GDPR AND THE LEGAL IMPLICATIONS

Size: px

Start display at page:

Download "GDPR AND THE LEGAL IMPLICATIONS"

Stewart Woods
5 years ago
Views:

1 GDPR AND THE LEGAL IMPLICATIONS Thursday 22 March 2018 Speakers: Simon Franckel (Oben Law) Alexandra Ruddy (Oben Law) Q & A Chair: Henry Wickham (Bedell Cristin) STEP Jersey is sponsored by:

2 GDPR and the legal implications STEP Jersey

The Team Simon Franckel Simon deals with litigation, contentious and non-contentious trusts, contentious probate, professional negligence and insolvency.

insolvency, trustee applications, professional negligence and partnership and shareholder disputes.

3 The Team Simon Franckel Simon deals with litigation, contentious and non-contentious trusts, contentious probate, professional negligence and insolvency. He has significant experience in a wide range of matters, both in court and out, including banking, trust and funds disputes, anti-money laundering issues, regulatory investigations, asset recovery, insolvency, trustee applications, professional negligence and partnership and shareholder disputes. He is a regular speaker at seminars on trust-related matters, and offers in-house training to trust businesses on trust and dispute resolution matters, particularly in good practice for avoiding breach of trust claims. In addition to having a number of published articles, he was asked by the Oxford University Press to pre-review a text on protectors on the basis of his knowledge of this area. As a Chartered Accountant Alex brings a different skill set to the team dynamic. Alex has spent most of her career in practice with two of the big four accountancy firms. Holding a senior position in Deloitte s Reorganisation, Forensic and Regulatory Services department Alex worked closely with financial services businesses and their legal advisers. She worked alongside the Jersey Financial Services Commission and the Joint Financial Crimes Unit on complex investigations, and also worked with the Viscount s department on insolvency matters. Alex also spent a short period of time working in the funds sector. Alex works closely with Nicola and Jamie to assist financial services businesses to find bespoke solutions to regulatory issues. She has considerable experience with AML/CFT and sanctions issues, policies and procedures, fraud and asset tracing and other litigation support. Alexandra Ruddy

4 Topic Areas Key differences between existing Privacy Law and GDPR GDPR v Data Protection (Jersey) Law 2018 D-SARS Cases Art. 45 Money Laundering regulations/ TRS Data Protection (Reg. and Charges) Jersey Regs 201_ Brexit

5 GDPR is a journey not a destination Y2K It is a milestone not a deadline We already have data privacy laws in place Evolution not a revolution Should be seen as an opportunity and not an additional cost Remember that you, yourself, are a Data Subject

6 Existing data protection law v. GDPR Key differences: Wider scope Captures more data Applies to Suppliers Tougher sanctions (fines etc) Data breach notification More individual (data subject) rights Data Protection Officers Emphasis on lawful processing/ legitimate interest Transfer of data Accountability and governance (In Jersey accountability is not a separate principle but is an overarching concept) Principles (slightly different) Cross border enforcement Derogations e.g. govt/national security Right to be forgotten D-SAR differences

7 GDPR v Data Protection (Jersey) Law 2018 Definition of data includes unstructured data held by public authorities Special category data includes information relating to a person s criminal record or activity Special provision under rights of access in relation to health records Administrative fines: 10,000 fine cap where the controller is processing in the public interest and not for profit Time limit on compliance with D-SARS Age of a child

8 D-SARS : what are the differences Currently under existing DP legislation you can make a subject access request so what are the differences? Fees: you can no longer charge unless the request is manifestly unfounded or excessive burden on you. If so, you can charge a fee or refuse to respond. Electronic access: you must allow your data subjects to make electronic requests (e.g. by ) and if the request is made electronically the information should be provided in electronic format (unless otherwise requested) Content of response: the data subject should be given details on what information is held about them and what processing is being carried out Response time: the data controller must respond to SARs within four weeks

9 D-SARS: what should you be doing? Update your policies and procedures being mindful of key timescales Training for employees on recognising and responding to subject access requests Draw up template letters to respond/ scripts for phone calls to ensure that you comply with GDPR requirements Assess how quickly you can access data for each data subject Consider how you can provide the information i.e. format

10 D-SARS: Points to consider What should be disclosed? Personal data only- if a natural person cannot be identified from the data it is not personal data. It is important to know what you do NOT need to provide: Article 25 of the Law - Right to withhold: data controllers have the right to withhold personal data if disclosing it would adversely affect the rights and freedoms of others. - see Dawson-Damer v Taylor Wessing below. - Tipping off offence. Right to be forgotten- could this be used as a test?

11 Importance of Contracts Three different types of contract to think about: Employment Third party service providers Clients

12 Cases Various v. Morrisons [2017] EWHC3113 (QB) Dawson-Damer v. Taylor Wessing [2017] EWCA Civ 74 Uber Equifax

13 Various v. Morrisons [2017] EWHC3113 (QB) Facts Claims under Data Protection Act 1998/misuse of private information /breach of confidence. DPA Schedule 1 Principle 7 requires appropriate technical and organisational measures to be taken against unauthorised processing, loss and damage to personal data. Finding: Breach of DPA but no loss. Morrisons vicariously liable for acts of employee. Damages to be assessed. Permission to appeal. Impact of GDPR

14 Dawson-Damer v. Taylor Wessing [2017] EWCA Civ 74 Facts SAR Outcome cf Jersey Art 25 DP(J) Law 2018 Art 29 Trusts (Jersey) Law 1984 NB Draft Amendment No. 7 to the Trusts (Jersey) Law also amends Article 29.

Facts Uber Breach was not made public by Uber or disclosed to regulators until over a year later. Uber reportedly paid the hackers $100,000 ransom to delete the data.

15 Facts Uber Breach was not made public by Uber or disclosed to regulators until over a year later. Uber reportedly paid the hackers $100,000 ransom to delete the data. Existing Law consequences: Requirement for effective DP policies and procedures which would include escalation of breaches such as this one Maximum penalties under the current UK DPA regime are 500,000 No mandatory requirement to report/notify breaches (but note ICO has made it clear in guidelines that it expects to be notified in respect of serious breaches). Under GDPR: Requirement for effective DP policies and procedures which would include escalation of breaches such as this one. Mandatory reporting to the Regulators if result in high risk for rights of data subject. Maximum penalties under GDPR will be the greater of 20m or 4% of total worldwide annual turnover

16 Equifax Facts Personal data of up to 143 million Americans could have been compromised. Information taken included names, social security numbers, dates of birth, addresses and driver s license numbers (everything needed for identity fraud) and some financial records The compromised data may include user names, passwords, security questions and other login information. The credit card numbers of at least 209,000 consumers were lost. Timing Reportedly Equifax knew about the data breach as early as mid-may 2017 but did not announce it publicly until 29 July Industry reports suggest that there was a security breach in Equifax s platform that had been in existence for 9 years and that hackers had slowly taken data for months. Allegedly 3 senior executives (including the CFO) sold their stocks between the date the hack was discovered and the date it was made public.

17 UK Trusts Register v Data Protection (Jersey) Law 2018 Reg. 45 Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations In certain circumstances- UK tax liability- trustees are required to disclose personal data. Disclose? Thoughts.

18 Draft Data Protection (Registration and Charged) (Jersey) Regulations 201_ Art 17 and 18 Data Protection Authority (Jersey) Law 2018 Registration of controllers and processors. Fees; form; exemptions. To remain as is from 25 May May NB risk-based tiered levy from 25 May 2019 to support the funding of the Authority.

19 Brexit Relates to transfers of data not scope. Art. 44 & 45 GDPR. Art. 66 & 67 Data Protection (Jersey) Law How easy would it be for a post-brexit UK to satisfy EU of adequacy? Theresa May and adequacy-plus.

20 Transfer of personal data to third countries or international organisations No restrictions on transfers to EEQ countries: Austria Germany Malta Belgium Greece Netherlands Bulgaria Hungary Norway Croatia Iceland Poland Cyprus Ireland Portugal Czech Republic Italy Romania Denmark Latvia Slovakia Estonia Liechtenstein Slovenia Finland Lithuania Spain France Luxembourg Sweden United Kingdom

21 Transfer of personal data to third countries or international organisations The following additional countries are considered by the EU as having adequate data protection laws: Andorra Guernsey New Zealand Argentina Isle of Man Switzerland Canada Israel Uruguay Faroe Islands Jersey

22 Comments and questions?

23 Contact details SIMON FRANCKEL Advocate +44 (0) ALEXANDRA RUDDY Director +44 (0)

24 THANK YOU FOR YOUR ATTENDANCE STEP Jersey is sponsored by:

Approach to Employment Injury (EI) compensation benefits in the EU and OECD

Approach to Employment Injury (EI) compensation benefits in the EU and OECD Approach to (EI) compensation benefits in the EU and OECD The benefits of protection can be divided in three main groups. The cash benefits include disability pensions, survivor's pensions and other short-