Legal Compliance Blogs | Teal Compliance

EU-US Privacy Shield and Brexit – What you need to know

Blogs, Data Protection, Legal Compliance / Emma Willis

After a turbulent few months, the Privacy Shield was re-approved by the EU Commission at the end of last year and with Brexit looming, if you are a Privacy Shield participant there are some steps you may need to take before 30th March 2019 to ensure you can continue to receive personal data from the UK.

I say ‘may need to take’ because it all depends on whether the Brexit Withdrawal Agreement is approved by the UK Parliament. If approved, there is an 18 month transitional period so Privacy Shield commitments will not need to be updated until 31 December 2020.

However, if the Agreement is not approved then Privacy Shield commitments will need to be updated by 30th March 2019 so it is advisable to start to look at this now.

So what do you need to do?

Update publicly facing privacy policies to specifically state that Privacy Shield Commitments extend to personal data received from the UK.
If transferring HR data then the HR Privacy Policy will also need to be updated.
Maintain your certification by completing an annual re-certification.

If you are a UK business that deals with a Privacy Shield Certified business then you should make sure that steps are being taken to make the relevant changes in time.

Get in touch

If you need help with this or any of the other regulatory compliance changes that are happening this year then don’t hesitate to contact us today.

EU-US Privacy Shield and Brexit – What you need to know Read More »

Couple signing an agreement with professional person

Ten point plan for IDD compliance

Blogs, Legal Compliance, Regulatory Compliance / Shazia Zamir

This may appeal to those of you who like me are a little lost when someone talks to you about the Insurance Distribution Directive. Let’s start from the basics, The Insurance Distribution Directive (IDD) is a new European directive that has replaced the Insurance Mediation Directive (IMD). It applies to Firms who conduct insurance distribution activities and its introduction will change the way relevant firms work. The SRA recently announced the approval by the Financial Conduct Authority and the Legal Services Board of its rules to comply with the directive, reflected in the changes made to the SRA Handbook 2011on 1 October 2018.

In summary the Directive aims to enhance consumer protection when buying insurance – including general insurance, life insurance and insurance-based investment products (IBIPs). It also focuses on supporting competition between insurance distributors by creating a level playing field. Like the IMD, the IDD covers the authorisation, passporting arrangements and regulatory requirements for insurance and reinsurance intermediaries. However, the application of the IDD is wider, covering organisational and conduct of business requirements for insurance and reinsurance undertakings. It’s also important to mention in order the demonstrate firms and employees possess appropriate knowledge to perform their duties, CPD of at least 15 hours are required to complete this.

In practical terms the definition of ‘insurance distribution’ in the new directive has been defined as the activities of advising on, proposing, or carrying out other work preparatory to the conclusion of contracts of insurance, of concluding such contracts, or of assisting in the administration and performance of such contracts, in particular in the event of a claim. That means Law firms involved in personal injury, conveyancing and probate will most likely be carrying on insurance distribution activities e.g. arranging for clients’ after the event insurance in a personal injury matter or insurance for defective title in a conveyancing matter.

Another important reference are the SRA rules particularly regarding the SRA Financial Services (Scope) Rules 2001 (Scope rules) and the SRA Financial Services (Conduct of Business) Rules 2001 (COB rules). The specific requirements which relate to insurance distribution activities are set out in Appendix 1 of the COB rules.

Here are 10 steps you may consider when you deal with IDD compliance:

Step 1

Notify the SRA using a FA8 form if you propose to conduct insurance distribution services. The SRA will inform the FCA on your behalf who maintains a register of firms which includes those that are carrying on insurance mediation activities. Before submitting the completed form be sure to provide some basic information like details of your firm’s insurance distribution officer, the identities of shareholders or members that have a holding in your firm that exceeds 10%, and the amounts of those holdings, the identities of persons who have close links with your firm as per close links definition under Article 13 point 17 of Directive 2009/138/EC and information that those holdings or close links will not prevent you exercising your supervisory or regulatory functions. Failing to register when required to do so is likely to be breaching the general prohibition which is a criminal offence under section 23 of the Financial Services and Market Act 2000 and you may find that the contracts of insurance arranged for clients are invalid.

Step 2

When appointing an insurance distribution officer, you must make sure that they are competent and understand the terms and conditions of policies offered, laws covering the distribution of insurance products, claims and complaints handling requirements, how to assess a customer’s needs.

Step 3

Make sure that you do not carry on any insurance distribution activities unless you have in place a policy of qualifying professional indemnity insurance. More information about the obligations on you can be found in the SRA Indemnity Insurance Rules 2013.

Step 4

Consider Rule 3 of the COB rules setting out the sort of information that you must provide about you, your firm and the services you can provide when arranging insurance e.g. inform the client you are regulated by the Solicitors Regulation Authority for this work and the scope of your services, i.e. that you can only carry on insurance distribution activities limited to those not prohibited by your Scope Rules.

Step 5

Set out information that you will need to give to your clients about any remuneration you receive for arranging the insurance and any fees that might be payable by the client in accordance with Part 8 and 9 of Appendix 1 of the COB rules.

Step 6

If you collect a fee from a client, you must disclose the exact amount of that fee (not an estimate or range). If the exact amount is not known, then the method of calculation must be provided. Any information you give to the client must be in a “durable medium” being fair, transparent and not misleading.

Step 7

In addition to providing information about the status of your firm, you must provide your clients with information confirming, that you are an insurance intermediary, as opposed to an insurer and that you cannot manufacture insurance products; whether you provide a personal recommendation in respect of the insurance products offered; whether you act on behalf of the client and/or the insurer. If you act for both you will need to explain in what circumstances you can act for each party, and if you have “10% or more” of the voting rights in an insurer (for example, as a shareholder).

Step 8

You must in comply with chapter 1 SRA Code of Conduct 2011 “honestly, fairly and professionally in the client’s best interests”.

Step 9

Comply with outcomes in Chapter 8 of the SRA Code of Conduct 2011 by making sure that your marketing communications, addressed to clients or potential clients are fair, clear and not misleading. Marketing communications should always be clearly identifiable as such.

Step 10

Ensure you have sent the client a summary document for general insurance products in the form of an Insurance Product Information Document (IPID) before you conclude a contract. The insurer is required to draw up the IPID and must set out the key information a client will need to make an informed decision about the product.

Get in touch

If you have any questions at all about IDD compliance, insurance generally or regulatory compliance, then get in touch with one of our experts today. An initial call is always free.

Ten point plan for IDD compliance Read More »

GDPR six months on……

Blogs, Data Protection, Legal Compliance / Emma Willis

It’s been six months since GDPR came into effect on 25th May. Despite the Y2K like panic in the run up to May, the world did not come crashing down and despite some high profile data breaches, the ICO is yet to issue its first fine under the new regime.

But what has happened in the last 6 months and what is still to come?

ICO updates

Over the last six months the ICO have made several updates to their online guidance, including:

A more comprehensive and in-depth analysis of what constitutes personal data has been added to the online guide and also a separate detailed publication – here
Individual sections on each core principle including guidance and practical examples – here
A significantly expanded section on international transfers – here
A significantly expanded section on the exemptions, including those in schedules 2-4 of the Data Protection Act 2018 – here
Updated security guidance – here
New guidance on encryption and passwords for online services – here

The ICO have also updated their guidance on the right of erasure in respect of backups. They have confirmed that the right is also applicable to data held in backups and the updated guidance emphasises the need to ensure erasure from backup systems as well as from live systems. For delayed erasure for backups they maintain the position that it is important to put the data ‘beyond use’. They’ve also finalised the detailed guidance on children and the GDPR.

The ICO have confirmed that the number of self-reported data breaches for the first half of 2018 was more that for the whole of 2017. As a result, the ICO have issued an update to remind organisations that reports only have to be made where the breach is likely to threaten an individual’s security. Organisations are encouraged to call the ICO helpline before making a report – and remember if you are in any doubt you can always ask Teal Compliance who are always on hand to help!

Consultations/Feedback

On 12th November 2018, the ICO issued it’s consultation on the new proposed Direct Marketing Code.

The Data Protection Act 2018 required the Commissioner to produce an improved code which provides practical guidance and promotes good practice. The new code will only cover the rules under PECR and will only be updated once the new E-Privacy Directive is finalised. The consultation is open until 24th December.

The ICO is also asking parents, carers, and those who work with children to give their views on the draft Age Appropriate Design Code which set the standards which must be followed by those who provide online services and apps for children – this consultation is open until 5th December 2018.

Fines/court cases

Whilst we are yet to see the first ‘GDPR’ fine, there have been a number of high profile ICO enforcement actions and some high profile Court cases in the last six months.

WM Morrisons Supermarkets Plc v Various

The Court of Appeal ruled that the supermarket must pay compensation to thousands of employees who were victims of a data beach in 2014. The High Court ruled in 2017 that the supermarket was vicariously liable for this breach so Morrisons took the claim to the Court of Appeal. Morrisons had argued that they should not be liable for this breach because they had safeguards in place to protect the data. This stance was challenged by more than 5,000 past and current staff. Morrisons have indicated that they will now take the decision to the Supreme Court. This is a stark warning to employers that they can be held viciously liable for data breaches caused by employees even if they have appropriate safeguards in place.

Lloyd v Google LLC

The High Court has refused to grant leave to serve a claim form on Google Inc outside the English Jurisdiction in relation to the ‘Safari workaround’ which involved Google allegedly using cookie technology on the iPhone safari browser to obtain browser-generated information about iPhone users between 2011-2012 without their knowledge.

ICO Prosecution under the Computer Misuse Act 1990

A motor industry employee has received a six month prison sentence following the first prosecution to be brought by the ICO under the Computer Misuse Act 1990. The worker, who was employed by Nationwide Accident Repair Services accessed thousands of customer records containing personal data without permission, using his colleagues’ log-on details to access the Audatex system. He then continued to do this when he changed employer. Confiscation proceedings under the Proceeds of Crime Act are in progress to recover any benefit obtained as a result of the offending.

Enforcement Decisions

Metropolitan Police 16th November 2018 – issued an enforcement notice on concerns relating to the Gangs Matrix
Facebook Ireland Ltd – 24th October 2018 – £500,000 fine for breaches of data protection law
Heathrow Airport – 8th October 2018 – £120,000 fine for failing to ensure the security of personal data
Equifax Ltd – 20th September 2018 – £500,000 fine for failing to protect personal data relating to a cyber attack in 2017
Bupa Insurance Services Ltd – 28th September 2018 – £175,000 for failing to have effective security measures in place

In addition, there have been a number of fines relating to nuisance emails/calls –

Secure Home Systems £80,000 (for 84,347 nuisance calls to TPS subscribers)
ACT Response Ltd £140,000 (for 496,455 nuisance calls to TPS subscribers)
Boost Finance Ltd £90,000 (for nuisance emails about pre-paid funeral plans)
Oaklands Assist UK Ltd £150,000 for nuisance direct marketing calls

All of these cases highlight that ICO will act where it becomes aware of a data breach or due to breaches of PECR, so it’s more important than even to make sure that your processes are up to date being used by your employees AND just as importantly that you have all the documentation you need to demonstrate accountability just in case the ICO do get in touch with you.

E-Privacy update

The controversial update to PECR is experiencing further delays and is now not expected to be ready until Spring 2020. Keep an eye on our website for the latest updates.

Get in touch

Contact our experts at Teal Compliance if you have any data compliance related questions. An initial call is always free.

GDPR six months on…… Read More »

The new transparency rules: what you need to know

Blogs, Legal Compliance, Regulatory Compliance, Risk Management / Amy Bell

The Legal Services Board have approved the SRA’s proposed change to the transparency rules. But, what does this mean for your law firm and how are you going to ensure you comply with the new rules by the December 2018 deadline?

What’s the aim of the transparency rules?

The aim of the changes is to assist clients by providing clarity in relation to their legal fees.

The rationale came from the recent Competition and Market Authority report, where it was apparent that consumers wanted more information to enable them to make informed decisions about the range of services available to them when accessing legal services. The report found that the prices charged and the services offered were unclear, descriptions were ambiguous and that the client was not always getting what they expected.

What are the changes?

Under the rules, law firms will be required to publish on their website, their price and service information for specified legal services which include:

Debt recovery (up to £100,000)
Employee and employer tribunal claims (unfair/wrongful dismissal)
Immigration
Licensing applications for business premises
Probate
Residential conveyancing
Road traffic offences

The rules do not apply for publicly funded work.

In addition, firms will be required to display the new SRA digital badge which essentially provides a layer of protection against fraudulent activities,

Other changes include the requirement to publish the firm’s complaints procedures, including how and when complaints may be made.

As a firm, you will be required to publish:

A full description of services offered, which also should be included in your Client Care Letter/Terms of Engagement
The costs of services: These must be clear, no more hidden additional fees. If it is not possible to provide the total costs, you should provide details of the costs in stages, and what each stage entails.
Hourly rates -v- fixed fee: If the firm is charging on an hourly rate basis these will need to be published. Consider placing these on the profiles of the fee earners on the service pages, so potential clients can see the information sooner rather than later. Firms may also want to consider an hourly rates table on their website. If you are offering fixed fees, ensure that you clearly set out what is and isn’t included in the fee.
Disbursements: Provide clarity and certainty (where possible) as to what the disbursements will be during the matter. For example, for conveyancing transactions firms may want to consider providing a full list on the website of possible disbursements. In other matters, the firm may want to consider listing the types of disbursements that may need to be funded, so that it does not come as a surprise to the client.
VAT: Be clear as to what will have VAT added.
Referral Arrangements: You will need to disclosure any referral agreement you have in place, including how much you will receive. This information should also be in the Client Care letter/Terms of Business.

How can you make this work on your website?

Firms will be considering how to achieve this. You should consider the “user experience” how will your clients find out this information. The draft guidance to support these rules suggests the information should be easily navigable if it is not on your home page. Some firms are creating specific pages, others are building this into an online quote tool, or are considering connecting to price comparison sites. There is an increasing number of firms that are white labelled under other organisations and they will all need to align, particularly in relation to conveyancing where clients can obtain online quotes.

Complaints information must also be published and should include your complaints handling procedure as well as details about how and when a complaint can be made to the Legal Ombudsman.

Firms must also display in a prominent place its SRA number and digital badge.

What if I don’t have a website?

If a firm does not have a website the firm must make the information available on request. Firms are not expected to create a website simply to comply with these rules.

Get in touch

If you require any help or assistance in navigating the new rules, or wish to speak to us about risk management, or find out more about our website auditing service, then feel free to get in touch with our experts today. An initial chat is always free.

The new transparency rules: what you need to know Read More »

Someone typing on laptop with a credit card in hand

Latest cybercrime risks to the legal sector and how to manage them

Blogs, Legal Compliance, Risk Management / Dora

A recent report produced by the National Cyber Security Centre (NCSC) highlights the need for even the smallest firms to undertake a cyber threat risk assessment and implement effective controls. The report cites a 2017 PricewaterhouseCoopers Law Firm survey, in which 60% of law firms reported an information security incident in the last year, up from 42% in 2014. The report also cites SRA reports that over £11 million of client money was stolen due to cyber related crime in 2016.

The report ‘Cyber threat to the UK Legal Sector’ sets out, through case studies, the latest cyber security threats that are of particular relevance to the legal sector. The report also identifies practical steps firms can take to reduce the likelihood of them falling victim to such threats.

The report is the work of the NCSC and its sponsored Industry 100 scheme, with input from the Law Society, the SRA, Action Fraud and the National Crime Agency (NCA). The mission of the team is to increase the resilience of UK law firms who are particularly vulnerable to this type of threat as a result of the sensitive client information and significant funds they hold. These risks can disproportionately impact smaller firms who may have a small number of staff but may still be processing large volumes of data or handling significant client funds.

While firms may have taken action to secure personal information as a result of the General Data Protection Regulation (GDPR), this report identifies cyber security as a wider issue impacting commercially sensitive information, supply chain risks and financial controls that could make firms vulnerable to fraud and bribery. The 4 key current risks identified in the report are:

Phishing attacks where attackers influence users into disclosing information or clicking a bad link which compromises the payment of invoices and money transfers;
Accidental and deliberate data breaches as a result of insiders such as disgruntled employees looking to gain financially or ‘get back at a firm’ for perceived grievances;
Ransomware – a type of malware that prevents firms from accessing files or data on their computer or network until a ransom has been paid to fraudsters.
Third party suppliers failing to adequately secure their systems that hold your firm’s sensitive data or money transfer arrangements leading to loss of data or money. State actors can also target a law firm in order to gain access to corporate clients and their information.

The report also raises concerns that future increased use of online delivery methods; outsourcing of services; blockchain and Artificial Intelligence will increase the risks going forward. As Christina Blacklaws, President, The Law Society states;

“As data controllers, law firms handle significant volumes of confidential and sensitive information and client monies as part of their daily work. In the post-GDPR world and as the sector delivers and transacts more online, it’s vital that we get a common view and understanding of cyber threats and their impact.”

As well as understanding and assessing the risks, firms need to consider the adequacy of their existing controls and then strengthen them where necessary. The report identifies a number of simple key controls for firms to consider including:

Implementing processes to verify (via independent means) invoices and account details for money transfers;
Using ‘cooling off’ periods for changing account details for high value transactions;
Encouraging a culture where suspicious transactions are queried;
Educating clients about your firm’s invoice and money transfer processes to help them avoid falling victim to a phishing attack;
Monitoring user access of systems;
Keeping software, and especially operating system (OS), up to date;
Control what software and applications you choose to allow into your firm; and
Verify that third party suppliers, particularly those that hold their sensitive data, have basic cyber security controls in place.

All of the above controls are relatively cost effective for any firm but other controls may be disproportionate for smaller firms. To this end the NCSC’s ‘Small Business Guide’ offers simple practical technical tips for smaller firms. The NCSC also points firms to the government-backed ‘Cyber Essentials’ scheme. As well as providing simple but effective controls, certification under the scheme demonstrates a firm’s commitment to cyber security which can provide a competitive advantage.

UK-based law firms can also access cyber security expertise by signing up to the Cyber Security Information Sharing Partnership (CiSP), a joint industry and government initiative. There is a private CiSP group tailored to law firms which is free to join. Full details on the membership benefits and joining instructions can be found here. The NCSC or the Law Society can sponsor your organisation, as appropriate.

The NCSC report also recommends the NCSC ‘10 Steps to Cyber Security’, a guide to help board members and auditors ask the right questions about cyber security.

As with most frauds these losses occur not because of the absence of controls but rather that the controls in place are not applied consistently. According to the latest KPMG ‘Global Profile of a Fraudster’ report, weak internal controls were a factor in 61% of frauds.

A firm’s assessment should therefore also consider at a high level how likely it is that controls are adequately performed in each business area. Control systems should be reviewed at regular intervals to ensure that these remain current, relevant and appropriate to the needs of your firm. Risk models have to be regularly revisited and reconsidered in order to have assurance that the risk profile continues to be valid and in particular after:

Restructuring
Downsizing
Changes in business processes
When major new policies are being developed, changed or implemented differently
Following identification of weaknesses
The introduction of new computer systems
After an incident of fraud

Get in touch

Firms wishing to obtain further information about conducting a risk assessment, raising awareness amongst staff or auditing the adequacy of their existing controls, please feel free to get in touch.

Latest cybercrime risks to the legal sector and how to manage them Read More »

Ten and twenty pound notes (sterling) scattered

New Government focus on AML

Anti-Money Laundering, Blogs, Legal Compliance / Emma Willis

When I decided to start ABC and Teal I was very clear about one thing. I will not scaremonger, use fear to sell our services.

In compliance there are serious consequences for failing, massive fines in Data Protection and custodial sentences in AML, not to mention striking off by the SRA!

But you all know those things. You don’t need me to tell you that compliance needs to be effective in your firm to mitigate the risks of these consequences.

The consequences often seem very remote – unlikely, not something that will apply to me – and I think that is correct most of the time.

However, I have woken this morning to more criticism of our profession by Ben Wallace, Security Minister, saying solicitors must do more to prevent money laundering, and that failure to report will lead to sanctions and prosecutions.

I sat in a meeting this week, as I do many weeks, with lawyers who do not recognise this criticism of being professional enablers or of under reporting. Who don’t understand why they are being criticised, or “tarred with the same brush”.

Today’s message from government is clear – professionals who enable money laundering will be scrutinised, and there is a high probability of action.

My message today is this – MLROs/COLPs/MLCOs – ask yourself these 5 questions to establish whether you are confident your firm is doing enough.

Are you confident your policies and procedures are effective? Have you had any examples where something should have been spotted earlier, particularly if you have had a production order about a case.
Are you confident all issues are reported to you? Have you had any reports from the high risk areas? If not, are you confident staff know what to look for?
Do you turn cases away because you have concerns about the due diligence, source of funds? If the answer is yes you can point to evidence which says your risk assessment process works in weeding out suspicious cases and stopping money laundering.
Does your CDD procedure properly consider the source of funds? Often CDD is mainly focused on Client ID – which does not prevent money laundering. You need to be able to demonstrate you have considered the source of funds and wealth and thought about any red flags.
Are you confident on the law, what you must report, what the level of suspicion is, how to report?

If any of these answers are no, I would urge you to address them urgently.

Help is available on the Law Society website, the updated guidance from the Legal Sector Affinity Group is essential reading.

Get in touch

We can help too! Find out more about our AML services or alternatively, contact one of our helpful experts today.

New Government focus on AML Read More »

The impact of ‘Brexit’ on data transfers

Blogs, Data Protection, Legal Compliance / Emma Willis

With just over six months to go until the UK exits the European Union, the Government has started to issue guidance on what will happen if there is ‘no deal’ by the 29th March 2019.

As we all know, the current data transfer rules are set out at European level in the General Data Protection Regulations (GDPR) which came into force on 25th May 2018. Under the current rules, transfers within the EEA are permitted BUT, on 29th March 2019 the UK will become a ‘third country’ for the purpose of the applicable legislation.

So, what does this mean?

The Data Protection Act 2018 will remain in force and the EU Withdrawal Act would incorporate the GDPR into UK law to sit alongside the domestic legislation.

UK-EU Transfers

The Government has recognised the ‘unprecedented degree of alignment’ between the UK and EU data protection regimes and has confirmed that at the point of exit they will allow the free flow of personal data from UK to the EU (this will be kept under review).

EU-UK Transfers

These transfers become more complicated as the UK will be deemed a ‘third country’. Under the GDPR, transfers to a ‘third country’ can only take place in defined circumstances –

There is an ‘adequacy decision’ in place; or
There are appropriate safeguards in place.

Adequacy decisions are currently in place for Andorra, Argentina, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. The adequacy finding for Canada only covers data subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and the finding for the US is for transfers covered by the EU-US Privacy Shield Framework (currently subject to challenge by the EU Commission).

Appropriate safeguards are –

A legally binding and enforceable instrument between public authorities or bodies;
Binding corporate rules (BCRs);
Standard data protection clauses adopted by the Commission;
Standard data protection clauses adopted by a supervisory authority and approved by the Commission;
An approved code of conduct together with binding and enforceable commitments of the receiver outside the EEA;
Certification under an approved certification mechanism together with binding and enforceable commitments of the receiver outside the EEA;
Contractual clauses authorised by a supervisory authority.

So, how does this impact me and what do I need to do?

The UK Government has expressed its intention to apply for an adequacy decision but the EU has stated that the process cannot be started until after 29th March 2019 and obtaining a decision can be a lengthy process. This means that EU-UK transfers will need to have appropriate safeguards in place.

If your organisation transfers data from the EU to the UK, or if you are an organisation in the UK that receives data from EU then you should look to implement standard contractual clauses as a matter of urgency – the latest approved version can be found on the EU Commission’s website. It’s important to note that the current version was approved pre-GDPR and should be updated.

UK organisations who offer goods and services to data subjects within the EU will need to appoint a representative within the EU.

You can find out more here through these links:

Get in touch

If you’d like to discuss our data protection services, then contact one of our helpful experts today.

The impact of ‘Brexit’ on data transfers Read More »

Cyber Essentials – Affordable Security

Blogs, Data Protection, Legal Compliance / Dora

Guest blog from Centre for Assessment Ltd

The Cyber Essentials Scheme has been around for a number of years now, and more and more businesses are finding the demand for this is increasing when it comes to working with particular clients and qualifying for tenders/contracts. The core values of Cyber Essentials offers both clients and supply chains peace of mind, knowing that basic cyber hygiene measures are being adhered to, and the essential elements of the IT infrastructure are running effectively.

The core values of Cyber Essentials are built around 5 main controls: firewalls, secure configuration, access control, malware protection and patch management. The combination of these controls ensure that the risk of cyber-attacks is kept to a minimum, and that companies are showing a commitment to both staff and clients, ensuring data is handled and stored safely and securely.

There are two different levels of cover available through the scheme which are ‘Cyber Essentials’ and ‘Cyber Essentials Plus’.

Cyber Essentials is a self-assessment driven audit, which allows businesses interested in the scheme to be able to evidence their basic conformance to the scheme rules within an application document. Once completed this is then reviewed by a registered certification body for assessment. Decisions on conformance can be made within as little as 48 hours.

Cyber Essentials Plus includes all of the self-assessment elements of the basic Cyber Essentials. Additionally, it entails a vulnerability scan, on-site testing and a much more comprehensive assessment process verified by independent experts to help further ensure that the IT infrastructure is as secure as possible. This level of assessment represents a much larger commitment to the overall IT welfare of any business and helps in leading the war against cyber-crime within the UK.

These types of assessments are a step in the right direction for any business looking to bolster their IT security within any industry. Cyber Crime is forever evolving and adapting to try and appeal to victims via a range of different means. This can be something as simple as a link in an email or sending updates with ‘URGENT’ in the subject, to try and instil fear and panic usually leading to a knee jerk reaction, which can cost victims dearly.

The legal sector is no stranger to cyber-crime and its devastation, with 62% of law firms estimated to be the victim of a cyber-attack in the last year. Law firms are considered to be 7th most vulnerable industry for malware according to Cisco, with 4.5% of all UK data breaches occurring within the legal sector. Practices are starting to take note of the devastation this causes and are beginning to take steps towards a scheme like Cyber Essentials, to help in the fight against cyber-crime and to re-assure clients.

We are even starting to see schemes like Cyber Essentials incorporated into other standards within the legal sector. In July 2018, a new version of Lexcel, The Law Society’s Legal Practice Quality Mark, was announced, and within some of the policies and procedures there is a direct reference to the scheme stating, “Practices must have an information management and security policy and should be accredited against Cyber Essentials.” This is helping to further enforce the importance of the scheme and general cyber awareness within the legal sector.

Get in touch

Cyber Essentials is available through the Centre for Assessment. To find out more, visit their website, or telephone them on 0161 237 4080

If you’d like to know more about Teal’s data protection services can help you, get in touch with one of our experts today.

Cyber Essentials – Affordable Security Read More »

ePrivacy Regulation Update – What’s the latest?

Blogs, Data Protection, Legal Compliance, Regulatory Compliance / Emma Willis

For some time now, the EU Commission has been planning an update to the current ePrivacy Directive (which was implemented in the UK through the Privacy and Electronic Communication Regulations, or PECR for short). The ePrivacy Regulation will replace the current rules on issues like the use of cookies and electronic marketing and was originally meant to be implemented alongside GDPR but the final text was not ready in time. So, what’s the latest update?

After significant delays in moving towards a final text for the Regulation, the EU Commission issued an update on 12 June 2018 following policy debates on 8th June and it would appear that further changes have been proposed.

Cookies

Currently websites display cookie banners informing visitors that the website uses cookies for the purposes of data analytics – if you don’t want cookies dropping on your device then the only option is to stop using the website. The EU Commission had already indicated that under the new rules, internet browsing companies should design functionality to allow individuals to give specific consent for cookies (in fact a small number of organisations have already made this change on their websites). Following the debate, the options for cookies now include banning the use of cookie walls (claiming it is disproportionate for public authorities to make their websites conditional on the use of cookies) or changing the recitals to clarify the requirements around consent.

B2B Marketing

Currently a large proportion of B2B marketing is carried out on a soft opt-in basis. This is where the email address has been obtained through the sale (or negotiation for the sale) of a product or service, the individual was told that their email address would be used for unrequested marketing and was given the chance to opt-out at the time of collection, the marketing relates to similar products and services, and each email gives the recipient the chance to opt-out. The draft Regulation indicates that the EU Commission may seek to bring B2B marketing in line with the requirements for B2C marketing, meaning that the current soft opt-in option will be reversed so that communications can only be sent where the individual has given prior consent.

The updated draft text also allows member states to set a time limit under which organisations may contact individuals for direct marketing purposes. The DMA is continuing to argue against these changes which could cause significant issues for businesses.

Timeline

It is now anticipated that the Regulations will be passed towards the end of 2018 or Spring of 2019 with one year for implementation.

What actions can I take now?

It’s important to document what marketing your business undertakes, your legal basis for the processing and how you obtain contact details. If you don’t rely on consent, then you may want to start to consider what implications the Regulations will have on your business if they are passed in the current format.

Start to talk to your website provider about the options around cookies now BUT don’t make any major changes until the Regulations are finalised.

Watch this space! With 3-6 months to go before the Regulation is passed it’s inevitable that further amendments will be made.

Get in touch

If you need any help in the meantime with regulatory compliance, then feel free to get in touch. An initial chat with one of our associates is always free.

ePrivacy Regulation Update – What’s the latest? Read More »

Revised Lexcel Standard: Be prepared!

Blogs, Legal Compliance, Regulatory Compliance, Risk Management / Dora

The Lexcel Legal Practice Quality Mark has been revised and expanded. Lexcel accredited practices will be assessed against the revised standard from 1st November which means there is plenty for you to be working on. The Law Society Lexcel website gives you more information.

Broadly, these changes align the standard with recent new and revised legislative requirements in relation to data protection and financial crime.

The SRA Code of Conduct 2011 mandatory outcome 7.5 applies whether or not you are Lexcel accredited… ‘you comply with legislation applicable to your business, including anti-money laundering and data protection legislation’.

1. Start planning

There is a lot here to risk assess, develop, train, implement and test before your next Lexcel assessment … and of course to communicate to clients, as appropriate, and to your staff.

With regard to data protection, look at all the Lexcel requirements and you will soon realise that data protection touches all areas of the Standard.

2. Risk assess

You will need to look at the wider picture to assess and manage the risk of breaches and other offences. A thorough review will include your compliance plan, risk register, policies and procedures, record keeping, monitoring and training. Are you, for example, maintaining appropriate records of data processing activities, information asset registers, money laundering risk assessments and records? Remember it is important to keep records of your decision making to evidence compliance and to have robust breach reporting procedures. You need to understand your vulnerabilities and risks and address these accordingly.

3. Develop documentation

For all these new requirements off the shelf template policies or procedures may be helpful but are not always likely to be sufficient as every practice is different. One size does not fit all. Examine the profile of your own practice, undertake thorough risk assessments and gap analyses. Bespoke policies and procedures in plain language and applicable to your business are best practice, and likely to be more robust and easily understood by everyone.

4. Train, implement and test

Ensure your policies and procedures are effective. Undertake audits and spot checks.

Be prepared for assessors (and potentially other bodies), to review your central documentation, follow the audit trails, check your matter files and interview staff for evidence that they understand their responsibilities relevant to their role and have received appropriate training. Importantly too, are your staff able to identify potential breaches or compliance failures and do they know how to go about reporting this?

A wealth of information and guidance is available on the ICO, Law Society and SRA websites. As always, Teal blogs are a great resource for practical guidance.

Make sure you check out the Cyber Essentials scheme which, for Lexcel accreditation, firms are now encouraged to achieve.

Take a deep breath, consider your risks, raise awareness in your business, and start your reviews and preparation now.

Get in touch

Most of all, don’t lose sleep! To find out more about our risk management services, simply contact one of our experts today to chat about how we can help.

Revised Lexcel Standard: Be prepared! Read More »