EU General Data Protection Regulation

LAYTONS

EU General Data Protection Regulation Preparing for the changes

LAYTONS Our Sectors • • • •

Technology, Communications & Digital Media Construction, Land & Planning Personal Affairs, Private Wealth & Philanthropy Retail & Hospitality

Our Expertise • • • • • • • • • • • •

Banking & Finance Charities Commercial & Corporate Data Protection & Information Disputes Employment & Immigration Family & Matrimonial Insolvency & Restructuring IP & Technology Real Estate Tax Trusts, Estates & Private Client

This information is offered on the basis that it is a general guide only and not a substitute for legal advice.

We cannot accept any responsibility for any liabilities of any kind incurred in reliance on this information.

EU General Data Protection Regulation Preparing for the changes The General Data Protection Regulation (GDPR) will apply from 25 May 2018, bringing with it a number of changes to existing data protection law and new requirements for organisations. This briefing looks at the key changes, highlighting actions to take and ways in which we can help.

Geraint Thomas Partner | Disputes geraint.thomas@laytons.com +44 (0)20 7842 8000

Michael Edgar Solicitor | Commercial michael.edgar@laytons.com +44 (0)20 7842 8000

EU GDPR | February 2017

Key changes & implications

Brexit

in order for information about the individual to constitute personal data; the GDPR makes it clear that other information

The GDPR will almost certainly apply to the UK

such as an identification number, location data, an online

notwithstanding Brexit since (1) the UK will still be in the

identifier or other factors specific to an individual can be

EU when the GDPR comes into force, and (2) even after

sufficient for that data to be caught.

the UK’s exit from the EU, the Government is expected to implement the GDPR’s provisions through national legislation.

Accordingly, the Information Commissioner has advised UK

Genetic data and biometric data

organisations to continue preparing for the GDPR coming into effect.

The GDPR introduces specific definitions of “genetic data” (for example, an individual’s gene sequence) and “biometric

Higher bar for unlawful processing

data” (for example, fingerprints and facial recognition data).

Genetic data and biometric data will both be treated as sensitive personal data, affording them enhanced protections

Generally a key requirement to process personal data lawfully

under the new rules.

is to obtain the requisite consent to do so, and the bar for valid consents will be raised under the GDPR. This is important now since if you do not obtain consent in a GDPR-compliant way there is a risk that customer and employee consents may

Pseudonymisation

expire following the GDPR coming into effect.

The GDPR specifically addresses the concept of Action: privacy policy and statements should be reviewed

“pseudonymisation”, where data is subjected to technological

and may need amendment.

and organisational measures so that it no longer directly identifies an individual without the use of additional

Broad definition of personal data

information (provided that such additional information is kept separately and securely). Pseudonymous data will still be considered a type of personal data; however, businesses

The GDPR defines personal data as “any information relating

which implement pseudonymisation techniques on their

to an identified or identifiable natural person”. To determine

personal data can enjoy various benefits under the GDPR.

whether a natural person is “identifiable”, account should

This recognises that the application of pseudonymisation

be taken of “all the means reasonably likely to be used” to

to personal data can reduce the risks to the data subjects

identify the person. Therefore an individual’s name, while

concerned and help controllers and processors to meet their

obviously a major indicator of identity, is not a necessity

data protection obligations.

4

EU GDPR | February 2017

Data processors will have data protection obligations as well as data controllers

Privacy by design and by default The newly codified privacy by design obligation requires data controllers to assess data protection risks throughout the designing of a new process, product or service, rather

Where you are or will be processing personal data as a

than retrospectively. The new privacy by default obligation

processor (rather than controller), this will open up its

requires that businesses implement appropriate technical

potential exposure to fines and reputational damage.

and organisational methods to ensure that, by default, only personal data which are necessary for each specific purpose

Action: contracts should be negotiated with this in mind, and

are processed.

certain current contracts may need to be reviewed and riskassessed.

Action: consider this carefully in relation to current and new measures that you use to safeguard personal data.

Minimum contract requirements

Data breach notification

From 25 May 2018, the minimum obligations that must be included in a contract under which personal data is handled

All data controllers will need to self-report serious breaches to

will significantly change. Concluding contracts without

the ICO within 72 hours of becoming aware of them from 25

consideration of this risks having to request renegotiation in

May 2018.

the middle of their term around May 2018, or being in breach of the GDPR.

Action: training and infrastructure preparation is

Action: again, contracts should be negotiated with this in

recommended in good time ahead of May 2018.

mind going forward, and certain current contracts may need to be reviewed and risk-assessed.

Right to data portability Action: technical preparations may be needed to enshrine this right. Such preparations may also help with responses to subject access requests, where the timeframe for responding will change to “without undue delay” and “at the latest within one month” from the time the SAR is received (currently, the timeframe is “promptly” and at the latest within 40 days).

5

EU GDPR | February 2017

Privacy Impact Assessments

Controllers and processors are required to ensure that the DPO is involved "properly and in a timely manner in all issues

There is a greater emphasis on privacy impact assessments.

which relate to the protection of personal data." The role of

Requirements on how these should be conducted

DPO is therefore a significant responsibility for controllers and

(periodically) has now been codified, and PIAs, carried out

processors.

under the supervision of the DPO, will be a legal requirement in certain circumstances under the GDPR.

Action: businesses will need to assess whether or not they fall within one or more of the categories in which appointing a

Action: the way in which your PIAs are conducted should be

DPO is mandatory. Examples of those businesses likely to be

reviewed against the GDPR’s requirements.

covered by the new requirement include public authorities, B2C businesses which regularly monitor online activity of their

Tougher sanctions

customers and website visitors, and healthcare companies who process large amounts of medical information. You may wish to appoint a DPO even where you are not required to

Compliance is increasingly important as the maximum ICO

by the GDPR, in order to help ensure you discharge your

fine for breaches is increasing from ÂŁ500,000 to the higher

obligations under the data protection rules and demonstrate

of â‚Ź20million or 4% of annual worldwide turnover of the

compliance.

corporate group. The ICO will also enjoy wide investigative powers, and the GDPR makes it easier for individuals to bring private claims against data controllers and processors relating to data protection breaches.

Data protection officer (DPO) The GDPR introduces the requirement for certain types of businesses to appoint a DPO. The following organisations must appoint a DPO: (1) public authorities; (2) controllers or processors whose core activities consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; (3) controllers or processors whose core activities consist of processing sensitive personal data on a large scale.

6

EU GDPR | February 2017

Transferring personal data outside the European Economic Area

How we can help

While the GDPR will not implement a significant shift to the

We have a specialist data protection team on hand to support

rules on transferring personal data outside the EEA, the

you on all aspects of data protection compliance.

tougher sanctions being introduced for breaches of the rules mean that compliance is increasingly important.

It is important to understand precisely what the term

Our assistance includes: •

GDPR implementation plan:

“transfer” means. The migration of a customer database from

we can help you prepare a timetable of implementing

a UK-based business to a business based outside the EEA

changes to prepare for the GDPR coming into force.

would clearly fall within the definition. But a number of other common business activities will also constitute a “transfer”, for

•

Privacy impact assessment:

example storing your business data using a hosting provider

we can prepare and generally support a PIA that is

whose server is based outside the EEA, or sharing data

consistent with the GDPR’s requirements.

between different companies in the same corporate group where transferors are based in the EEA and transferees are

•

International data transfers we advise on a variety of cross-border data issues, for

based outside it.

example those relating to your supply chain, suppliers, cloud storage and intra-group transfers.

Generally, transfers of personal data outside the EEA will breach the data protection rules unless the Commission has made a “positive finding of adequacy” in respect of the

•

Training

country in which the transferee is located, or the transferor

we can tailor data protection training to your

has put in place adequate safeguards to protect the rights

requirements, whether it is for your data protection

of the data subjects whose data is transferred. The latter

officer, in-house legal team, key teams or company-

is commonly achieved by incorporating the Commission’s

wide.

Standard Contractual Clauses into the contract governing the data transfer.

•

On-going support: we are here to support you with data protection

If you have US companies in your corporate group, you

questions and issues as and when they arise.

have the option of certifying the US entities with the US Department of Commerce under the Privacy Shield Framework to help ensure that they can receive personal data transfers from the EEA lawfully.

7

EU GDPR | February 2017

8

LAYTONS Sectors

Expertise Technology, Communications & Digital Media

Commercial & Corporate

Data Protection & Information

LAYTONS London

Manchester

Guildford

2 More London Riverside London SE1 2AP +44 (0)20 7842 8000 london@laytons.com

22 St. John Street Manchester M3 4EB +44 (0)161 214 1600 manchester@laytons.com

Ranger House, Walnut Tree Close Guildford GU1 4UL +44 (0)1483 407 000 guildford@laytons.com

laytons.com

Š Laytons Solicitors LLP which is authorised and regulated by the Solicitors Regulation Authority (SRA Nº 566807). A list of members is available for inspection at the above offices.