I am Head of the Data & Privacy department at Bates Wells. I have advised on a wide range of data protection issues, ranging from general compliance to specific queries arising in individual projects, products and services, and have assisted a number of clients to navigate complex and often contentious data protection issues (including subject access requests and data breaches).
I have significant experience on advising on the intersection between data protection and a number of other sectors and areas of law, including in the context of charity, law, commercial, employment, safeguarding and investigations. I work closely with colleagues across the firm to ensure that the advice we provide is thorough, accurate and pragmatic.
- Assisted a number of organisations, headquartered in both the US and UK, with EU and UK GDPR-compliance, including assessments of the applicability of the GDPR and direct marketing rules under PECR and preparation of privacy notices (including website, beneficiary, employee and volunteer privacy notices), data processing agreements, internal data protection policies, responding to subject access requests, handling data breaches as well as other documentation.
- Assisted organisations with assessing the data protection implications of corporate transactions and mergers, including data processing terms, due diligence, and warranties in share purchase agreements.
- Assisted a number of global organisations to assess the privacy implications of various projects and technologies, both from a data protection perspective and in light of wider privacy concerns.
- Advised various life science and other organisations on data protection compliance regarding data protection impact assessments, data sharing agreements and privacy policies in the context of scientific research, often involving large volumes of highly sensitive data.
- Advised a global non-profit on understanding the impact of AI and developing a policy to identify and mitigate the risks of generative AI.
- Advised a charity on the data protection implications of implementing an AI chatbot.
- Advised a worldwide youth organisation with a complex subject access request regarding an employment dispute.
- Advised a number of organisations on handling data breaches, including correspondence with the ICO and affected individuals.
- Advised a number of organisations on handling claims for compensation from individuals, including in data breach and other contexts.
- Advised on the implications of data protection in the context of awarding organisations, including the use of AI as part of examinations and proctoring.