially SMEs, not being subject to any form of @iconews investigation which would exacerbate the lack of respect for legal rights and duties which data subjects now experience. The plans should be opposed.

ICO now propose to reject investigation of many complaints unless there is a considerable number or increase concerning the same controller. With no investigation, the ICO would be unable to discharge its obligation to inform the complainant of the investigation outcome.

In reality, almost no complaints are being progressed within maximum period, it is far from clear that these are subject to appropriate investigation & ICO makes almost no use of its formal corrective powers (there were just 2 #dataprotection fines in 2024-25). Complaints have 📈

Under law ⚖️ ICO must investigate all #dataprotection complaints to the extent appropriate, respond consistently with need for strong enforcement and inform the data subject of the outcome of both the investigation and the complaint (providing a progress update within 3 months).

The UK Information Commissioner's Office is currently consulting (until this Friday) on its plans to change its response to #dataprotection including UK #GDPR complaints. Please do respond via ico.org.uk/about-the-ic...
ICO consultation on draft changes to how we handle data protection complaints
ico.org.uk

New blog on UK Information Commissioner's plan to reject investigation ‍of many #DataProtection complaints, an💡inconsistent with its obligation to inform all complainants of an investigation outcome & liable to fuel further disregard for the UK #GDPR especially among SMEs: inforrm.org/2025/10/28/c...
Cause for Complaint: Assessing the ICO’s Proposed New Approach to Data Protection Complaints – David Erdos
The Information Commissioner’s Office (ICO)’s data protection complaint handling performance is currently in very clear crisis.  Despite its pledge to assess and respond to 80% of such complaints w…
inforrm.org

Reposted by David Erdos

Happy to announce that I'm giving a CIPIL seminar in Cambridge on Nov 20th, "Faithful or Traitor? The Right of Explanation in a Generative AI World", and it's attendance on zoom as well as in person but registration needed : see www.cipil.law.cam.ac.uk/press/events...
CIPIL Evening Seminar: 'Faithful or Traitor? The Right of Explanation
Speaker: Professor Lilian Edwards, Prof of Law, Innovation & Society, Newcastle Law School Biography: Lilian Edwards is a leading academic in the field of Internet law.
www.cipil.law.cam.ac.uk

Great to see open-access volume on #dataprotection and #humanitarian action now out marking decade of @icrc.org & @unhcr.org frameworks🎉https://lnkd.in/eTTyttpw My chapter is on 1990 UN Guidelines role in promoting regulation alongside autonomy & derogations for humanitarian IOs.

Good to see highlighting of ICO failure to investigate grave #Afghan #databreach or even keep decision record. Similar earlier breach is binding reason for action not reverse. UK #GPDR requires "dissuasive" steps but this is lacking bsky.app/profile/chio...
ukconstitutionallaw.org/2025/09/03/d...
Just out! Important case for accountability in the online advertising industry. Grindr just lost its appeal, as its data is deemed sensitive under European law. More details forthcoming:

www.forbrukerradet.no/news-in-engl...

#privacy #gdpr #adtech
Grindr loses appeal
Today it was announced that the appeal by dating app Grindr’s was unsuccessful, and the administrative fine of 65 million NOK (ca €5.5 million) is upheld.
www.forbrukerradet.no

#Australia, #Canada & #UK's joint action today brings #Commonwealth State recognition of #Palestine to 80%. It must now accept its special urgent responsibilities, set up a support Fund & revive Palestine's 1997 membership application: www.tandfonline.com/doi/full/10.... bsky.app/profile/leah...
⚠️ Prime Ministers of the UK, Canada, and Australia announce their countries’ recognition of the State of Palestine:

Reposted by David Erdos

⚠️ Prime Ministers of the UK, Canada, and Australia announce their countries’ recognition of the State of Palestine:

Not least given British mandate origins of today’s conflict, the #Commonwealth has a special responsibility. There’s more background, including the Commonwealth’s advocacy between 1967 and 1997 for a just resolution in Palestine in my open-access article: www.tandfonline.com/doi/full/10....
Palestine and the modern Commonwealth: past engagements and future membership?
All Commonwealth summit communiqués from the late 1960s through to the mid-1990s maintained a focus on the Palestinian conflict and highlighted approaches that could lead to its just resolution. Wh...
www.tandfonline.com

In midst of #Gaza horror &⬆️Recognition of #Palestine by Members (up to 80% by end Sept & 🤞more soon) it's good to see Stuart Mole, former Head of it's Secretary-General's Office, call for Palestine #Commonwealth membership pathway (paused since 1997) www.commonwealthroundtable.co.uk/general/poli...

Instead, these omissions relate to ICO’s extreme reluctance to exercise its formal #dataprotection powers and functions, a reality which led to no UK #GDPR enforcement notices and just 2 fines (compared to >250 in eg Germany) in 2024/25. An in-depth & independent investigation would add value.

New Blog: In wake of #Afghan #databreach which put 100K at grave UK #GDPR risk ICO didn't obtain a full timely notification, engaged in no investigation or enforcement & recorded no decisions. The super-injunction protected its position so can't justify this ukconstitutionallaw.org/2025/09/03/d...
David Erdos: How Exposed? The Information Commissioner’s Office and the Afghan Spreadsheet Data Breach
On 17 August 2023 the Ministry of Defence (MoD) put the Information Commissioner’s Office (ICO) on broad notice about the devastating failure of data protection that is now generally known as the A…
ukconstitutionallaw.org

Reposted by David Erdos

noyb @noyb.eu · Sep 2
📰 "The Austrian data protection authority has ordered YouTube to give users access to their personal data, enforcing data access rules contained in the EU's General Data Protection Regulation (GDPR)."

www.euractiv.com/section/tech...
Austria's privacy watchdog tells YouTube to give users access to their data - Euractiv
But the decision by the Austrian authority comes more than five years after privacy group Noyb filed the data access complaint
www.euractiv.com

Reposted by David Erdos

Invoking "economic growth" & the vaguest of claims about #AdTech the UK Information Commissioner plans to explicitly “enable” non-compliant business models. Even partial Responses (by 7 Sept 25) pushing back on this erosion of rights & democratic processes would be good! ico.org.uk/about-the-ic...

The UK Parliament had a full opportunity to recalibrate #dataprotection & #ePrivacy compliance for #AdTech in Data (Use and Access) Act & did so. In immediately eroding these rights, the ICO’s stance would seriously undermine both the rule of law and democratic processes. 3/3

It is against the ICO’s Growth Duty, the Statutory Guidance being that “[n]on-complaint activity…harms the interests of legitimate businesses that are working to comply with regulatory requirements, disrupting competition and acting as a disincentive to invest in compliance” 2/3

Invoking "economic growth" & the vaguest of claims about #AdTech the UK Information Commissioner plans to explicitly “enable” non-complaint business models. Even partial Responses (by 7 Sept 25) pushing back on this erosion of rights & democratic processes encouraged. ico.org.uk/about-the-ic...