New EU data protection regulation

The text of the new EU General Data Protection Regulation (GDPR) has been finalised. When it comes into force it will replace all data protection legislation in EU member states (including the UK’s Data Protection Act 1998 (DPA)) without the need for further national legislation.

The GDPR will apply to any entity offering goods or services (regardless of payment being taken) and any entity monitoring the behaviours of citizens residing within the EU. Companies are now directly responsible for data protection compliance wherever they are based (and not just their EU-based offices) as long as they are processing EU citizens’ personal data.

Principles

The data protection principles, as set out in the DPA, remain but they have been condensed into six as opposed to eight principles. Article 5 of the GDPR states that personal data must be:

1. Processed fairly, lawfully and in a transparent manner in relation to the data subject.

2. Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.

3. Adequate, relevant and limited to what is necessary in relation to the purposes for which data is processed.

4. Accurate and, where necessary, kept up to date.

5. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.

6. Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Consent

Like the DPA, the GDPR will require data controllers to have a legitimate reason for processing personal data. If they rely on the consent of the data subject, they must be able to demonstrate that it was freely given, specific, informed and unambiguous for each purpose for which the data is being processed. Consent can be given by a written, including electronic, or oral statement. This could include the data subject ticking a box when visiting a website, choosing technical settings for social network accounts or by any other statement or conduct which clearly indicates their acceptance of the proposed processing of personal data. Silence, pre-ticked boxes or inactivity will no longer constitute consent.

Children

The preamble to the GDPR states: ‘Children deserve specific protection of their personal data, as they may be less aware of risks, consequences, safeguards and their rights in relation to the processing of personal data. This concerns especially the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of child data when

using services offered directly to a child.’

Article 8 requires that where the personal data of a child under 16 is being processed to provide ‘information society services’ (for example, online businesses, social networking sites and so on) consent must be obtained from the holder of parental responsibility for the child. Member states are allowed to lower this threshold where appropriate but not below the age of 13.

Data subjects’ rights

The list of rights that a data subject can exercise has been widened by section 2 of the GDPR. The subject access right, rectification and being able to object to direct marketing remain. The right to have personal data processed for restricted purposes and the right to transfer data/have it transferred to another data controller (data portability) are new rights.

In addition, article 17 introduces a ‘right to be forgotten’, which means data subjects will be able to request that their personal data is erased by the data controller and no longer processed. This will be where the data is no longer necessary in relation to the purposes for which it is processed, where data subjects have withdrawn their consent, where they object to the processing of their data or where the processing does not comply with the GDPR. However, the further retention of such data will be lawful in some cases where it is necessary for compliance with a legal obligation or for reasons of public interest in the area of public health or for the exercise or defence of legal claims.

To strengthen the ‘right to be forgotten’ online, the GDPR requires that a data controller who has made the personal data public should inform other data controllers which are processing the data to erase any links to, or copies or replications of, that data.

Data protection by design

Data controllers will be expected to include data protection controls at the design stage of new projects involving the processing of personal data. Where they wish to process personal data that poses potentially high risks they will have to, prior to the processing, carry out a data protection impact assessment. Supervisory authorities (the member state’s data protection regulators, for example the Information Commissioner’s Office (ICO) in the UK) will be able to produce lists as to what sort of processing would warrant such an assessment.

Notification

The current system of notification under the DPA will be replaced by a requirement for data controllers to keep an internal record in relation to all personal data they process (article 28). The record must include, among other things, details of the purpose of processing personal data, recipients, transfers to third countries, time limits for erasure as well as a general description of the technical and organisational measures in place protecting the data.

Security breaches

Under the DPA, even in the most serious data breaches, there is no requirement to inform the ICO. Article 31 of the GDPR requires that, as soon as the data controller becomes aware a personal data breach has occurred, it should, without undue delay and, where feasible, not later than 72 hours after becoming aware of it, notify the personal data breach to the ICO, unless the controller is able to demonstrate that the breach is unlikely to result in a risk for the rights and freedoms of individuals. Where this cannot be achieved within 72 hours, an explanation of the reasons for the delay should accompany the notification to the ICO and information may be provided in phases without undue further delay.

Furthermore, data subjects should be notified without undue delay if the personal data breach is likely to result in a high risk to their rights and freedoms to allow them to take the necessary precautions. This notification should describe the nature of the personal data breach as well as recommendations for the individual concerned to mitigate potential adverse effects. This should be done as soon as reasonably feasible, and in close cooperation with the ICO and respecting guidance provided by it or other relevant authorities (for example, law enforcement authorities).

Fines

Currently, the ICO can issue a monetary penalty notice of up to £500,000 for serious breaches of the DPA.

The GDPR introduces much higher fines.

For some breaches of the GDPR, data controllers can receive a fine of up to 4% of global annual turnover for the preceding year (for undertakings) or €20m. For other breaches (for example, failing to keep records or complying with security obligations) the fine can be up to €10m or 2% of global annual turnover (for undertakings).

Data protection officer

Section 4 of the regulation introduces a statutory role of data protection officer (DPO). Most organisations handling personal data, both data controllers and data processors, will require a DPO who will have a key role in ensuring compliance with the GDPR. A group of undertakings may appoint a single DPO provided that s/he is easily accessible. Public bodies may also have a single DPO for several such authorities or bodies, taking account of their organisational structure and size.

The DPO, who can be a staff member or contractor, shall be designated on the basis of professional qualities and, in particular, knowledge of data protection law and practices, and the ability to fulfill the tasks referred to in article 37. These are:

• to inform and advise the controller or the processor and the employees who are processing personal data of their obligations pursuant to the GDPR;
• to monitor compliance with the GDPR, including the assignment of responsibilities, awareness-raising and training of staff involved in the processing operations, and the related audits;
• to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to article 33;
• to cooperate with the supervisory authority (the ICO); and
• to act as the contact point for the supervisory authority on issues related to the processing of personal data.

The GDPR is accompanied by a directive, which contains new rules for data protection when applied to crime and justice, but which can be implemented by each member state through its own laws with greater flexibility.

The European parliament and council will formally adopt the final text of the GDPR at the beginning of 2016. It will come into force two years thereafter.

There is much do in the next two years. All data protection practitioners and lawyers need to read the GDPR and consider its impact on their organisation and clients. Training and awareness at all levels must start now.

Ibrahim Hasan is a solicitor and director of Act Now Training (www.actnow.org.uk)

The Law Society’s Civil Litigation Section spring conference: Growing your practice and looking ahead for opportunity will be held on 21 April.