Edward Machin is counsel in the data, privacy and cybersecurity group, based in London. He provides clear and business-focused advice on a wide range of legal and regulatory issues in the rapidly evolving areas of privacy, data protection and cyber security, and technology law. Secondments at data-rich businesses in the life sciences and market research sectors have given Edward a deep understanding of what clients want – and these experiences inform his approach to providing user-friendly legal and commercial solutions to organisations across Europe, the U.S. and Asia. In the Legal 500 UK 2024, Edward is described as “excellent” and “knowledgeable, responsive [and] practical”.
Edward’s practice encompasses regulatory compliance, advisory and transactional work for founders, start-ups, corporates, venture capitalists and asset managers across the technology, life sciences and healthcare, financial and professional services, food and beverage, consumer goods, entertainment and media sectors. He regularly advises on the development and operationalisation of global compliance programmes, new products and services, complex international data transfer issues, and emerging technologies and regulatory trends (such as the use of artificial intelligence, digital assets and alternative data).
In addition, Edward has particular experience with crisis and incident management. He helps clients respond to requests from law enforcement agencies and data protection authorities, and frequently advises on personal data breaches, security events and contentious subject rights requests. He also works closely with colleagues across the firm on the data protection aspects of internal investigations and litigation matters.
Edward writes widely on privacy, data protection and security issues, and has been quoted in the Financial Times, the Wall Street Journal, the Times, the Daily Telegraph, the Irish Times, Sky News and various industry publications. Before his legal career, Edward worked for six years as an award-winning financial journalist.
Disclaimer
Experience
Counselling and Compliance
- Providing day-to-day counsel to high-profile clients in the food and beverage, financial services, lead generation and data analytics sectors on a wide range of complex data protection, security and information law issues.
- Helping organisations prepare for new and upcoming laws in the EU and UK, including the Artificial Intelligence Act, the Digital Operational Resilience Act, the NIS2 Directive, the Digital Services Act, the Data Governance Act and the Online Safety Bill.
- Advising clients on the myriad of legal, regulatory and policy issues surrounding their investment in and development, supply and use of AI and machine learning systems and tools – from algorithmic bias and data acquisition risks, to the protection of sensitive data and implementation of organisational governance strategies.
- Counselling medical centres, universities and life sciences companies on the application of the GDPR and UK GDPR to their research and health care operations, including on the design of their consent forms and associated data protection disclosures.
- Advising businesses on legal and regulatory compliance issues in connection with their online behavioural advertising and direct marketing activities.
- Assisting clients create and operationalise global compliance programmes to address the requirements of national and extra-territorial data protection laws.
- Advising on complex international data transfer questions, including to address Schrems II and national localisation and notification requirements.
- Counselling on a wide range of discrete data protection issues, such as automated decision-making, communications and device monitoring, high-risk processing, the use of cookies and tracking technologies, and data scraping.
- Providing training to clients’ legal and compliance, HR, marketing and product design teams on the GDPR, UK GDPR, ePrivacy Directive and PECR, Brexit and related issues.
Crisis Management and Incident Response
- Counselling multinational technology companies in their responses to personal data breaches and cybersecurity incidents, including making notifications to regulators and affected individuals across the EU and UK.
- Advising multiple financial institutions and private capital providers on responding to U.S. and UK law enforcement requests for information, including under the Investigatory Powers Act, the Data Protection Act and the Securities and Exchange Commission’s books and records rule.
- Representing ultra-high-net-worth individuals in challenging their World-Check designations as politically exposed persons.
- Counselling clients in the UK and EU on dozens of contentious data subject rights requests, including before supervisory authorities and in pre-litigation correspondence.
- Representing a former senior executive at a global energy provider in an investigation by the Serious Fraud Office, with a focus on the naming of the client in public court proceedings.
- Regularly advising on the data protection aspects of internal and external investigations, including on issues relating to whistleblowing, device collection and review, U.S. disclosure requirements and international data transfers.
Transactions and Fund Management
- Advising private equity companies in Europe, the U.S. and Asia on the data, privacy and cybersecurity issues arising in pre-acquisition diligence and post-acquisition remediation.
- Drafting and negotiating the data protection aspects of asset management and fund formation documentation (including PPMs, subscription documents, administration agreements and related contracting advice).