These Workshops can be booked separately or in conjunction with the Conference.  Attendance at the Workshops by Conference delegates is optional but it is anticipated that most Conference delegates will wish to attend one or more of the Workshops.  Lunch will be provided at the venue starting at 12.45pm.

Each Workshop is accredited by the Law Society with 3 CPD Points.

The Workshops were really useful
Sally Jackson, Partnership Office Assistant, Allen & Overy LLP

Morning Sessions   ( 9.30am – 12.45pm )
 

A:  Data security and data breaches: being prepared

Workshop led by Dan Cooper - Special Counsel, Covington & Burling

Data security and responding to data breaches is high on the compliance agenda. In this Workshop, delegates will be given practical guidance for managing security and dealing with a security breach incident, including a consideration of:

• the current regulatory landscape
• recent high-profile cases
• guidance from the Information Commissioner, the FSA and other authorities
• the major sources of potential liability for organisations that suffer a data breach
• measures organisations can introduce to lessen the likelihood of a breach
• measures to cope with a breach, if it occurs
• whether to notify individuals, the content and timing of such communication, liaising with regulators, and managing the media
   

B:  E-marketing and behavioural targeting: the latest thinking

Workshop led by Eduardo Ustaran - Partner, Field Fisher Waterhouse

More organisations are engaging in e-marketing and behavioural targeting in order to reduce advertising costs and raise effectiveness.  However, these activities raise serious data protection issues.  In this Workshop, delegates will consider:

• the rules on e-marketing
• whether behavioural targeting is lawful
• whether anonymous data can ever be personal data l how to inform Internet users about profiling activities
• whether consent is required, and whether to use opt-in or opt-out devices
• how to comply with access rights
• how to lawfully market to your own customers
• the regulators’ opinions and recent court cases
   

Eduardo is a regular contributor to legal and industry journals and has taken part in many UK and international speaking engagements.  He is co-author of E-Privacy and Online Data Protection ( Tottel, 2007 ) and of Data Protection Handbook
( Law Society, 2nd Ed. 2008 ).

C:  Using data protection policies to your advantage

Workshop led by Hazel Grant, Partner, Bird & Bird

Organisations ideally need data protection policies for general data protection responsibilities, website privacy issues, acceptable use and employee monitoring, rights of subject access, CCTV usage and whistle blowing issues.  This Workshop shows how organisations can use policies to make information management more efficient and effective.  Using sample policy documents, this Workshop covers:

• the ICO guidance on drafting policies
• using policies to educate employees and customers
• using policies to control the release of information
• the “organic” model: keeping policies up to date
• when and how to make policies enforceable
• relying on your policies in disputes
• the international issues: differing views from other EU jurisdictions
   

Afternoon Sessions   ( 2.00pm – 5.15pm )
 

D:  Identifying personal data

Workshop led by Quentin Archer - Partner, Lovells

There has been considerable debate in the UK and the rest of Europe concerning the meaning of ‘personal data’, and UK court decisions have been criticised by EU authorities.  Despite guidance issued by the Article 29 Working Party and the Information Commissioner, many practical difficulties remain.

This Workshop looks at the key principles which organisations should bear in mind when identifying and disclosing personal data, including:

• what constitutes “personal data” in a normal business context
• reviewing the guidance on “personal data”
• the significance of the definition of “personal data” when responding to a request for information from data subjects and third parties
• considering controversial aspects of personal data, including the definition of a “relevant filing system” and whether an IP address constitutes personal data
   

E:  Data protection issues in the workplace

Workshop led by Ann Bevitt - Partner, Morrison & Foerster and Karin Retzer - Of Counsel, Morrison & Foerster

The processing of employee data raises many data protection issues.  In some cases the law requires organisations to implement measures that are counter-intuitive.  This Workshop provides guidance on several topical issues including:

• monitoring employees and using location data
• handling health and biometric data
• performing background checks when hiring new employees
• testing staff and how to use the results
• the use of model clauses in relation to employee data
• the use of new technologies such as Facebook, MySpace and portable devices
   

F:  How to manage an international compliance programme

Workshop led by Rosemary Jay - Partner, Pinsent Masons

Managing a data protection compliance programme across multiple jurisdictions is a large challenge involving many different people, cultures and regulations.  This Workshop provides practical advice for implementing such a compliance programme, including:

• establishing the project team and allocating responsibility among the team members
• assessing the critical compliance issues in each jurisdiction
• determining when to use local standards and when to use global standards
• assessing critical compliance issues for each jurisdiction
• dealing with resistance to the programme from inside the organisation
• revealing pitfalls to avoid