Phil Brining

AI in Housing: The NHF Report Explained

The National Housing Federation has published a new report, The State of AI in Housing 2025, produced with IT services provider Phoenix, looking at how housing associations are adopting artificial intelligence, the opportunities it offers, the risks it creates, and how ready the sector actually is. It is not new legislation and does not create new legal duties, but it is genuinely useful sector insight for any housing provider already using AI, considering it, or finding that colleagues are quietly experimenting with it already.

AI adoption in housing is already well underway

The headline finding is that AI is not a future consideration for housing, it is already in day-to-day use. The report found that 47% of respondents are using AI in their daily operations, with a further 23% not using it yet but planning to. Current use cases span internal administration, data handling, compliance checks, resident communications and service delivery.

Confidence and governance haven’t kept pace with adoption

The report also shows a sector that is moving faster than its own readiness. 87% of respondents rated their knowledge of AI as low, and 44% have no AI policy in place at all. That gap, widespread use alongside limited confidence and limited governance, is the part of the report worth paying closest attention to. AI can genuinely help a housing provider save time, support staff and improve services, but it should never be treated as a straightforward technology purchase or a way around existing data protection obligations.

The same data protection questions still apply

Whatever the tool, the same questions need answering before personal data goes anywhere near it. What is the purpose? Is the use necessary? What is the lawful basis? Have people been told clearly what is happening with their data? Is the information secure? And are you confident the tool itself is accurate and fair?

These questions carry extra weight in housing specifically, given the nature of the data involved, often including residents’ health, financial circumstances, vulnerabilities, safeguarding concerns and household situations.

Where the real risks sit

The report highlights privacy and security, bias and discrimination, accountability, and inaccurate AI-generated information as the key areas to watch. AI can produce an answer that sounds entirely convincing while being wrong, and it can reflect bias baked into the data it was trained on. That matters most where AI could influence decisions about residents, allocations, arrears, complaints handling, vulnerability assessments or safeguarding.

The safest approach is straightforward: do not let AI make high-impact decisions about individuals without a proper assessment, meaningful human involvement, and a clear route for someone to challenge the outcome.

A sensible way to adopt AI, according to the report’s own case studies

The organisations getting this right in the report’s case studies followed a similar pattern: start with a lower-risk use case, secure genuine leadership support, involve staff early, and put governance in place before the project expands rather than after.

Four steps worth taking now

Based on the report’s findings, four immediate actions stand out for any housing provider:

• • Find out which AI tools are actually being used across the organisation, including tools staff may be using independently without anyone else knowing.
  • Put clear guidance in place so staff know exactly what can and cannot be entered into an AI tool. Personal, confidential and special category data should never go into an unapproved tool.
  • Carry out proper due diligence on any AI supplier, understanding the contract, where data is processed, whether there are international transfers, and what security measures are actually in place.
  • Assess higher-risk uses properly. Where an AI project could create a high risk to people’s rights and freedoms, a Data Protection Impact Assessment may be required before processing begins.

Adopt AI thoughtfully, not cautiously or carelessly

The message from the report isn’t to avoid AI, it’s to adopt it thoughtfully. Innovation and data protection aren’t competing priorities. Good governance, clear policies, trained staff and proper oversight are what give a housing provider the confidence to use AI in a way that protects residents, supports staff and builds trust.

For housing associations without the in-house resource to build that governance from scratch, this is exactly the kind of gap an outsourced DPO is built to close, bringing practical AI policy development, supplier due diligence and DPIA support without needing to build the capability internally. If you’re considering an AI project, reviewing a supplier, or need support with an AI policy or DPIA, speak to your Data Protection Officer or get in touch with the Data Protection People team.

Untangling Misconceptions Around Recording Meetings

Untangling Misconceptions Around Recording Meetings

In this week’s episode of the Data Protection Made Easy Podcast, we delve into the complex world of recording meetings and dispel some common misconceptions. Joined by data protection experts Jasmine Harrison, Joe Kirk, and Phil Brining, we unravel the intricacies of ensuring data protection and compliance during recorded meetings.

Key Data Protection Considerations

1. Purpose and Necessity: Before recording a meeting, it is essential to establish a clear and legitimate purpose for the recording. Ensure that the recording is necessary for a specific business objective and that there are no less intrusive alternatives.
2. Consent: Obtain explicit consent from all participants before recording a meeting. The consent should be informed, meaning participants should be aware of the purpose of the recording, the duration, who will have access to the recording, and how it will be stored.
3. Data Minimisation: Only record the necessary parts of the meeting. Avoid recording irrelevant or excessive information.
4. Data Security: Implement robust security measures to protect recorded data from unauthorised access, alteration, or disclosure. This includes encryption, access controls, and regular backups.
5. Data Retention: Establish a clear data retention policy for recorded meetings. Determine how long recordings will be kept and when they will be deleted or archived.
6. Transparency: Inform participants about the recording and provide them with information about their rights, such as the right to access, rectify, or erase their personal data.
7. Data Protection Impact Assessment (DPIA): For high-risk data processing activities, such as recording meetings involving sensitive personal data, conduct a DPIA to assess the risks and identify appropriate safeguards.

Common Misconceptions

• Implied Consent: Simply informing participants that a meeting is being recorded does not constitute implied consent. Explicit consent is required.
• Internal Use Only: Recordings made for internal use only are still subject to data protection laws.
• Anonymisation: Anonymising recorded data does not necessarily eliminate privacy risks.
• Cloud Storage: Storing recordings in the cloud may pose additional security risks.

Best Practices for Recording Meetings

• Use Secure Recording Equipment: Ensure that the equipment used for recording is secure and compliant with data protection standards.
• Implement Access Controls: Restrict access to recorded data to authorised personnel only.
• Regularly Review and Delete: Regularly review recorded meetings and delete those that are no longer necessary.
• Provide Clear Information: Inform participants about the recording at the beginning of the meeting and provide them with clear information about their rights.

Recording meetings can be a valuable tool for businesses, but it is essential to do so in compliance with data protection laws. By following the guidelines outlined in this article, organisations can ensure that their recording practices are lawful and protect the privacy of individuals. If you have any unanswered questions, feel free to reach out to a member of our team: Contact Us.

Tune in to all 185 episodes of the Data Protection Made Easy podcast on all major-audio streaming platforms including Spotify.

Listen on Spotify here: https://open.spotify.com/episode/3V0SW8HNxXHT39r8vIWooF?si=jPZQK9SBQv-l26tLwZ35bQ

The Role of a DPO: A Deep Dive

Podcast: The Role of a DPO: A Deep Dive

In this episode, we delve into the crucial role of the Data Protection Officer (DPO) in the UK. We discuss the specific responsibilities outlined in the UK GDPR, the potential conflicts of interest that can arise, and how organisations can ensure that their DPOs are operating independently and effectively.

The Essential Tasks of a DPO

The UK GDPR mandates that certain organisations appoint a DPO to oversee data protection compliance. Key responsibilities of a DPO include:

• Informing and advising the organisation on data protection obligations
• Monitoring compliance with data protection laws and internal policies
• Providing advice on Data Protection Impact Assessments (DPIAs)
• Acting as the primary contact point for the Information Commissioner’s Office (ICO)
• Handling data subject requests
• Assisting in data breach response and reporting
• Providing data protection training for staff

Avoiding Conflicts of Interest

A DPO must operate independently to effectively fulfil their role. Conflicts of interest can arise when the DPO‘s other responsibilities within the organisation could influence their judgment or decision-making regarding data protection. Common roles that may present conflicts include:

• Finance: A focus on cost minimisation might lead to compromises in data protection measures.
• Human Resources: Managing sensitive employee data can create challenges in maintaining objectivity.
• Information Technology: Overlap in responsibilities can impact the DPO’s ability to ensure data protection compliance.
• Sales and Marketing: Prioritising revenue generation might lead to shortcuts in data handling practices.
• Directors/Chief Officers: Strategic focus on business operations can overshadow data protection priorities.

How to Ensure a DPO’s Independence

To prevent conflicts of interest, organisations should:

• Clearly define the DPO’s role, responsibilities, and reporting lines.
• Establish robust governance structures, such as a data protection committee.
• Regularly assess potential conflicts and implement mitigation strategies.
• Consider outsourcing the DPO role to a third party.

Conclusion

The role of the DPO is essential in ensuring compliance with data protection laws and protecting individuals’ privacy rights. By understanding the DPO’s responsibilities and avoiding potential conflicts of interest, organisations can effectively safeguard their data and mitigate risks.

Additional Resources

• Information Commissioner’s Office (ICO) Guidance on DPOs
• Data Protection People’s Outsourced DPO Service

GDPR Radio – Episode 182

Unlocking Data Protection: Quality, Governance, and Legal Complexities with Industry Experts

Welcome to this week’s episode of Data Protection Made Easy podcast, where hosts Jasmine Harrison, Joe Kirk, and Phil Brining delve deep into the world of data protection, unraveling the complexities of quality, governance, and legalities. Led by experts from Data Protection People, our hosts work with a huge range of clients every day, together, they expert insights and advice surrounding data protection. If you’re serious about mastering data integrity and compliance, this episode is a treasure trove of expert insights and practical advice.

Mastering Data Integrity and Compliance

The episode kicks off with a comprehensive discussion on data quality, software solutions, and consulting. Jasmine, Joe, and Phil spotlight their exciting new partnership with a cutting-edge data management firm that offers innovative solutions to enhance data quality beyond just personal data. They explore how these advancements can help organisations navigate the tough terrain of processor contracts and ensure compliance with multiple controller relationships.

Navigating Data Contracts and Legalities

One of the highlights of this episode is the in-depth analysis of processor contracts. Joe raises a critical question: Can a single overarching agreement suffice for multiple controllers, or are individual contracts necessary? The discussion covers the legal requirements of Article 28.4, the practical challenges of managing these agreements, and real-world scenarios that emphasise the importance of maintaining compliance while dealing with complex contract frameworks.

Revolutionising Data Quality with AI

Jasmine shares an intriguing case study on Everton Football Club’s transition from Siebel to Salesforce, showcasing how this shift revolutionised their data management operations. The conversation extends to the significance of data quality measures, especially as AI becomes integral to organisational strategies. The hosts debate the universal applicability of data classification schemes and the various contexts that necessitate different levels of data accuracy.

Challenges in Data Management and Protection

Phil sheds light on the often-overlooked inconsistencies in GDPR and ISO guidelines, highlighting differences in interpretations between German and UK contexts. This leads to a broader discussion on the importance of governance, the practical benefits of information asset registers, and how these elements contribute to compliance with standards like ISO 27001 and GDPR.

The Future of Data Protection and Compliance

The episode also features a detailed exploration of sub-processor agreements within the context of UK GDPR. Joe and Phil dissect the legalities surrounding these agreements, emphasising the importance of imposing the same data protection obligations on sub-processors as on processors. They share various perspectives on managing these agreements, considering factors such as the nature of services, contract variations, and specific requirements like breach notification timelines.

Responsibilities and Liabilities in Data Protection

The conversation takes a critical turn as the hosts examine the complexities of liability between data controllers and processors, particularly in light of a significant data breach involving the Advanced Computer Software Group. They discuss the challenges controllers face in ensuring that processors have robust security measures and the implications of processor failures despite due diligence. The episode underscores the need for thorough audits and role of the ICO in enforcing compliance.

Duties of Data Protection Officers

In the final segment, the hosts delve into the responsibilities of Data Protection Officers (DPOs), drawing insights from the latest directives by the Brazilian National Data Protection Authority. They discuss varying interpretations of a DPO’s duties, including security incident reporting, data protection impact assessments, and internal oversight mechanisms. The conversation also touches on the resignation of the UK’s Biometrics and Surveillance Camera Commissioner and the implications of advancements in facial recognition technology.

Final Thoughts

This episode of Data Protection Made Easy podcast is packed with essential information for anyone serious about data protection. From practical advice on data quality and governance to deep dives into legal complexities and future trends, Jasmine, Joe, and Phil provide a well-rounded perspective on the current and future state of data protection. Our hosts run two kinds of sessions. This week’s episode is called GDPR Radio, which takes place every other week. These are alternated with more topic-focused sessions. The GDPR Radio sessions are more relaxed; we discuss the news from the last two weeks (since the previous episode), any updates to laws or legislation, and take live Q&As from our audience.

If you would like to join us on future episodes, you can visit our events page and either request to join specific discussions or request to subscribe and benefit from weekly invites to insightful sessions where our experts share opinions. You can have the chance to ask our hosts questions live on air, make use of the live chat, benefit from links shared in the chat, visuals from the episode, and most importantly, network with like-minded individuals.

Stay tuned, stay compliant, and stay ahead with Data Protection Made Easy podcast!

RoPA Round Up (Part 2)

Effective ROPAs, Cybersecurity Updates, and Building a Proactive Culture

Welcome back to another insightful episode of Data Protection Made Easy! In our latest instalment, we delve deep into the multifaceted world of data protection and cybersecurity, offering you practical advice, timely updates, and real-world stories that underscore the importance of maintaining robust data protection practices. Here’s what you can expect from this episode:

• 0:03:46 – Risk Identification in ROPAs
• 0:07:14 – Facial Recognition vs Blacklist Comparison
• 0:14:58 – US Data Protection and Online Safety
• 0:21:10 – Maintaining Data Processing Documentation
• 0:31:18 – Understanding Risk in Project Work
• 0:36:39 – Data Retention and Privacy Compliance Review
• 0:43:41 – Engaging Data Protection Compliance Challenges
• 0:48:30 – Managing Complex Relationships in Databases
• 0:53:26 – UK GDPR Compliance and International Business
• 0:58:52 – Policy and Procedure Simplification

Unlocking the Secrets of Data Protection

Are you struggling to keep your Records of Processing Activities (ROPAs) up-to-date in your complex organisation? We begin by unravelling the intricacies of ROPAs, comparing them with privacy notices and information asset registers. We also emphasise the importance of regular updates to ensure they reflect the current reality of your data processing activities. Moreover, we introduce the concept of risk registers, which play a crucial role in assessing risks associated with data processing.

Staying Ahead in Cybersecurity and Privacy

The episode doesn’t just stop at ROPAs. We bring you the latest cybersecurity and data protection updates, covering significant incidents like the Leeds riots and the challenges of facial recognition technology in the age of mask-wearing criminals. We explore the role of social media in criminal identification and touch upon international incidents, such as an Olympic swimmer’s breach of COVID protocols. Additionally, we shed light on the UK’s cybersecurity vulnerabilities, Meta’s settlement over biometric data privacy, and new US legislation aimed at protecting children’s online safety.

Embedding Data Protection in Global Organisations

One of the standout segments of this episode is our discussion on embedding a data protection culture within large, international organisations. Discover strategies for managing ROPAs effectively, even with a global workforce, and learn about the importance of data champions and top-down support. We emphasise the power of community collaboration in overcoming shared challenges, ensuring that data protection becomes an integral part of your organisation’s culture.

Navigating the Challenges of Facial Recognition Tech

Facial recognition technology is a hot topic, and we dive into its practical implications and challenges. From a personal story involving facial recognition tech at John Lewis to the broader concerns around its use, especially during the Leeds riots, we provide a balanced view of this controversial technology.

Crafting a Culture of Proactive Data Privacy

Creating a proactive data protection culture isn’t easy, but it’s essential. We discuss the importance of assigning responsibility to data champions and the role of senior management in leading by example. We also highlight the balance between encouraging positive behaviour and ensuring there are consequences for non-compliance. Our goal is to make data protection engaging and relatable, helping you foster a proactive attitude towards data privacy within your organisation.

Managing Risks and Records in Data Processing

Finally, we explore the practical aspects of managing data protection systems and records. From using AI tools to maintain accurate ROPAs to evaluating comprehensive data protection solutions, we cover it all. We even touch upon the complexities of managing ROPAs for organisations with international employees, providing best practices for maintaining these records effectively.

Cybersecurity and Data Protection Update

We examine recent events, such as the Leeds riots and the limitations of facial recognition technology when perpetrators use masks. The discussion also covers international incidents and cybersecurity vulnerabilities in the UK, providing a comprehensive overview of the current data protection landscape.

Risk Assessment in Data Protection

This segment focuses on the multifaceted aspects of recruitment, selection, and the comprehensive lifecycle of employment. We discuss the utility of AI tools in maintaining accurate ROPAs and the importance of human oversight despite AI’s capabilities.

Implementing Data Protection Culture Within Organisations

We explore strategies for embedding a data protection culture within organisations, emphasising the importance of data champions, top-down support, and continuous engagement to make data protection an integral part of the organisation’s culture.

Managing Data Protection Systems and Records

Our hosts delve into the capabilities of data protection systems, highlighting a custom-built system based on Salesforce. They discuss the functionalities of such systems and provide insights into evaluating and selecting the right data protection solutions.

International Employees in Data Protection

We address the complexities of managing ROPAs for organisations with international employees, exploring scenarios involving UK-based companies with global operations and the implications of local laws.

Conclusion

As we wrap up this episode, we emphasise the importance of community collaboration in overcoming common challenges. We thank our contributors, Phil and Joe, for their invaluable insights and remind everyone about the upcoming GDPR radio session.

Tune in to this episode for a comprehensive guide to mastering data protection, staying ahead of cybersecurity threats, and fostering a proactive data protection culture within your organisation.

Don’t miss out on this essential discussion—your organisation’s data protection and cybersecurity strategies will be all the better for it!

If you would like to join us on future episodes of the Data Protection Made Easy podcast you can visit our events page. You can also request to subscribe via our contact us page. 

Our community now has over 1300 members from a wide range of backgrounds. Click below to subscribe.

Freedom Of Information – A Tool For Transparency

Freedom Of Information – A Tool For Transparency

Working in the data protection industry, where information is power, ensuring transparency within organisations is crucial. Freedom of Information (FOI), also known as the Freedom of Information Act (FOIA), empowers individuals to request access to information held by public authorities. During this week’s episode of the AWARD WINNING Data Protection Made Easy podcast, with over 20,000 Spotify plays and 170 episodes, dives deep into the world of FOI with expert Laura Brentnall, Support Desk Manager from Data Protection People.

Transparency: The Cornerstone of Public Trust

The FOI serves as a cornerstone for open government and public trust. It allows individuals to hold organisations accountable and fosters a more informed citizenry. Laura, with her experience working in local authorities and across diverse sectors, sheds light on the practicalities of FOI for organisations of all sizes.

Intriguing Encounters with FOI Requests

The session wouldn’t be complete without a touch of intrigue! Laura along with some of our listeners shared some fascinating (and sometimes bizarre) FOI requests they’ve encountered. From the infamous UK parliamentary expenses scandal, where information was disclosed outside of FOI channels, to a local council paying a psychic for an exorcism (yes, you read that right!), these real-world examples highlight the vast scope of FOI requests.

Navigating the Legal Landscape

FOI comes with its own legal framework. The discussion explores recent cases and considerations surrounding the FOIA. This includes the concept of vexatious requests, where someone submits excessive or unreasonable FOI requests to disrupt an organisation’s operations. A link to a case study from the Information Commissioner’s Office (ICO) is provided for further exploration.

Equipping You for FOI Success

The session equips organisations with practical strategies for handling FOI requests effectively. This might involve streamlining processes, understanding exemptions under the FOIA, and effectively communicating with requesters. Data Protection People have a dedicated team of FOI experts if you have further questions after listening.

Our New FOI Service: Simplifying the Process

Data Protection People are excited to announce its new FOI service! This service is designed to support organisations of all sizes and sectors in navigating the FOI process with confidence. Whether you need help developing a robust FOI policy or require assistance in responding to complex requests, our team of experts is here to guide you.

Calling All Outrageous Requests!

For the upcoming part two of this FOI discussion, the team is looking for your input! Submit your most outrageous (and anonymous) FOI experiences, and they’ll be discussed on the next episode. This is a fantastic opportunity to learn from the experiences of others and gain valuable insights.

Join Our Vibrant Community!

Data Protection Made Easy is more than just a podcast; it’s a thriving community. If you enjoyed this session and want to be part of the conversation, subscribe! Simply visit the contact us page and request to subscribe. You’ll then receive weekly invites to insightful discussions led by our industry experts.

Here’s what makes our community special:

• Diversity: We welcome everyone, from veteran Data Protection Officers (DPOs) with 20 years of experience to students just starting their careers.
• Open Forum: Our discussions are designed to be enthusiastic and informative. Professionals share valuable top tips, practical advice, and real-world stories to empower others.
• Commitment to Education: We are passionate about data protection and believe in sharing knowledge freely. There’s no sales pitch here; just genuine conversation.
• Impressive Reach: With over 100 live listeners every week, our podcast is a top contender in the data protection space. You’ll be joining a community of passionate individuals committed to data privacy.

Don’t miss out! Subscribe today and unlock a world of data protection knowledge with Data Protection Made Easy.

Tune in now via Spotify. 

GDPR Radio – Episode 134

Faces, Farage and Pseudonymisation

In this week’s episode, our knowledgeable hosts, Phil Brining and Tristan Mills, dive deep into the latest updates in data protection law, recent breaches, fines, and much more. Join us as we discuss the most relevant news of the week and simplify complex data protection topics, making them easy to understand and navigate.

Exploring Unauthorised Apps in the Workplace, Including WhatsApp: A Data Protection Standpoint

One of the key topics covered in this episode is the use of unauthorised apps in the workplace, with a special focus on WhatsApp. While these apps offer convenience in communication, they can pose significant data protection risks. Learn how organisations can address these risks and promote secure communication channels to protect sensitive information.

Facial Recognition and Its Implications on Data Protection

Another crucial discussion in this episode revolves around facial recognition technology and its implications on data protection. We explore the challenges surrounding the use of this technology, data privacy concerns, and the importance of obtaining proper consent when implementing facial recognition systems.

Understanding Personal Data, Pseudonymisation, and Anonymisation

We delve into the fundamental concept of personal data and its categorisation under data protection regulations. Additionally, we demystify the concepts of pseudonymisation and anonymisation, discussing their roles in protecting individual privacy and complying with data protection requirements.

Get Involved in Future Episodes!

Data Protection Made Easy values our community of data protection enthusiasts, and we want you to be a part of our podcast’s growth. Here’s how you can get involved:

Listener Questions: Have questions related to data protection or specific topics you’d like us to cover? Send us your queries, and we may feature them in upcoming episodes!
Guest Speakers: Are you an expert in data protection or know someone who is? We welcome guest speakers to bring fresh perspectives and insights. Reach out to us, and let’s collaborate on an engaging discussion.
Feedback and Suggestions: Your feedback matters to us. Share your thoughts and suggestions to help us improve the Data Protection Made Easy podcast for all our listeners.

Listen to Episode 124: GDPR Radio Now!

Don’t miss this insightful episode packed with valuable information and expert insights. Tune in to Data Protection Made Easy Podcast Episode using the player above or search for ‘Data Protection Made Easy’ on all major audio streaming platforms.

GDPR Radio – Episode 128

TikTok, International Transfers and Professor Hackett

Tune in to the latest episode of GDPR Radio on the Data Protection Made Easy podcast!

In Episode 128, our hosts Jasmine Harrison (Account Manager), Tristan Mills (Support Desk Manager), and Philip Brining (Founder and Managing Director) from Data Protection People delved into the fascinating world of data protection news. They explored various topics, including breaches, intriguing cases, emerging technologies, and much more.

Join the discussion as they analyse the ICO’s opinion on privacy information regarding TikTok and delve into the complexities of TikTok’s privacy policy, exploring potential compliance issues. Discover insights from a deep dive into TikTok’s privacy notice and gain valuable knowledge on international data transfers, with a specific focus on the data bridge between the UK and US.

You’ll also hear about an alarming data breach at the University of Manchester, where students received an email notifying them of the exposure of their personal data. Find out the intriguing details, including the curious fact that the hacker responsible was fittingly named Mr. Hacket.

This insightful episode is available now on our website and all major audio streaming platforms, including Spotify and Amazon. Don’t miss your chance to listen to our expert hosts share their opinions and analysis on the latest developments in the data protection landscape.

Data Protection People is a leading data protection consultancy in the UK, offering a comprehensive range of tools and services to simplify complex aspects of data protection. Stay informed, gain valuable insights, and take your data protection knowledge to the next level by tuning in to this captivating episode.

If you would like to get involved and join us live on future episdoes of the podcast, check out the upcoming episodes of the Data Protection Made Easy podcast and register for an individual session or subscribe and join one of the UK’s fastest growing data protection communities.