This paper concentrates on the legal basis of processing personal data in the context of the employment background screening role. Although this is a specialised task, it serves as a useful exercise for any enterprise evaluating the legal basis of processing personal information, especially when third parties are involved. When conducting employment background screening, the roles of the parties involved need to be clearly outlined. If a third party screening company is used, they may be a data processor, which requires specific contractual language. If they are a data controller, then joint controller language will need to be completed, as the employer and background screener have entirely separate roles in the data processing. Determining the legal basis of processing is primarily completed by the hiring organisation, as only they know who they are screening and why. Although the term ‘consent’ is commonly used in the background screening process, it is rarely allowable in General Data Protection Regulation (GDPR) or GDPR-like privacy regulations but may be the primary legal basis of processing in other countries. This can set up a conflict of laws for the hiring organisation, which they will have to navigate through. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.

Humanitarian organisations often operate in emergency contexts where strict compliance with data protection laws, such as the General Data Protection Regulation (GDPR), can pose significant practical challenges. This paper explores the need for a differentiated data protection regime tailored to the realities of humanitarian crises, balancing efficiency and the fundamental rights of data subjects. By analysing key European Court of Justice cases, including Schrems II (C-311/18), Nowak (C-434/16) and Pankki S (C-579/21), the paper highlights the importance of adapting core GDPR principles to crisis situations. It also examines the integration of human rights principles, emphasising the protection of dignity and autonomy during emergencies. Furthermore, it addresses regulatory challenges, proposing proactive engagement with authorities to ensure accountability and trust. Practical solutions are proposed such as simplified Data Protection Impact Assessments (DPIAs), the use of pseudonymisation, data minimisation and standardised Memorandums of Understanding (MOUs) to replace complex contractual requirements. These measures aim to ensure compliance while enabling rapid and effective responses in emergencies. The paper concludes by calling for the development of a flexible regulatory framework that integrates data protection into the operational needs of humanitarian organisations without compromising ethical and legal standards.

The digital landscape has witnessed a significant transformation since the introduction of cookies in the mid-1990s, evolving from simple user tracking mechanisms to complex tools integral to online user experiences and targeted advertising. This evolution, however, has not come without consequences; the proliferation of cookies has raised substantial concerns regarding user privacy and data security, prompting the development of regulatory frameworks such as the General Data Protection Regulation (GDPR)1 and the ePrivacy Directive.2 This paper undertakes a critical analysis of the intricate intersection between cookies, the ePrivacy Directive and the GDPR, with a particular focus on the IAB Belgium ruling.3 This landmark case has catalysed significant changes in consent practices, reshaping the digital advertising ecosystem and compelling businesses to reassess their data protection strategies. Notably, the ruling reinforces the primacy of consent under GDPR for cookie deployment, particularly in the context of personalised advertising. The decision also brings into stark relief the unresolved tension between consent-based models and the use of legitimate interest as an alternative legal basis for data processing. While the IAB Belgium ruling firmly aligns with the GDPR’s stringent consent requirements, the European Court of Justice’s (ECJ) subsequent rulings on legitimate interest introduce a potential divergence. For example, in the Koninklijke Nederlandse Lawn Tennisbond (KNLTB) case,4 the court recognised commercial legitimate interest as a lawful basis for processing data, yet this recognition did not extend to cookies, which are central to behavioural advertising and commercial profiling. The recent European Data Protection Board (EDPB) guidelines5 further complicate this regulatory landscape, as they emphasise the need for legitimate interest assessments but offer limited insight into how this legal basis should apply to cookies. This confluence of judicial and regulatory decisions underscores the ongoing challenges in harmonising legitimate interest with cookie-related data processing, calling for a more cohesive regulatory framework. As organisations navigate this complex regulatory environment, the insights provided in this paper aim to serve as a valuable resource for understanding the evolving dynamics of cookie compliance and the broader implications for data protection in the digital age. The paper ultimately seeks to inform stakeholders of the pressing need for accountability and user-centric approaches in the realm of digital privacy.

This paper takes an overview of case law legislation and professional guidance to assess when it may be acceptable for medical practitioners to breach patient confidentiality and data protection law in the public interest. It looks at the implications of making such decisions in both a positive and negative light because of what happens if confidentiality is breached in the public interest, but also the implication, on occasion, if it is not. The paper synthesises the often contradictory considerations of the Data Protection Act 2018 and UK General Data Protection Regulation with the wider implications of breaching the common law duty of confidentiality and professional guidance offered by the likes of the British Medical Association, General Medical Council and right back to the Hippocratic Oath. In doing so, it creates a framework in which it is acceptable in many circumstances to breach patient confidentiality while demonstrating that due care and attention are required to ensure the appropriate decisions are made.

This paper investigates the role of synthetic data in the field of health research, with a particular focus on data protection. More specifically, it aims at clarifying whether this new technology represents an alternative to more classic anonymisation techniques. The analysis is construed on a review of the existing literature; nevertheless, it is noted that the majority of contributions focuses on the technical aspects of synthetic data and machine learning, while less legal studies have been conducted on this topic. The outcome of this study outlines that, by using synthetic data which respects the ‘privacy by design’ principle (although the identifiability risk still exists), researchers are no longer occupied by the question of re-identification but rather focus on the quality and utility of synthetic datasets. After examining the different solutions applied to enshrine privacy, however, this paper concludes there is a necessity for regulating the use of artificially generated data for research and machine learning purposes.