Emma Willis

With just 14 days left to go until GDPR implementation day, what should you be focusing on?

At our conference on 26th April, 57% of those attending said they had nearly completed all of the changes they needed to make in advance of 25th May, 4% stated that they were ready. So, what about the 22% who said they had only just started, or the 17% who didn’t know what GDPR was??  The key is DO NOT panic. It’s not Y2K all over again, the world will not end if you haven’t completed all of your preparations by 25th May.

What you do need is a plan……

Transparency is the key – prioritise those documents which tell your clients/customers what you will do with their personal data – how do you collect it, how do you process it, who do you share it with, how long do you keep it and how do you delete it?

Policies – get your key documents in order – data protection policy, data retention policy, privacy notices, cookies policy etc – make sure they are fully updated and available on your website.

Data processors – make sure you have full contractual arrangements in place with anyone who processes personal data on your behalf.

Data subject rights – how can your customers/clients exercise their rights under GDPR?  Make sure this is clearly signposted in your privacy notices, data protection policy and on your website – something simple, quick and easy. Make sure your staff know who to refer any requests to.

Don’t forget your employees! They will need a privacy notice that covers the use of their data for employment purposes and they will need to know where to refer any GDPR questions they either have themselves or receive from clients/customers.

Security – do you have robust security measures in place for both your electronic data and any paper data you store in filing cabinets?

Beyond this, and perhaps beyond 25th May, you will need to refine your processes for responding to data subject requests, ensure you have a full training programme in place (if you haven’t done training already) and consider what spot checks and audits you need to have in place to ensure ongoing compliance and accountability.

Get in touch

Don’t forget, here at Teal we are available to offer support for all your data protection needs. Simply contact us today for more information.

 

With less than 50 working days until GDPR takes effect on 25th May 2018, many businesses are starting to consider the ‘hot topic’ of whether their marketing lists will still be valid.  But it’s not just GDPR that needs to be considered……

Current Rules (up until 25th May 2018)

Data Protection Act 1998 (DPA98)

Privacy and Electronic Communications Regulations 2003 (PECR)

After 25th May 2018

General Data Protection Regulation (GDPR)

Privacy and Electronic Communications Regulations 2003 (PECR) BUT only until the Regulation on E-Privacy and Electronic Communications (the E-Privacy Regulation) comes into force

General Principles

Under DPA98 “An individual is entitled at any time by notice in writing ……to require the data controller…to cease, or not to begin processing for the purposes of direct marketing….”

Whilst referenced in DPA98, the majority of the rules around direct marketing can actually be found in PECR.  Take a look at the ICO’s current direct marketing guidance, based on PECR.

Direct marketing can currently be carried out following a variety of opt-ins or opt-outs but under GDPR the rules become more challenging because giving consent (or opting in) to direct marketing has specific requirements.

GDPR says:

“Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time….”

“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

As we all know, under GDPR, organisations can only process personal data if they have a lawful basis for doing so (GDPR Article 5 clause 1).  The test for ‘lawfulness of processing’ includes that the data subject has given consent for the processing, but this does not automatically mean that you need consent to carry out direct marketing (or any other type of processing).

Legitimate Interests

Recital 47 of the GDPR states “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”

Even the ICO acknowledge that obtaining valid consent under GDPR (Art 7) will be challenging and they urge businesses to consider whether consent is the correct lawful basis for the processing of any data.

But when deciding whether the sending of direct marketing can be done as a legitimate interest, an organisation still needs to consider the rules under PECR.

Postal marketing – not covered by PECR so as long as the organisation identifies itself, offers an opt-out and screens addresses against the mail preference service then it’s ok to send first party marketing (about your own products and services) as long as the client has not previously opted out.  If they haven’t previously opted out but have registered with the mail preference service then you need to leave them alone.

Email/SMS marketing – you must follow the rules in PECR which require an opt-in unless you have obtained the contact details of the individual during the course of a sale (or negotiations of the sale) of a product or service.  The marketing must be of a similar product or service and the individual must have been given the opportunity to opt-out.

Telephone Marketing – for live marketing calls, the rules say you can contact anyone as long as they have not previously opted out and are not registered with the telephone preference service.  You must not make automated calls to anyone unless they have specifically opted in to receive this type of call from you.

So what do you need to do?

• Consider whether consent is the most appropriate lawful basis for processing – can you use legitimate interests instead?

• Make sure your privacy notice covers direct marketing if you will be sending it to clients

• Ensure that there is an easy way for clients to opt-out of marketing and that your system can record the opt-out

• Ensure your marketing teams screen all marketing data against both the telephone preference service and mail preference service

• If you do need (or want to rely on consent) then review your current opt-in’s, if they don’t meet the requirements of Article 7 then you will need to ask your clients to opt-in again

• Keep an eye out for our updates on the E-Privacy Regulation – it was supposed to be ready for 25th May 2018 but this is looking increasingly unlikely as the text is yet to be finalised

Get in touch

We will be talking about the practicalities of GDPR at our upcoming conference in London on 26th April.  However, if you’d like to discuss data protection and GDPR with one of our experts, simply contact us today.

 

The draft Data Protection Bill [HL] 2017-19 will get it’s second reading in the House of Commons today, Monday 5th March 2018, moving one step closer to receiving Royal Assent.  In preparation for the second reading, the House of Commons issued a 60-page briefing paper which includes a summary of the Bill and the House of Lords debates[1].

In May 2018, as we all know, there will be some changes to the EU’s data protection framework – the General Data Protection Regulation (GDPR) will apply from 25th May and as it is a Regulation it does not need to be transposed into domestic law.  But prior to that, the Police and Criminal Justice Directive, also known as the Law Enforcement Directive (LED), needs to be transposed into UK law by 6 May.

GDPR

GDPR widens the scope of the previous Data Protection Directive, (which was the EU legislation that unpinned the Data Protection Act 1998), to provide data subjects with greater protection for their personal data and also extends data subject rights.  The Regulation reduces the principles from 8 to 6, but introduces 8 data subject rights, some of which are a continuation of rights under previous legislation, (like subject access requests), but some are new.  Data controllers must be able to demonstrate compliance with all the principles (accountability) and there are new obligations for data processors.

LED

The LED will apply to both the cross-border and domestic processing of personal data for law enforcement purposes and repeals the previous 2008 Framework Decision.  The Directive is designed to protect the personal data of individuals involved in criminal proceedings, whether they are witnesses, victims or suspects.  In addition, it is anticipated that the LED will “facilitate a smoother exchange of information between Member States’ police and judicial authorities, thereby improving cooperation in the fight against terrorism and other serious crime in Europe.[2]

An overview of the LED can be found here.

Council of Europe Convention on Processing Personal Data

The Council of Europe is not an EU institution and the UK will continue to be a member after Brexit.  The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No108) was the first binding instrument on data protection.  The UK ratified the Convention in August 1987 and it entered into force on 1 December 1987:

“[The Convention]…protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the trans frontier flow of personal data.”[3]

The Convention will be modernised and will reflect the same principles as GDPR.  A draft version is available online https://www.coe.int/en/web/data-protection

The Draft Bill

The draft Data Protection Bill (‘the Bill’) has a number of purposes:

• It sets out how the UK would apply the derogations available under GDPR

• It will bring the Law Enforcement Directive (LED) into UK law

• It updates the laws governing personal data processing by the intelligence services

• It aims to ensure that the UK would be able to freely exchange data with the EU post-Brexit

• It will repeal the Data Protection Act 1998

The Bill was originally introduced into the House of Lords on 13th September 2017, but it’s passage has been slow due to a number of concerns around the age of consent for children to have access to information society services, immigration control and freedom of expression in journalism.

GDPR allows Member States a limited number of derogations, and following consultations in 2017, the Government confirmed it would exercise those derogations in the following areas:

• The age of consent for children to access information society services

• Processing criminal conviction and offence data

• Automated individual decision-making

• Freedom of expression in the media

• Research

The Bill was introduced to the House of Lords on 13th September 2017 and following much debate it was introduced to the House of Commons on 18th January 2018.

The Department for Digital, Culture, Media and Sport (DCMS) factsheet provides a succinct summary of what the Bill will do –

The Bill is split into seven Parts and eighteen schedules:

• Part 1: Bill overview and definition of key terms
• Part 2: General data processing in line with GDPR and other general data processing in areas outside the scope of EU law
• Part 3: LED and law enforcement processing
• Part 4: Nation Security Processing through a modernised Council of Europe Convention
• Part 5: Functions and Duties of the Information Commissioner – including requirement to publish codes of practice of data sharing, direct marketing, age appropriate design for online services likely to be accessed by children
• Part 6: Enforcement regime and ICO Powers
• Part 7: Various issues including regulation to be made under the Act, penalties for offences and the Act’s territorial application

The Briefing Paper also includes a summary of the House of Lords debates for those who are interested in reading more http://researchbriefings.files.parliament.uk/documents/CBP-8214/CBP-8214.pdf which the full debate transcripts are available of the House of Lords website.

So, for those of you using the 80 days (inc weekends and bank holidays) to prepare for GDPR what does this mean?  Well, if you don’t carry out any national security or law enforcement processing then your GDPR preparations will stand you in good stead, although you may want to glance at the draft Bill and specifically the section around the Information Commissioner and Enforcement.  If you do carry out national security or law enforcement processing, then you have probably already been preparing for the changes under the LED but you will need to familiarise yourself with the Parts of the Act that are relevant to you.  Everyone will need to monitor the Governments Brexit negotiations, as once we leave the EU the UK will be a ‘Third Country’ and there may be additional requirements to enable the transfer of data between the EU and member states.

Get in touch

If you need further advice, find out more about our Ask Teal service, or simply contact one of our helpful experts today.

 

 

---

[1] https://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-8214#fullreport

[2] European Commission, Questions and Answers – Data protection reform packages, 24 May 2017 – http://europa.eu/rapid/press-release_MEMO-17-1441_en.htm

[3] https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108

 

 

As we are all aware, the GDPR implementation deadline of 25th May 2018 is fast approaching….. in fact it’s just over 15 weeks away.  But were you also aware that the requirements for data controllers to register with the ICO, and the fees for registration are changing on 1st April 2018?

Under the current rules, organisations that process personal information are required to register (notify) with the ICO as data controllers.  The notification includes explaining what personal data they collect and what they do with it.  At the point of notification, the data controller is required to pay a fee, currently £35 per year for organisations with less than 249 employees, and £500 for all other organisations.

After 25th May 2018 there will no longer be a requirement to notify the ICO in the same way.  Under GDPR, data controllers are to be accountable by maintain records and conducting assessments of processing activities.

However, there is a provision under the Digital Economy Act that means there is still a legal requirement for data controllers to pay the ICO a data protection fee.  As with the notification fee now, the data protection fee will be used to fund the ICO’s data protection work as all money received in fines is passed directly back to the Treasury.

The Digital Economy Act paves the way for a new funding system.  The new system will aim to make sure the fees are fair and reflect the relative risk of the organisation’s processing of personal data.  The size of the fee will still be based on a organisations size and turnover, but will also consider the amount of personal data being processed.

The final fee structure will go live on 1st April 2018 but is likely to be a three-tier system:

• Tier 1: annual fee of up to £55 applied to small and medium firms that do not process large volumes of data;

• Tier 2: annual fee of up to £80 applied to small and medium firms that process large volumes of data;

• Tier 3: annual fee of up to £1000 for large businesses;

• And a direct marketing top-up fee of £20 for organisations that carry out electronic marketing activities as part of their business.

If your renewal is due prior to 1st April, then you will simply renew under the old system and the new structure will not affect you until your following renewal.

‘new data protection fee regime payments made during the 2017/18 financial year under the current system will run for a full year. This would mean that organisations which pay their annual notification fee at any point during this time will not need to pay the new fee until their notification under the old model would otherwise expire.’

Get in touch

For more information about Data Protection Compliance and the GDPR, get in touch with our experts today.

 

So, if you haven’t heard about GDPR by now you must have been in hibernation for quite some time!  It’s coming……soon….. but where are you on your journey?

A small percentage of you will have been aware of the General Data Protection Regulation (GDPR) since it was adopted in the EU in 2016.  A larger percentage will probably have become aware around the start of 2017, maybe a few of you have genuinely only just heard about and are starting your preparations now.

In theory, if you are fully compliant with the Data Protection Act 1998 then you are already part the way to being compliant with the new regulation, but may firms will find that they were perhaps not as compliant as they first believed………do you have a large store room full of very old files for example?

I became aware of GDPR towards the end of 2016 when I attended a Data Protection for COLPs course.  My firm, like many at the time, did not have GDPR on the radar so I went back to the office and began awareness raising, inadvertently volunteering myself to create a project plan and briefing for the Board and I have been managing our preparations since January 2017.

So what are my ten top tips?

1.  It’s a journey, not a destination….

Preparing for GDPR is not about ‘tick-box’ compliance, its about making sure your policies and procedures are sustainable, and that you have a plan for checking your controls, policies and procedures work for your business and are being followed.  Yes, you are working towards getting those policies and procedures in place to ‘switch-on’ on the 25th of May but you also need to ensure that they are sustainable.

2.  Research

GDPR enhances many of the provisions of the current DPA 98 but it also introduces new ideas and data subject rights.  Are you fully up to speed on ‘the right to be forgotten’, ‘the right to data portability’ and ‘privacy by design and default’?  If you are, do you understand what changes you need to introduce to your firm to ensure that you can have workable, sustainable procedures and processes AND to demonstrate accountability?

What is your legal basis for processing personal data?  Do you need to rely upon consent or do you have a different legal basis?  As a law firm you will be processing under a contract rather than relying upon consent but does all of your processing fall under the contract with the client?  Do you process sensitive category data?  You need to understand what data your business processes as well as the GDPR requirements for that data.  Do you understand the definition of ‘processing’?

3.  Information audit

The first, and one of the most important stages of preparation is to conduct a thorough information across all areas of your business – don’t forget that your employee’s personal data is also included for GDPR purposes, it’s not just about your client personal data.  You need to document exactly what personal information you process, why you process it and how you process it.  Consider any risks to the data during processing for each business area.  Treat the audit as a GAP analysis – do you still think you are fully DPA 98 compliant or are there clear GAPs which need to be considered?

4.  Plan, plan, plan

Once you have the results of your information audit you should be able to design a comprehensive plan for your preparations.  If you have a Project Management Team, now is the time to get them on board!  What resource do you have that you can dedicate to the preparations?  Your plan will need to be a living, breathing document that you update on a regular basis.  Your plan will evolve and grow as you work through the actions (and may grow longer before you know it!)

5.  Data flow mapping

Do you know how personal data moves through your business?  Can you clearly demonstrate the flow of data through your systems from on-boarding to file closure?  It’s important that you have this mapped out (your IT department are your new best friends!) – how can you comply with a subject access request if you don’t know where to look for all the data subject’s personal data?  Don’t forget your paper filing systems and off-site storage!

6.  Third party systems

Do you use any third-party systems?  Most law firms with a case management system will use a third-party system.  Through your information audit and data flow mapping you should identify exactly what systems you use but it’s important to also consider where that system stores the data – is it on your network and server or is it held on the third- party server.  Does it link to your case management system so you can easily access the data if your receive a data subject request?

7.  Awareness and engagement

It’s really important to promote GDPR awareness throughout your business, to all departments and all levels of employees.  Engage all business area heads at the earliest opportunity, they are the people who understand how your current processes work on a day to day basis, without them you will not be able to implement the changes you need to ensure compliance.  Your IT department, whether internal or external, is a valuable asset – do you understand how your IT systems work on a technical level, probably not so make your Head of IT your new best friend and ensure they are fully briefed on GDPR requirements.

Engagement at the top will make your project run smoother – you will need investment in your project in the form of people resource and potentially a financial investment depending on the outcome of your information audit.  You are more likely to secure this resource and investment if your Board, senior stakeholders and investors understand what GDPR means for the business.  Remember, it’s not just about avoiding the potentially huge fines, by being compliant you build trust with your clients and professional partners and through better processes you can offer a high level of customer service.

8.  Policies and procedures

You will need to conduct a thorough review of your data protection policies and procedures – this will include your retention policy and privacy risk should be included within your risk management framework.  You will need to build new procedures for the new data subject rights.

9.  Data retention

Law firms have a reputation for storing documents and files for much longer than required for legal and regulatory purposes so now is the time to ‘get your house in order’.  Do you have a robust archiving, storage and retention policy?  If you do, is it followed?  Do you have a secure way to delete files once the storage period has come to an end?  What about legacy systems and databases, and cloud systems?  Can you securely data that is held on your third-party systems?  Again, business area engagement is important to ensure that you meet your legal and regulatory obligations (which means you will have to delete some data).

10.  Training

You can have the best policies and procedures in the world, but they are useless if your employees do not know they exist or do not know how to put them into operation.  GDPR is a difficult and dry subject so it’s probably best to break the training down into small chunks.  Make it interactive and engaging (or get someone in who can do this for you).

Get in touch

So, after reading this, how do you feel about GDPR now?  If you are a compliance ‘geek’ like me then you will feel excited and fired up ready to start your journey.  Alternatively, you may be feeling overwhelmed and unsure where to start.  Fear not!  The ICO have some really useful (and free) resources. Alternatively, check out our data protection compliance services or contact one of our experts for more information.

 

Recently,  the Bill re-authorising section 702 of FISA (Foreign Intelligence Surveillance Act) was passed in the US House of Representatives after the original December deadline was extended until 19th January.  Although the Bill still has to get through the Senate, it seems that with the backing of President Trump, the Bill allowing targeted surveillance of non-US nationals outside the US will be re-authorised despite the concerns of the EU WP29.

On 28th November 2017 the WP29 published its report on the first annual Joint Review of the EU-US Privacy Shield.  WP29 had previously expressed concerns about the Privacy Shield, and whilst they acknowledge that progress has been made, they still have a number of concerns around transparency and in particular, access for US Law Enforcement and National Security purposes.

“The WP29 welcomes the various efforts made by US authorities to set up a comprehensive procedural framework to support the operation of the Privacy Shield through for example the strengthening of the checks performed prior to the listing of certified organizations.”

For those of you who need reminding, in October 2015 the European Court of Justice declared ‘Safe Harbor’ invalid, leaving the EU Commission and the US Government to find a new way of safeguarding EU-US data transfers.  In February 2016, political agreement on a new framework was reached and the final version was adopted by the EU Commission on 12 July 2016.  The self-certified Privacy Shield requires companies to establish a privacy policy which is in line with the privacy shield principles.  Companies are obliged to re-certify on an annual basis.  Part of the agreement was an annual joint review.

In September 2017, EU Commission and the WP29 visited Washington to undertake the review.  The Commission published its report in October 2017, and adopt a seemingly different position to WP29:

“The Commission stands strongly behind the Privacy Shield arrangement with the US.  Making international data transfers sound, safe and secure benefits certified companies and European consumers and businesses, including EU SMEs.  This first annual review demonstrates our commitment to create a strong certification scheme with dynamic oversight work.”

However, the WP29 report lists a number of concerns which fall broadly into two categories; commercial aspects and concerns around Government access to EU personal data for law enforcement and National Security purposes (with specific reference to s702 FISA).

The commercial aspects that remain a concern include:

• A lack of guidance and clear information on the Privacy Shield principles, onward transfers and the rights and available remedies for data subjects;

• The need for increased oversight and supervision of compliance with the principles;

• The need to distinguish between the status of data processors and data controllers

• Required improvements in the interpretation of and handling of ‘HR data’

• Lack of rules on automated decision-making and profiling

• Unresolved issues from opinion 1 of 2016

The WP29 acknowledges that progress has been made in comparison with the previous Safe Harbor arrangements.

They also acknowledge that progress has been made in respect of the concerns around access to data for law enforcement and National Security reasons, but a number of concerns remain, specifically in relation to the collection and access of personal data for national security purposes under section 702 of FISA and Executive Order 12333.  Executive Order 12333, originally signed by Ronald Reagan, compels leaders of US intelligence services to co-operate fully with the CIA.

Two programs operate under s702 FISA – PRISM and UPSTREAM.  PRISM requires internet service providers to provide the US authorities with the data of their users corresponding to ‘selectors’.  Under UPSTREAM, telecommunication providers are required to assist the NSA by collecting data from the chosen ‘selector’.  WP29 has specific concerns around the UPSTREAM programme:

“…the WP29 calls for further evidence or legally binding commitments to substantiate the assertions by the US Authorities that the collection of data under s702 is not indiscriminate and access is not conducted on a generalized basis under the UPSTREAM programme.”

WP29 viewed the re-authorisation of s702 as “an important opportunity to include additional safeguards…” but it remains to be seen whether this feedback has been taken on board when the Bill passes to the Senate on 19th January 2018.

What is clear, is that WP29 have given a stark warning to the US in respect of the Privacy Shield if their concerns are not addressed prior to the GDPR implementation date of 25th May 2018:

“In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling.”

If WP29 chose to go down this route there could be detrimental consequences for EU businesses that need to transfer data to the US (and vice versa).  It would be prudent for those businesses to ensure that they fully understand the systems and processes they have which could be impacted by any such action and to keep fully up to date with any developments.

In the meantime it’s just a waiting game, with only a few months to go until 25th May…

Get in touch

For more information about our data protection services, simply contact one of our experts today.