Data Protection Top 10

<p>Mark heads Bristows’s data protection practice and is also leader of the firm’s technology sector group. He has a doctorate in semiconductor physics from the University of Oxford and specialises in how data protection works in a technology context, particularly new technologies, such as cloud computing, AI, facial recognition and Adtech. For several years, Mark was in-house at IBM where he held various roles, including that of Global Data Privacy Counsel.</p> <p>Mark’s practice comprises helping clients to establish proportionate and pragmatic compliance programs globally, product counselling for several of the largest technology companies and representing companies in connection with regulatory enforcement. Mark has defended companies in several of the largest, most high profile regulatory enforcement actions in the world, both in respect of data breaches and also data misuse cases.</p>

<p>Hannah’s practice covers a wide range of EU and UK data protection and privacy issues, including AI, adtech, “accountability”, data transfers, data subjects rights and direct marketing. She has particular experience in emerging technologies, helping clients find a pragmatic pathway to achieving legal compliance whilst still using data to innovate.</p> <p>Her practice also includes a significant amount of contentious work, advising clients on managing personal data breaches and enforcement by the European data protection authorities. She has worked on many of the most high profile GDPR enforcement actions by the UK Information Commissioner’s Office and other EU data protection authorities, including the CNIL and Irish Data Protection Commission.</p> <p>Hannah also advises extensively on the increasing intersection between privacy and other digital regulations, including competition and consumer law, the Digital Services Act, Digital Markets Act and Online Safety Act.</p>

<p>Marc helps clients to evaluate and manage data protection and cyber risk in cross-border compliance programs, in technology projects involving the development of machine learning/artificial intelligence, Internet of Things, cloud applications, in life sciences and medical device projects covering healthcare apps, remote diagnostics, clinical trials and investigations and genomic research, and in the financial services sector across the lifecycle of product development and FinTech applications.</p> <p>Marc also advises on cyber security incidents, and regulatory investigations and disputes involving data protection, misuse of private information and breaches of confidentiality, and has experience of devising voluntary redress schemes for individuals affected by such misuse or breaches.</p> <p>In the area of digital regulation, Marc assists clients to navigate the EU’s digital services legislative framework, advising amongst others on the Data Act, the DSA, NIS2, DORA and related legislation.</p> <p>Some of Marc’s work highlights include:</p> <ul> <li><strong>Defending</strong> a global advertising technology platform <strong>against proceedings</strong> brought by a leading privacy campaigner for alleged breaches of GDPR i<strong>n the field of real time bidding.</strong></li> <li>Advising on numerous <strong>cyber incidents</strong>, with a sector focus advising banks, law firms and barristers chambers on <strong>responding to incidents</strong> and on <strong>subsequent investigations and enforcement action</strong> by data protection authorities.</li> <li><strong>Defending</strong> a leading global advisory services firm against threatened <strong>SLAPP proceedings</strong> and advising them on numerous <strong>subject access requests.</strong></li> <li>Advising <strong>providers and deployers of AI</strong>, including a sector focus in <strong>HR</strong>, advising international leadership consulting firms on the <strong>development of AI</strong> in the field of recruitment and performance management.</li> <li>Defending a multinational <strong>data analytics and consumer credit reporting </strong>company in <strong>enforcement proceedings</strong> brought by the <strong>ICO.</strong></li> <li> Advising firms in the life sciences and healthcare sectors on the full range of GDPR issues in their sector, including research institutions on <strong>anonymised data</strong>, pharmaceutical companies on <strong>medical research and clinical trials</strong>, medical device companies on development of devices, an NGO in the field of <strong>vaccine development against pandemics</strong>, and a global leading university on <strong>Freedom of Information</strong> and on <strong>international data transfers.</strong></li> <li>Advising <strong>banks in the UK, EU and Middle East</strong> on data transfer impact assessments, the adoption of <strong>cloud</strong>, <strong>AI customer service operations</strong> and <strong>anti-fraud technologies.</strong></li> <li>Advising <strong>technology suppliers</strong> on the development and supply of technologies with a particular focus on <strong>EU ePrivacy</strong> rules and their intersection with the GDPR.</li> <li>Advising a <strong>Chinese FinTech</strong> on GDPR compliance in the development of its <strong>AML solutions</strong> for banks.</li> <li>Supporting a leading <strong>global car manufacturer </strong>on its <strong>connected vehicle strategy.</strong></li> <li>Advising a <strong>FTSE100 retailer</strong> on a range of GDPR compliance issues.</li> <li>Defending firms in several sectors against <strong>noyb</strong> complaints.</li> <li>Supporting our <strong>Corporate and Medical Regulatory teams</strong> on data protection due diligence on a range of <strong>mid-tier acquisitions and disposals</strong>.</li> <li>Advising an <strong>MVNO</strong> on its obligations under <strong>UK interception of communications legislation</strong> and on a range of GDPR issues.</li> <li>Supporting a <strong>multinational commodities company</strong> on its end-to-end GDPR compliance programme.</li> <li>Developing <strong>BCRs</strong> for a global <strong>management consulting and technology firm.</strong></li> </ul> <p>Marc advises on both UK and EU law, covering GDPR, the Data Protection Act 2018 and the ePrivacy Directive, the Network and Information Systems Regulations including NIS2, DORA and the Cyber Resilience Act, the Digital Services Act, the EU AI Act and the EU Data Act, the Freedom of Information Act and Environmental Information Regulations, the Investigatory Powers Act and the data protection and security aspects of financial services legislation and regulation (such as PSD2 and the SYSC rules in the FCA Handbook).</p> <p>Marc is a member of the International Association of Defense Counsel, International Association of Privacy Professionals and ITech Law.</p> <p>Marc has a good working knowledge of German and Swedish.</p>

<p>Jamie’s practice includes advising clients on a wide range of privacy and data protection issues, including:</p> <ul> <li>responding to regulatory investigations and data breaches arising from security incidents;</li> <li>managing contentious data subject complaints and rights requests;</li> <li>assessing privacy risks in the context of new lines of business and the adoption of new technologies, in particular in relation to adtech and AI;</li> <li>user notification and consent issues (including implementing appropriate consent management platforms for online users);</li> <li>issues of anonymisation and pseudonymisation; and</li> <li>drafting and negotiating complex data processing and transfer agreements.</li> </ul> <p>He has particular expertise advising clients on ad-tech compliance issues, in terms of navigating ePrivacy and GDPR requirements in the context of data collection, online tracking and profiling.</p> <p>Jamie also has experience in drafting Binding Corporate Rules (BCRs), both for processors and controllers, and in helping clients to navigate the complex BCR application and review process.</p> <p>He also helps clients respond to data breach incidents, and defend regulatory enforcement action across Europe. He has also worked on high profile data protection litigation in the English High Court.</p> <p>Jamie’s work highlights include:</p> <ul> <li>Acting for a global video sharing platform on a regulatory investigation regarding alleged unlawful processing of user data and related litigation.</li> <li>Acting for a global social media platform on legal proceedings concerning the training of a generative AI model.</li> <li>Advising a major adtech platform on a major regulatory investigation, litigation and a range of privacy compliance issues.</li> <li>Advising a major airline on a range of adtech compliance issues.</li> </ul> <p>Jamie also has experience advising clients on issues arising from freedom of information legislation.</p> <p>He is a member of the Society of Computers & Law as well as the International Association of Privacy Professionals.</p>

<p>Mac has over 20 years’ experience advising on <a href="/expertise/regulatory-advisory/data-protection-privacy/">data protection and privacy</a> issues, including responding to data subject rights requests, managing data breaches, drafting customer-facing privacy policies, and cross-border data transfers. She also has extensive experience managing multi-jurisdictional compliance projects.</p> <p>Mac advises clients in a wide range of industries, but has particular experience with <a href="/expertise/sectors/life-sciences/">life sciences</a>, connected vehicles, and financial services. She has worked with universities, biobanks and pharmaceutical companies on a wide range of matters, including projects involving medical devices, clinical trials and investigations, healthcare apps, genomic research, and cross-border research projects. She has extensive experience advising on data sharing, data re-use (including in the context of AI developments) and issues around pseudonymisation and anonymisation of data in these contexts.</p>

<p>Mike specialises in technology and data privacy.</p> <p>He advises businesses on a range of data protection and privacy issues, including some of the world’s largest technology companies. This work includes developing privacy compliance programs, product counselling, carrying out risk assessments, and engaging with supervisory authorities. He also assists companies with preparing and negotiating technology-focused contracts, and implementing data sharing and international transfer arrangements.</p> <p>Mike is experienced in helping clients navigate highly regulated sectors, including the digital services, telecoms and financial sectors, and regularly advises on new and developing technologies, such as AI and biometrics.</p> <p>He has extensive experience of in-house work, including secondments with a large technology company and in the telecoms sector.</p>

<p><span data-contrast="none">Emma advises a wide range of UK and multinational clients on <a href="/expertise/regulatory-advisory/data-protection-privacy/">data protection and privacy</a> issues. Her practice includes assessing privacy risks in the context of new product launches, the use of AI, data subjects’ rights, data transfers (including Binding Corporate Rules), global compliance programmes, and direct marketing.</span></p> <p><span data-contrast="none">Emma has significant experience acting for clients facing regulatory investigations and enforcement action from data protection authorities. She has worked on several high profile GDPR enforcement actions by the UK Information Commissioner’s Office and the Irish Data Protection Commission. She also has experience of working on data protection litigation before the English High Court.</span></p> <p><span data-contrast="none">In 2022, Emma spent time on secondment at the legal team of the UK’s Information Commissioner’s Office, in which she worked on policy and contentious regulatory matters.</span></p> <p><span data-contrast="none">Emma has also completed a number of client secondments. From 2018-2019, she spent time on secondment in the legal department of a US social media company, gaining extensive experience of the data protection and privacy issues facing businesses operating in the TMT sector. In 2018 she also spent time at the legal team of a leading energy company based in Singapore where she assisted with the implementation of the client’s global privacy programme. During her training contract Emma was seconded to the in-house team of a leading US technology company, working in the UK and EMEA litigation team.</span></p>

<p>Will is an associate in the commercial IP, IT and data privacy team at Bristows, having joined the firm as a trainee in 2019 and qualified into the team in 2021. He advises clients on various commercial IT and data protection matters with a particular focus on the life sciences, media and technology sectors.</p> <p>Will’s experience covers day-to-day commercial and IT matters including negotiating software licences, assisting clients in launching their SaaS offerings and working on outsourcing agreements. Will also provides ongoing commercial advice to a number of clients through long term retainers.</p> <p>A key area of Will’s work involves assisting clients enter the health tech sector. For example, this may involve preparing the T&Cs and privacy policy for connected medical devices and advising on how to commercialise existing IP using new technologies.</p> <p>Will also has experience of working on data protection matters which includes coordinating global privacy law surveys, preparing and implementing compliance programmes and advising on direct marketing rules. Will has also assisted a number of companies in responding to enquiries from data protection authorities, including in relation to how cookie banners are implemented.</p> <p>In the life sciences sector, Will’s experience includes negotiating data processing and data sharing agreements in the context of clinical trials, advising on the legal basis for processing special category data and assisting in the appointment of DPOs.</p> <p>During his secondment to a global technology company, Will also gained experience in responding to data protection and defamation complaints made by individuals, in particular in relation to the right to be forgotten.</p>

<p>Elisa is an associate in the commercial technology and data protection team at Bristows and advises clients on all aspects related to data privacy and technology transactions.</p> <p>She has experience in drafting and negotiating a broad range of technology contracts covering software licensing, joint ventures, AdTech, artificial intelligence, telecoms and outsourcing. Through her work and in-house experience, Elisa has gained an in depth understanding of how global technology companies and software vendors operate and advises clients on cross-border digital transformation projects. For example, Elisa has assisted clients on the development and commercialisation of new technology platforms and the launch of new AI solutions in Europe. As part of this, Elisa also provides guidance on consumer law and e-commerce regulations.</p> <p>Elisa also advises large data rich companies on a range of data protection and privacy issues, with a particular focus on companies operating in the technology and life sciences sectors. Her work ranges from implementing broad compliance programmes to product specific advice on complex areas of data privacy laws. She has also gained experience in negotiating global data transfer agreements and has advised clients in responding to regulatory enforcement actions by data protection authorities.</p> <p>Elisa spent time on secondment in the legal department of Google DeepMind, where she provided product counselling and advised on the development and launch of multiple AI models, including high profile launches such as AlphaFold. She also completed a secondment at a multi-national software company, gaining extensive experience in negotiating SaaS agreements.</p>