Extract to table

This memorandum and the underlying Thistlewood Consulting Ltd technical audit report were prepared in anticipation of regulatory enforcement proceedings and must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP

3 million annually is at risk if non-compliant vendor relationships must be suspended or terminated pending remediation

Article 5(1)(a) requires that personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject

The Court of Justice of the European Union confirmed in Planet49 (Case C-673/17) that consent must be obtained prior to the commencement of processing, must be specific and informed, must be freely given, and must constitute an unambiguous indication of the data subject's wishes by way of a clear affirmative act

This is a fundamental flaw in AGMG's consent architecture that must be addressed as a matter of urgency

For the UK properties, Regulation 6(1) of PECR provides that a person shall not store or gain access to information stored in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met