1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

Brexit: New UK Guidance if there’s “No Deal”

Yesterday, the ICO published new guidance on data protection implications of a “no deal Brexit”. This includes a “Six Steps to Take” Guide, a blog with embedded guidance and FAQs.  In addition, UK government published its plans for “No Deal Brexit”.

Here are the key points:

  • Substantive changes to GDPR rules: GDPR continues to apply under the EU Withdrawal Act.  But UK Government will amend it to remove references to “EU institutions and procedures” and references to “Union or Member State law”.
  • ICO role: The ICO will remain the ICO’s Independent privacy regulator. It will no longer be a member of the European Data Protection Board. But the UK and EU have agreed to implement rules on co-operation between the ICO and the Board.
  • Data Transfers to EEA countries and Gibraltar: the UK will transitionally recognise all EEA states and Gibraltar as providing adequate protection for personal data.  Personal data continues to flow freely from the UK to these countries.  But this may be kept under review.
  • Data Transfers from the EEA to the UK: you need a transfer solution in place.  This may require re-papering with SCCs to be clear that the UK is a data importer or another transfer solution.
  • Data Transfers under EU adequacy decisions: The UK will preserve the effect of the EU adequacy decisions on a transitional basis.  Data Transfers to these jurisdictions can continue uninterrupted.  This covers: Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and USA (under Privacy Shield framework). As Privacy Shield is an EU/US agreement, it is less clear how the UK can recognise it post-Brexit.  The ICO have actually said that Privacy Shield would be excluded from this arrangement but that the UK government’s intention is to make arrangements for it to continue to apply.  This will need a “watching brief”.  It may require an alternative solution to be in place for transfers from UK to US if these arrangements are not in place in time.
  • Data Transfers from countries with an existing EU adequacy decision to the UK:  These transfers were based on an adequacy decision in place with the EU.  It will be for each individual country to determine whether it will respect that decision regarding transfers to UK.  But transfer solutions may be necessary.
  • Data Transfers from UK under EU Standard Contractual Clauses (SCCs): you are probably using SCCs to export data to countries like the US.  No action is required on these at this time provided you have SCCs in place.  The UK government plans to recognise EU SCCs.  The ICO will be given the power to issue new SCCs (presumably customised for UK terminology) post-Brexit.
  • BCRs: Existing authorisations of BCRs made by the ICO continue to be recognised in UK law post-Brexit.  The UK will also recognise BCRs approved by other EU supervisory authorities pre-Brexit.  The DCMS paper suggests that post-Brexit, the ICO will continue to be able to authorise new BCRs but only under domestic law.  It is not clear why BCRs approved post-Brexit by the EU would not be potentially valid for transfers from the UK (as UK BCRs are for transfers from adequate jurisdictions).  BCRs (both approved and in-flight applications) will presumably need to transition to a new Lead Supervisory Authority.  Existing BCRs will also need to be updated to reflect the UK as a third country.
  • One Stop Shop:  If you’re only established in the UK post-Brexit (not the rest of the EU), you’ll lose the benefit of “One Stop Shop”.  You will also lose the benefit of “One Stop Shop” where you no longer undertake any cross-border processing in the EU due to Brexit (e.g. you previously processed only in two EU countries one of which was the UK).  This may mean that in the event of a breach you would need to deal with both the ICO as well as the supervisory authorities in the each of the relevant EU countries in which individuals are affected.   This raises the possibility of multiple enforcement actions (including fines).

There are a number of other significant implications:

  • Consider updating GDPR documentation (e.g. Article 30 records) and privacy notices (e.g. references to the UK as part of the EU and in relation to data transfers).
  • If you end up not established in the EU post-Brexit but are caught by the EU extra-territorial scope, you’ll probably need to appoint a Representative (one Representative in the jurisdiction in which you have the majority of your customers). Conversely, if you target products into or monitor data subjects in the UK but are not established here, you probably need to appoint a UK Representative.
  • Consider reviewing DPIAs (if they involve data transfers).

DCMS plan to issue draft regulations soon to implement the above proposals.

Brexit: New UK Guidance if there’s “No Deal”

Brexit and data protection

As over half a million people marched to Westminster this weekend for a People’s Vote – a demand for a second referendum on the eventual Brexit deal – this put me in mind of one essential similarity between the UK referendum-hopefuls (on the one hand) and global Data Protection Officers (on the other): A desire for control over the direction of events following the 29 March 2019. Less than 6 months away from “Brexit Day”, two questions asked daily by our global clients are: How will Brexit affect data transfers to and from the UK? And how best should we prepare?

A Brexit deal is essentially uncertain – ironically for the demonstrators, that uncertainty is only likely to be exacerbated in the short term by any prospect of a further referendum. A transition period covering data flows is similarly moot. The prospect of an adequacy decision is months or even years away, if the pace of progress in the European Commission’s dealings with Japan and South Korea is anything to judge by.

Therefore, rather than crystal-ball gazing at more attractive alternatives, the only sensible approach, in my view, is to prepare now for the absence of a deal on data transfers – the so-called “Hard Brexit” scenario. A “Hard Brexit” for data privacy means the UK becoming, as of the later of 29 March 2019 or the end of a transition period which covers data flows, a “third country” within the meaning of GDPR.

The practical preparations required would include the following:-

  • Territorial Scope Assessment – a global business will already be familiar with exploring whether their non-EEA establishments are caught by Article 3(2) GDPR. A UK establishment will now have to ask themselves the same questions: (i) Are we offering goods or services to data subjects in the EEA? (ii) Are we monitoring the behaviour of data subjects, as far as their behaviour takes place in the EEA?
  • Accountability – if the answer to the territorial scope assessment above is “yes”, then this should be acted upon by the UK establishment. However, if GDPR compliance programmes have been completed, then the UK establishment will be in a strong starting position. The assessment should be documented internally for the benefit of supervisory authorities in the affected Member States. It may also be beneficial for clarity to split away the UK Article 30 Records of Processing caught within extra-territorial scope of GDPR.
  • Appoint a Representative – the UK establishment should, subject to the exceptions in Art 27(2) applying, appoint a representative in writing in one of the Member States affected by the UK establishment’s processing activities. For a business with multiple EEA establishments, another existing establishment may suffice.
  • Data Exports – in the absence of an adequacy decision, for organisations caught by GDPR, one of the safeguards in Article 46 GDPR must be selected for any data transfers to the UK. In many cases these will be the standard contractual clauses approved by the European Commission, although businesses who have Binding Corporate Rules in place may continue to rely on BCRs. Addressing Brexit issues will involve e.g. the review of intra-group agreements governing data transfers to re-badge UK establishments as Data Importers and processor contracts with vendors to ensure that adequate safeguards are in place.
  • Privacy Notices – privacy notices need to set out (where applicable) the fact that a controller intends to transfer personal data to a recipient in a third country as well as the safeguards which are in place. For organisations caught by GDPR, once the “data exports” task above has been completed, a minor redraft of privacy notices to capture the new additional information will need to be completed.
  • Main Establishment – for an organisation caught by GDPR to benefit from the One-Stop-Shop, the “main establishment” will have to be based in a Member State. Where the “main establishment” is currently in the UK, a defensible case may have to be built for why another establishment should be re-designated as the “main establishment” post-Brexit. In some circumstances, it may be that decision-making functions and resources will have to be shifted out of the UK to another establishment.
  • Reliance on Union or Member State Law – in certain circumstances, the GDPR makes provision for legal bases which align to Union or Member State Law. For example, in order to rely upon Article 6(c) or (e) GDPR as a basis for lawful processing. Where processing involves UK establishments they will not be able to claim reliance on UK laws in relation to processing which is caught by extra-territorial scope of GDPR in the same way that a US entity would not be able to rely upon US law. This may involve some creative re-thinking or risk decisions. If anyone is able to solve what I will euphemistically call the “Article 10” dilemma, I welcome answers on a (non-literal) postcard!

For UK establishments, the GDPR will be incorporated into UK law on 29 March 2019 as a result of the European Union (Withdrawal) Act 2018. Therefore, the story will be otherwise largely one of continuity in terms of other areas of the law, including data subject rights, controller and processor obligations and data export arrangements, save for any provisions relating to EDPB and One-Stop-Shop. Which leads me onto…

A Better Alternative for Data Privacy in the UK?

Rather than seek adequacy (or even, adequacy+), there may be a more attractive model for the continuing relationship of the UK with the EU in respect of data transfers.

By result of a Joint Committee Decision (JCD), the GDPR entered into force in the EEA EFTA States of Iceland, Liechtenstein and Norway on 20 July 2018. This enables the supervisory authorities of the EFTA States to participate fully in the one-stop-shop, the consistency mechanism and the European Data Protection Board (EDPB), save for the fact that they are not able to vote or stand for election as chair or deputy chair of the EDPB.

In the event that the UK became an EEA EFTA State, this would (i) enable the UK ICO to remain part of the consistency mechanism and the one-stop-shop (ii) enable the UK ICO, which is well-resourced and has a wealth of experience, to continue to approve and monitor Binding Corporate Rules and have a limited participatory role in the EDPB and, crucially, (iii) avoid all of the legal issues outlined above. From the perspective of data transfers, could this be the best possible ready-beaten path, save for full membership of the EU?

 

Brexit and data protection

What have the ICO said about data breach?

The ICO have been discussing data breach reporting under GDPR in a new webinar.

Here are the key points:

  • GDPR introduces mandatory breach reporting.  This applies to accidental breaches and internal breaches – not just those that are deliberate or are about losing personal data externally.  Don’t forget about integrity and availability breaches (e.g. damage to records due to fire or flood as well as ransomware).  Temporary loss of data, according to EDPB Guidance can be a personal data breach.
  • This does not mean that you have to report all general breaches of GDPR (eg. failure to present a suitable privacy notice).  Breach reporting only applies to breach of confidentiality, integrity or availability of data: the so-called the “CIA Triad”.  Similarly, breach notifications do not apply in relation to records relating to deceased persons (not covered by GDPR).
  • The 72 hour timeline kicks in from “awareness” of the breach.  This equates to having a “reasonable degree of certainty” that the breach has occurred.  The ICO gave an example of a customer who complains that he/she has received someone else’s information.  This would constitute “awareness”.  It may be less clear, at the initial stage, whether an IT issue has resulted in a personal data breach as that may require more forensic/detailed investigation.
  • In addition to deciding whether or not to notify a breach, you should always undertake a risk assessment to identify the scope and extent of the breach, contain it and stop it repeating or harming individuals.  This risk assessment will also impact the shape of the overall response.
  • If a personal data breach has occurred and you are aware of it, it is then necessary to decide the level of risk associated with it to determine whether or not to notify the ICO.  In order to require notification, there should be more than a remote chance of harm.  If there is more than a remote chance of harm, then this would make the risk to rights and freedoms of individuals likely, triggering Article 33.  Equally, mere inconvenience is not enough.
  • Article 33 sets out a number of pieces of information that should be provided with a notification.  It’s no excuse not to be able to provide this, even within 72 hour timeline.  So basic information will be required even if further information will be provided later as permitted by GDPR.
  • The 72 hour deadline is “72 real hours” – so this includes evenings and weekends.  If a breach comes to your attention on Friday morning, it will need to be reported by Monday afternoon.  Extra resources are likely to be required to respond promptly.
  • The ICO response will be quick (same day/next day) for serious breaches.  Less serious breaches may mean the ICO gets back to you in a couple weeks.
  • You can report a breach by phone (available during working hours), or web form (available 24/7).  You don’t have to use the official ICO web form, but the ICO prefers it if you do as it contains all the relevant information.
  • You always have to record breaches in your data breach log – the ICO can come and inspect this later if they wish.
  • The ICO acknowledge the risk of “notification fatigue” and say that that’s the reason why notification to data subjects under Article 34 is only required where there is a likely high risk to rights and freedoms of relevant individuals.
  • The sectors that have typically notified data breaches since 25 May are health, education, general business, local government and some law firms.
  • The ICO repeat their general advice that “not every breach needs to be reported”.  It’s also the controller’s decision as to whether or not to report.  They also mention practical points such as an example where someone reported a loss of payslips and rang back a couple of hours later to say they had found them!  Better not to do this.
  • The webinar also covered a number of live questions: One question was whether to report the situation where access rights to particular data have been inappropriately broad, but there is no evidence of actual unauthorised access.  The ICO think that this could be reportable if the situation had been allowed to last for a long time so there is, therefore, a significant risk of unauthorised access.  Presumably, if this happened for a short time, you could argue that the likelihood of unauthorised access was very limited.
  • Someone else asked about data sent to an old address and then finding that the data subject had moved addresses without telling the controller.  This is not a breach of security, although you could separately ask yourself whether sending sensitive information by post is an appropriate security risk in the first place.
What have the ICO said about data breach?

ICO Release Annual Report

The Information Commissioner’s Office have released their Annual Report for 2018.  This blog summarises the key messages.

Information Commissioner’s Thoughts

Elizabeth Denham highlights the following in her foreword to the Report.

  • The ICO has been involved in producing significant GDPR guidance in the last 12 months and has also run an internal change management process to ensure it is up to the demands placed upon it by GDPR (think: extra staff, new breach reporting functions and helplines).
  • The ICO’s pay levels have fallen out of step with the rest of the public sector.  UK Government has given the ICO 3-year pay flexibility and some salaries have increased.
  • The ICO has taken decisive action on nuisance calls and misuse of personal data.
  • The ICO began investigation of over 30 organisations in relation to use of personal data and analytics for political campaigns.
  • The ICO launched a “Why Your Data Matters” campaign – designed to work as a series of adaptable messages that organisations can tailor to inform their own customers of their data rights.

The Laws that the ICO Regulates

The Report refers to the Data Protection Act 1998 and the new Data Protection Act 2018 as well as the Freedom of Information Act 2000.

But don’t forget about the Privacy and Electronic Communications Regulations and the Investigatory Powers Act 2016. The ICO is also an authority to which organisations can report cyber incidents under the new Network and Information Systems Regulations 2018 (NIS).

Key Guides

The ICO has produced a Guide to GDPR – definitely worth a read.

The ICO has also produced an introduction to the Data Protection Bill and a Guide to the Law Enforcement Directive as well as significant other guidance.

The ICO have also supported other bodies in producing their own GDPR guidance:

  • Direct Marketing Association;
  • The National Health Service (NHS);
  • The Health Research Authority; and
  • The Department for Education.

There is also a new guidance on international transfers to reflect the Privacy Shield and guidance on the new case law on the concept of “disproportionate effort” in the Subject Access Code of Practice.

Data Sharing Codes of Practice

The ICO engaged with UK Government on data sharing codes arising from the Digital Economy Act 2017. This includes the publicly available register of information sharing agreements.

ANPR

Automatic Number Plate Recognition data used to be retained for 2 years. The ICO and the Surveillance Camera Commissioner raised concerns and the UK police have agreed to reduce the retention period to one year.

Participation in Global Networks

The ICO led the 2017 Global Privacy Enforcement Network Sweep with 24 regulators around the world looking at the control users have over their personal information. Privacy Notices of 455 websites that were assessed and often found inadequate.

Civil Monetary Penalties – Fines

The ICO issued 11 fines for serious security failures. The joint highest fine ever (£400k) was served on Carphone Warehouse.  There were significant fines for nuisance callers and spammers.

Criminal Investigations

The ICO launched 19 prosecutions and gained 18 convictions for data theft under the old Section 55 Data Protection Act 1998.

It also ran two investigations into acquisition of data in the Automotive Repair Industry and alleged breaches of Section 55 DPA 1998 by clients tasking private investigators to unlawfully obtain personal data. The case law involving the prosecution of private investigators and clients continues.

Self Reported Data Breaches

The number of self report breaches has increased by 29%. Under GDPR it is mandatory to report data breaches to the ICO.  There has been a significant spike in GDPR breach notification since 25 May 2018.

The sector that reported the largest number of breaches was health (37% of all cases).

Telephone Preference Service (TPS)

This is the central UK opt out register where individuals can object to telemarketing calls. In January 2017, the ICO took over responsibility for running TPS.  This enables quicker receipt and assessment of intelligence for ICO enforcement teams.

Funding/Notification Fees

Registration/notification fees collected in the last year totalled £21 million. This regime has, with effect from 25 May 2018, been replaced by a new fee regime which will be used to fund the ICO going forward.

Helpline calls

For obvious reasons, there has also been a spike in calls to the ICO helpline. Call numbers have increased by 24.1%.  Live chat has increased by 61.5%.  Written advice has increased by 40%.  Needless to say, the ICO is expanding its operations and recruiting more staff.

Brexit

We think the ICO has probably got enough of it on its plate with GDPR, e-privacy and all the new guidance. Then there’s Brexit!  There’s actually little comment on Brexit in the Annual Report other than to flag that it is one of the issues for the ICO.  Then again much of the detail on this has yet to be worked out.

The Commissioner concludes in her “foreword” that “the ICO is the proactive digital regulator the UK needs for ongoing challenges of upholding information rights in the digital world”.

Much more work to be done!

ICO Release Annual Report

What does BREXIT mean for data protection?

On 23 June 2016, the UK is holding a referendum as to whether to stay in the European Union or leave it. But what does a BREXIT (a British Exit from the EU) mean for data protection?

Most of the UK law on data protection comes from the EU. The UK Data Protection Act 1998 and the Privacy and Electronic Communications Regulations both implement overarching EU law. So you might think this is like “unplugging” the source of data privacy law and therefore switching it off? But UK data protection law, in fact, pre-dates the European data protection directives. In fact, the UK was a signatory to the 1981 Convention (the forerunner of modern data protection law). Enough history!

What could happen in theory?

The UK parliament could reduce (or repeal) the Data Protection Act. The Courts could decide to no longer follow EU case law. Most importantly, the UK could choose not to implement the General Data Protection Regulation (GDPR). This, as we all know, is a wholesale upgrade to EU data protection law. GDPR includes new penalties of up to 4% of worldwide turnover, new legal duties to notify of data breaches and requirements to implement an accountability framework of policies and procedures.

What will happen in practice?

The UK could leave the EU and join the European Economic Area. In this case, it would be legally obliged to maintain data protection law on an equivalent footing to the EU. So all the current law would stay. GDPR would also be a requirement.

Theoretically, the UK could go out on its own. However this would make it a non-adequate jurisdiction for international data transfers. This means it cannot receive personal data freely from the EU. It could ask the EU for an “adequacy decision” but its anyone’s guess as to how long that would take. It could be a difficult negotiation (…think about the recent story of Snowden, Schrems and the proposed Privacy Shield, which is still being worked on).

No doubt there would be huge pressure on the UK to fall into line (dare I say it) with EU-style data protection law anyway. Otherwise, this could be a significant drag on international trade.

Finally, there is the practical argument that we actually need data protection law to underpin consumer trust in the digital economy. So let’s not trash it.

For what it’s worth, the ICO say that the UK needs clear and effective data protection law regardless of whether it remains in the EU. They don’t expect to be packing their bags.

Whatever the uncertainty on a possible UK exit, the issue will, at least, be resolved in a little over 7 days.

What does BREXIT mean for data protection?