A survey conducted in April and May 2023 revealed that around ** percent of the companies that do business in the European Union (EU) and the United Kingdom (UK) found it challenging to adapt to new or changing requirements of the General Data Protection Regulation (GDPR) or Data Protection Act 2018 (DPA). A further ** percent of the survey respondents said it was challenging to increase the budget because of the changes in the data privacy laws.

As of February 2025, the largest fine issued for violation of the General Data Protection Regulation (GDPR) in the United Kingdom (UK) was more than 22 million euros, received by British Airways in October 2020. Another fine received by Marriott International Inc. in the same month was the second-highest in the UK and amounted to over 20 million euros.

A survey conducted in April and May 2023 among companies that do business in the European Union and the United Kingdom (UK) found that over half of the respondents, ** percent, felt very prepared for the General Data Protection Regulation (GDPR). A further ** percent of the companies believed they were moderately prepared, while ** percent said they were slightly ready to comply with the EU and UK privacy legislations.

Whilst this some of the requested information is held by the NHSBSA, we have exempted some of the figures under section 40(2) subsections 2 and 3(a) of the FOIA because it is personal data of applicants to the VDPS. This is because it would breach the first data protection principle as: a - it is not fair to disclose individual’s personal details to the world and is likely to cause damage or distress. b - these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the individual. https://www.legislation.gov.uk/ukpga/2000/36/section/40 Information Commissioner Office (ICO) Guidance is that information is personal data if it ‘relates to’ an ‘identifiable individual’ regulated by the UK General Data Protection Regulation (UK GDPR) or the Data Protection Act 2018. The information relates to personal data of the VDPS claimants and is special category data in the form of health information. As a result, the claimants could be identified, when combined with other information that may be in the public domain or reasonably available. Online communities exist for those adversely affected by vaccines they have received. This further increases the likelihood that those may be identified by disclosure of this information. Section 40(2) is an absolute, prejudice-based exemption and therefore is exempt if disclosure would contravene any of the data protection principles. To comply with the lawfulness, fairness, and transparency data protection principle, we either need the consent of the data subject(s) or there must be a legitimate interest in disclosure. In addition, the disclosure must be necessary to meet the legitimate interest and finally, the disclosure must not cause unwarranted harm. The NHSBSA has considered this and does not have the consent of the data subjects to release this information and believes that it would not be possible to obtain consent that meets the threshold in Article 7 of the UK GDPR. The NHSBSA acknowledges that you have a legitimate interest in disclosure of the information to provide the full picture of data held by the NHSBSA; however, we have concluded that disclosure of the requested information would cause unwarranted harm and therefore, section 40(2) is engaged. This is because there is a reasonable expectation that patient data processed by the NHSBSA remains confidential, especially special category data. There are no reasonable alternative measures that could meet the legitimate aim. As the information is highly confidential and sensitive, it outweighs the legitimate interest in the information. Section 41 FOIA This information is also exempt under section 41 of the FOIA (information provided in confidence). This is because the requested information was provided to the NHSBSA in confidence by a third party - another individual, company, public authority or any other type of legal entity. In this instance, details have been provided by the claimants. For Section 41 to be engaged, the following criteria must be fulfilled:

Since the enforcement of the General Data Protection Regulation (GDPR) in May 2018, fines have been issued for several types of violations. As of February 2025, the most significant share of penalties was due to companies' non-compliance with general data processing principles. This violation has led to over 2.4 billion euros worth of fines.

Deze dataset is een centrale catalogus van Data Protection Impact Assessments (DPIA's) van smart city-projecten die persoonlijke informatie verzamelen in openbare ruimtes. Door dit voor het eerst op één plaats te publiceren, zal het publieke transparantie mogelijk maken en goede praktijken onder exploitanten ondersteunen.

Een DPIA helpt bij het identificeren en minimaliseren van de risico's van een project dat persoonsgegevens gebruikt.

DPIA registratieformulier: "https://www.london.gov.uk/dpia-register-form" target="_blank" style="color: rgb(158, 0, 98);">https://www.london.gov.uk/dpia-register-form

Informatiecommissaris DPIA: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/

Deze dataset is een centrale catalogus van Data Protection Impact Assessments (DPIA's) van smart city-projecten die persoonlijke informatie verzamelen in openbare ruimtes. Door dit voor het eerst op één plaats te publiceren, zal het publieke transparantie mogelijk maken en goede praktijken onder exploitanten ondersteunen.

Een DPIA helpt bij het identificeren en minimaliseren van de risico's van een project dat persoonsgegevens gebruikt.

DPIA registratieformulier: "https://www.london.gov.uk/dpia-register-form" target="_blank" style="color: rgb(158, 0, 98);">https://www.london.gov.uk/dpia-register-form

Informatiecommissaris DPIA: "https://data.london.gov.uk/dpia/_wp_link_placeholder" target="_blank" style="color: rgb(158, 0, 98);">https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/

Between 2018 and 2022, there has been a significant increase in the level of awareness around the General Data Protection Regulation (GDPR) among European users. In 2018, when the GDPR was first applied, the United Kingdom had the highest level of awareness, with 32 percent of respondents agreeing or strongly agreeing with the statement: "I am aware of the new General Data Protection Regulation (GDPR) that will be introduced in May 2018". In 2022, the share of UK respondents agreeing with the statement increased to 73 percent. France had the lowest level of awareness in 2018, 20 percent, whereas in 2022 it reached 47 percent but remained the lowest among other European markets.

BackgroundThe COVID-19 pandemic brought global disruption to health, society and economy, including to the conduct of clinical research. In the European Union (EU), the legal and ethical framework for research is complex and divergent. Many challenges exist in relation to the interplay of the various applicable rules, particularly with respect to compliance with the General Data Protection Regulation (GDPR). This study aimed to gain insights into the experience of key clinical research stakeholders [investigators, ethics committees (ECs), and data protection officers (DPOs)/legal experts working with clinical research sponsors] across the EU and the UK on the main challenges related to data protection in clinical research before and during the pandemic.Materials and methodsThe study consisted of an online survey and follow-up semi-structured interviews. Data collection occurred between April and December 2021. Survey data was analyzed descriptively, and the interviews underwent a framework analysis.Results and conclusionIn total, 191 respondents filled in the survey, of whom fourteen participated in the follow-up interviews. Out of the targeted 28 countries (EU and UK), 25 were represented in the survey. The majority of stakeholders were based in Western Europe. This study empirically elucidated numerous key legal and ethical issues related to GDPR compliance in the context of (cross-border) clinical research. It showed that the lack of legal harmonization remains the biggest challenge in the field, and that it is present not only at the level of the interplay of key EU legislative acts and national implementation of the GDPR, but also when it comes to interpretation at local, regional and institutional levels. Moreover, the role of ECs in data protection was further explored and possible ways forward for its normative delineation were discussed. According to the participants, the pandemic did not bring additional legal challenges. Although practical challenges (for instance, mainly related to the provision of information to patients) were high due to the globally enacted crisis measures, the key problematic issues on (cross-border) health research, interpretations of the legal texts and compliance strategies remained largely the same.

In September 2024, the Irish Data Protection Commission fined Meta Ireland 91 million euros after passwords of social media users were stored in 'plaintext' on Meta's internal systems rather than with cryptographic protection or encryption. In May 2023, the EU fined Meta 1.2 billion euros for violating laws on digital privacy and putting the data of EU citizens at risk through Facebook's EU-U.S. data transfers. European privacy legislation is seen as being far stricter than American privacy law, and the sending of EU citizens’ data to the United States resulted in the record breaking penalty being issued to the tech giant. In January 2023, after it was discovered that Meta Platforms had improperly required that users of Facebook, Instagram, and WhatsApp accept personalized adverts to use the platforms, the company was issued a 390 million euro fine by the European Commission. EU regulators claim that the social media giant broke the General Data Protection Regulation (GDPR) by including the demand in its terms of service. In addition, Meta was fined 405 million euros by the Irish Data Protection Commission (DPC) in September 2022 for violating Instagram's children's privacy settings. In November 2022, the DPC fined Meta a further 265 million euros for failing to protect their users from data scraping. GDPR violations in 2022 Social media sites and companies are not the only types of online services upon which users' data can potentially be compromised. In 2022, the online service with the biggest fine for violating GDPR was e-commerce and digital powerhouse Amazon, which was issued a 746 million euro fine. Furthermore, in December 2021, Google was penalized 90 million euros for GDPR violations. What are the most common GDPR violations? Since GDPR went into effect in May 2018, fines have been imposed for a variety of reasons. As of June 2022, companies' non-compliance with general data processing principles accounted for the largest share of fines, resulting in over 845 million euros worth of penalties. Insufficient legal basis for data processing was the second most common violation, amounting to 447 million euros in fines.

Question 2 National Audit Office (NAO) are the auditors of the NHS Pension Scheme Accounts. The main contact at NAO has not consented to the disclosure and is therefore exempt under 40 subsections 2 and 3A (a) of the Freedom of Information Act 2000, as disclosure of this information would be unfair and as such this would breach the UK GDPR first data protection principle because: a) it is not fair to disclose main contact of the NAO personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the main contact of the NAO. NAO have provided the name of the Auditor General, Gareth Davies Government Internal Audit Agency (GIAA) currently provide Internal Audit for the NHSBSA. This includes the following areas of NHS pensions for 2023/24: Member Data McCloud and other Legislative Changes . Pensions Annual Allowance Charge Compensation Scheme (PAACCS) My NHS Pensions Portal Government Internal Audit Agency (GIAA) - The main contact at GIAA has not consented to the disclosure and is therefore exempt under 40 subsections 2 and 3A (a) of the Freedom of Information Act 2000, as disclosure of this information would be unfair and as such this would breach the UK GDPR first data protection principle because: a) it is not fair to disclose main contact of the Government Internal Audit Agency’s personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the main contact of the Government Internal Audit Agency. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40 Question 3 National Audit Office (NAO) National Audit Office 157-197 Buckingham Palace Road London SW1W 9SP Government Internal Audit Agency (GIAA) Governance Team Corporate Services Directorate Government Internal Audit Agency 10 Victoria Street Westminster London SW1H 0NB United Kingdom Question 4

A study conducted among *** websites in the UK showed that roughly ** percent of the websites was compliant with the General Data Protection Regulation (GDPR). The consent management platforms (CMP) displayed were in most cases not meeting the requirements of the EU law.

Dataset on commits (and repositories) on GitHub making reference to data privacy legislation (covering laws: GDPR, CCPA, CPRA, UK DPA).

The dataset contains:
+ all_commits_info_merged-v2-SHA.csv : commits information as collected from various GitHub REST API calls (all data merged together).
+ repos_info_merged_USED-v2_with_loc.csv: repository information with some calculated data.
+ top-70-repos-commits-for-manual-check_commits-2coders.xlsx: results of the manual coding of the commits of the 70 most popular repositories in dataset.
+ user-rights-ω3.csv: different terms for user rights teriminology in legislation.
+ github_commits_analysis_replication.r: main analysis pipeline covering all RQs in the R programming language.

In order to perform also the initial data collection, the GitHub REST API can be used, collecting data using time intervals, for instance:
https://api.github.com/search/commits?q=%22GDPR%22+committer-date:2018-05-25..2018-05-30&sort=committer-date&order=asc&per_page=100&page=1

This dataset accompanies the following publication, so please cite it accordingly:

Georgia M. Kapitsaki, Maria Papoutsoglou, Evolution of repositories and privacy laws: commit activities in the GDPR and CCPA era, accepted for publication at Elsevier Journal of Systems & Software, 2025.

Reasons for data donation subscale correlations, and means, standard deviations and Cronbach’s Alpha for subscales of Reasons for Data Donation.

Reasons for Data Donation Questionnaire with factor loadings and 99% confidence intervals, EFA, as well as means (M) and standard deviations (SD) for each item.

For step comparison, missing observation were deleted listwise, resulting in N = 1024.

One fifth of e-commerce and multichannel retailers in the UK and France saw the EU General Data Protection Regulation (GDPR) as the greatest concern in the future of personalization. Personalization in e-commerce retail was also a technology that retailers were worried they would not understand or keep up with. The changing trends in personalization were also another concern among ** percent of UK and French retailers.

Een Data Protection Impact Assessment (DPIA) is een van de manieren om erachter te komen welke privacyrisico’s mensen lopen wanneer informatie over hen wordt verzameld, gebruikt, opgeslagen of gedeeld. Dit helpt de Londense gemeente Barnet problemen te vinden zodat risico’s kunnen worden weggenomen of verlaagd tot een aanvaardbaar niveau. Het bezuinigt ook op inbreuken op de privacy en klachten die de reputatie van de Raad kunnen schaden of leiden tot actie van de Information Commissioner (de waakhond van de regering). De London Borough of Barnet maakt DPIA’s openbaar in zijn Data Charter en de Data Protection Act 2018 en UK GDPR. Een Data Protection Impact Assessment (DPIA) is een van de manieren om erachter te komen welke privacyrisico’s mensen lopen wanneer informatie over hen wordt verzameld, gebruikt, opgeslagen of gedeeld. Dit helpt de Londense gemeente Barnet problemen te vinden zodat risico’s kunnen worden weggenomen of verlaagd tot een aanvaardbaar niveau. Het bezuinigt ook op inbreuken op de privacy en klachten die de reputatie van de Raad kunnen schaden of leiden tot actie van de Information Commissioner (de waakhond van de regering).

De London Borough of Barnet maakt DPIA’s openbaar in zijn Data Charter en de Data Protection Act 2018 en UK GDPR.