Data, Privacy and Cyber

Our team is recognised for its practical, pragmatic approach. We pride ourselves on our ability to digest complex issues of law and regulation into accessible, commercial advice, enabling our clients to maximise their use of data and respond to challenges whilst managing complex risks.

We regularly initiate protective legal proceedings for clients, including injunctive relief. Successful proceedings include persons unknown proceedings following cyber-attacks and applications against rogue individuals. We also have extensive expertise and experience in defending individual and mass privacy claims.

Many of our clients are part of a global group. We are able to draw upon expertise across our international offices and network of trusted partners to provide a solution for handling significant projects, or responding to global incidents.

We advise clients across all sectors but have particular expertise in advising clients in financial services (includes insurance); health and social care; real estate; and technology. This sector expertise means that our lawyers are able to advise specifically in the context of industries which have their own, unique challenges.

As well as providing bespoke solutions to our client's needs, we have specific, fully outsourced offerings which includes data protection healthchecks, handling of data subject access requests, corporate due diligence and data breach response planning. We also provide cyber insurance incident response services.

Featured experience

• Advising a global health tech company using AI to improve patient health outcomes on their entry into the UK market and establishment of a worldwide performance benchmarking programme.
• Leading a series of complex data protection impact assessments for an insurer relating to the use of personal data for pricing, claims handling and fraud detection.
• Advising clients facing regulatory action, with successful appeals against regulatory sanctions.
• Acting in cyber and privacy litigation, including persons unknown injunctions (Ince Group, Pendragon, Armstrong Watson), injunctive proceedings against known persons (Notting Hill Genesis) and some of the leading defensive privacy cases (e.g. Johnson v Eastlight [2021]).
• Advising an investment bank on complex employee privacy matters and providing a fully outsourced end to end subject access request service.
• Advising on the use of facial recognition technology.
• Strategic advice regarding the use of footfall analytics technology.
• Advising a data science accreditation provider on its data protection strategy including for data transfers post Schrems II.
• Advising a leading chain of private fitness and leisure clubs in relation to data protection considerations arising out of the launch of a member app.
• Supporting an international fintech supplier in relation to various data protection issues, including overseas transfers, liability for data protection breaches and obtaining consent for direct marketing contents.