Legal news Deloitte Czech Republic. July 2017

Transcription

1 Legal news Deloitte Czech Republic July 2017

2 The GDPR as a Test of Innovativeness 2 Following its adoption in April 2016, the General Data Protection Regulation, known as GDPR, became an instant phenomenon for a significant part of European corporations, and especially a nightmare for the business public. The actual content of this legal regulation has garnered a significant level of attention, generating a myriad of articles. Let us have a look at the GDPR from a fresh perspective. More than a year has gone by since the GDPR was adopted and many large companies and financial institutions have already started preparing for its effective date to implement their compliance. It is becoming increasingly more evident that in addition to new rights and obligations for businesses, the GDPR also brings a specific opportunity for legal advisors to break free from traditional memoranda and theoretical analyses to prove that even legal services can be innovative. There have been numerous comments that the panic caused by the adoption of the GDPR is unnecessarily excessive and that many obligations imposed by the GDPR already apply. On the other hand, it is no secret that many companies have previously failed to pay sufficient attention to these matters. In this respect, the GDPR brings one of the most important changes; high fines. Corporations now have a longer road to compliance in an effort to avoid breaching the set conditions, resulting in a heavy monetary burden. Prepare for Hundreds of Adjustments of Processes and System Multiply this fact by the GDPR s scope, and the panic no longer looks so unsubstantiated. What makes the GDPR specific is the fact that the personal data processing it regulates affects the vast majority of corporate processes, from product development, to supply chain management, to human resources. All of these processes are often subject to other regulations as well (especially sector ones AML, consumer protection, finance sector regulations), which complicate the implementation of change requirements. Personal data is simply found everywhere, as well as being stored in most systems and other IT equipment that corporations utilize. The GDPR places new demands on these systems, which can often lead to the creation of new applications or other solutions. It is not said in vain that the GDPR is the lawyers revenge on the IT sphere. In addition, one of the essential topics from the GDPR perspective is the security of personal data, the breaches of which constitute the data protection breaches subject to the highest and most frequent fines by the Personal Data Protection Authority in recent years, as indicated by Deloitte Legal s statistics. Hundreds of required adjustments of processes and systems can appear within one client when the corporation is used as a personal data controller. The preparation

3 3 and implementation of these requirements is significantly time consuming and financially demanding. It is evident that it is not in the power of any legal advisor to successfully prepare their client s GDPR compliant regime on their own without the help of experts in each client s processes, analytics and IT specializations. The client needs a quick and efficient solution in order to process the requirements before the regulation is imposed, on its own and through its other suppliers. Lawyers Alone are Not Enough We know from our own practical experience with comprehensive GDPR projects that the traditional theoretical memoranda, or at least the general analyses of possible impacts prepared by law offices, are not sufficiently concrete for the employees of the client s and suppliers individual departments to be able to prepare the specific requirements for implementation. These purely legal reports do not adequately represent the technical (including security) and procedural side of the implementation required legal advisors are not trained to map every circumstance of personal data processing for their clients. Such mapping can take trained specialists hundreds of hours, which most law offices lack. In addition, the mapping of such services is not legal in nature. The procedural mapping is then conducted internally by the clients trained personnel, or by a contracted specialist from another external advisory company. When contracting, the client must invest further funds in educating the advisor on the client s activities and the capacities of its own employees to ensure cooperation with these external advisors as they get to know the system. In an instance where the legal advisor can offer an educated advisor with sufficient knowledge of the client s processes and systems, this legal output is likely to fail due to the recommended solution being unfeasible, too costly or undoable in the required time frame. Legal advisory is unable to address and comprehend many of these non-legal aspects. It is therefore necessary to come up with a way of adapting legal advisory to the client s specific needs during complex legal changes that have such an extensive impact on the client as the GDPR does and additionally require significant knowledge of technologies and security norms. When dealing with the GDPR reform, the key to survival is precisely the innovativeness and flexibility of legal advisors. Synergy of Legal and Specialised Advisory is the Core of Success Deloitte Legal offers its clients several alternative solutions. All of these alternatives

4 4 are based on the key cooperation between legal advisors specialising in personal data protection and experts from Deloitte Advisory. These experts specialise in business analysis, security, IT advisory and project management. Thanks to their joint efforts, the client receives comprehensive advisory as a result of the work of a multidisciplinary team of experts. Our team takes advantage both of a deep knowledge of the law and knowledge of the client s business, the standards in the field, technological possibilities and the security context. This may result in detailed and specified requirements and recommendations that are completely tailored to fit the client s business activities. Additionally, Deloitte offers the client s management group and employees with a comprehensible and approachable advisory team. The recommendations and change requirements given by the Deloitte advisory team take into account non-legal aspects, such as financial cost-intensiveness of the implementation compared to the risks the client faces in the event of non-implementation, while at the same time guaranteeing the compliance of the proposed solutions with the new legislation. The client receives a unique benefit between the synergy of legal and expert advisory, allowing them to easily integrate new obligations set by the GDPR, e.g. the inclusion of personal data impact assessment in change management processes. Or preparing for modifying the wording of documents and the process of concluding contracts with employees and customers (or other data subjects) in a way that meets the GDPR requirements for the granting of consent with personal data processing. Furthermore, we can help define security demands on the client s marketing or other service providers which are given access to personal data, or define instructions for IT providers to adjust specific systems so that the client is able to satisfy a data subject s right to access their personal data, and many other aspects. DPO: Save Your Capacities Deloitte Legal cooperates with security professionals within its own network on the DPO as a Service project, which is unique in the area of legal services and enables the outsourcing of the services provided by these professionals as Data Protection Officers. The quality of this service is substantially supported by regular consultations with the legal advisors of our law office. Clients will thus save expenses for their own capacities and may once again profit from the combination of legal certainty and a business-friendly approach. Bringing these benefits to clients is where Deloitte Legal sees the long-term future of successful provisions of legal services, thanks to the added value for the client and

5 5 the increasing demand for modern-type services, as Jan Spáčil, the Managing Partner of Ambruz & Dark Deloitte Legal, already mentioned in the 2016 issue of the Inovativní právník magazine. (The Czech-language version of this article was issued Inovativní právníci 2017, published by Economia.) Jaroslava Kračúnová Martina Heřmanová GDPR in facts More than 100 new provisions concerning the obligations of personal data controllers and processors Effective from 25 May 2018 Fines for a breach of obligations up to EUR 20 million or 4% of global turnover Notifications and reporting of personal data privacy breaches within 72 hours Extended scope including all entities offering goods or services on the EU territory and/or monitoring the behaviour of individuals on the EU territory Invalidity of most previously provided consents with personal data processing General Data Protection Regulation is the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

6 Come into Effect in a Few Days 6 On 1 July 2017, acts on offence liability, offence proceedings and certain offences will come into force. An amendment act was also presented for the President s signature, reflecting the new conception of offence law in the individual special acts that have so far treated certain offences or administrative delicts. The new act on offence liability and offence proceedings ( Offence Code ) deals with proceedings on offences committed by natural persons as well as legal entities and self-employed individuals (these offences have so far been called administrative delicts). The facts of certain offences contained in the existing Act on Offences of 1990 have been partially integrated in the Special Act on Certain Offences ( Offences Act ) and will be partially transferred (via the amendment act) to the individual acts treating the relevant area of public administration. The Offence Code will not concern disciplinary offences (disciplinary transgressions), order offences (e.g. breaches of a procedural obligation punishable by a disciplinary penalty) and payment offences (e.g. failure to pay tax), which will continue to be treated by special acts. Transition to New Legislation Proceedings on an offence or administrative delict taking place on the effective date of the Offence Code (1 July 2017) will be completed under the previous regulations. However, if it is more advantageous for the perpetrator, the liability for the offence or administrative delict committed before 1 July 2017 will be assessed and the type and extent of the sanction will be determined in accordance with the Offence Code. For example, if an offence against the public order is heard after the effective date of the Offence Code, but the offence was committed before that date and the perpetrator would face a prohibition of residence for it, it will be impossible to impose such a sentence after 1 July The relevant authority will have to select a different admissible sentence, usually a fine or a restrictive measure consisting e.g. of the prohibition to enter into contact with a particular person or persons. Starting from 1 July 2017, periods set by the Offence Code will apply and it will no longer be possible to apply the provisions on periods for the expiration of liability for an offence (administrative delict), for its hearing and for imposing a fine for it, as set in the individual special acts. Liability for an offence or administrative delict committed before the effective date of the Offence Code, however, cannot become time-barred before these periods have elapsed. In practice, this means an extension of the limitation period of most non-time barred offences committed by

7 7 non-self-employed individuals and of more serious offences (administrative delicts) of self-employed individuals and legal entities. Certain New Aspects A new element in the area of offence liability is the institute of indirect perpetrator (so-called living instrument ) and in certain cases set by law also the punishability of participation in an offence or a punishable attempt to commit it (organising, instigation, aid). In certain cases, the legal representative or guardian of the individual can be held liable. The area of offences newly includes the responsibility of legal entities for offences committed by a natural person whose actions can be legally attributed to the legal entity. The circle of such natural persons is even wider in the Offence Code than in the Act on Criminal Liability of Legal Entities. A legal entity could be prosecuted for offences committed before it was incorporated, or in cases where a court declares it invalid, or if the natural person acted on behalf of the legal entity on invalid or ineffective grounds. The responsibility of a legal entity for an offence is transferred to all its legal successors, but in justified cases, the administrative body of the offence proceedings can prohibit the liquidation, dissolution or transformation of the legal entity charged with the offence (which could happen especially in respect of cross-border transformations where the legal successor would be a foreign entity, or the transfer of net assets to the owner). The obligation to pay the imposed fine will also be transferred to the legal successors. A self-employed individual is responsible for the actions of his/her employees and certain other individuals in relation to his/her business. After his/her death, the responsibility for the offences committed is transferred to the individual who continues the business. A legal entity or a self-employed individual are responsible for offences regardless of whether they caused them. However, they can be exempt from responsibility if it is proved that they have made all effort that could be required to prevent the offence. The Offences Act of 1990 knows only two cases of circumstances excluding the illegality of actions that seem like an offence (necessary defence and extreme necessity). New additions now include permission of the injured party, justified use of a weapon and acceptable risk. The term sanction is replaced with administrative punishments. The existing sanction of prohibition of resi-

8 8 dence has been replaced by the punishment of publication of the decision on the offence. The administrative body will also be authorised to require the suspect or accused to provide a guarantee (monetary or non-monetary) to secure compliance with obligations that could be imposed during the proceedings or in the decision on the offence (e.g. fine, obligation to meet the claims of the injured party). Another new provision concerns the possibility to (conditionally) refrain from punishment. Protective measures remain without essential changes. However, it is now possible to impose the obligation to refrain from contact with a specific person or circle of persons or to undergo a suitable programme for aggression or violence management. Instead of confiscating the asset that the perpetrator destroyed, it is possible to confiscate the substitute value of the asset (similarly in case of the sentence of asset forfeiture). Another new institute taken over from the Criminal Code is settlement. It is a method of solving the offence without pronouncing guilt and the related negative consequences (especially a record in the Register of Offences). Settlement can be used only in proceedings attended by the injured party, since it has the form of an agreement between the injured party and the accused. The administrative body will verify the compliance with legal conditions, hear the parties to the settlement and approve the agreement through a decision. An effective decision on the approval of the settlement also gives rise to a claim preclusion (res judicata). Existing ticket proceedings will be replaced by order proceedings. An order can also be issued on the spot (subject to the consent of the accused). An order cannot impose the sentence of publication of the decision on an offence, sentence a minor (except to a fine) or a person with limited legal competence or deal with the injured party s claims. An order issued in the spot can impose a fine only in a limited amount, a caution or a monetary guarantee of compliance with obligations. Jakub Hájek jahajek@deloittece.com Hana Erbsová herbsova@deloittece.com Iveta Vildová ivildova@deloittece.com

9 Contacts If you are interested in obtaining additional information regarding the services provided by Deloitte Czech Republic, please contact our legal specialists: Ambruz & Dark Deloitte Legal s.r.o., advokátní kancelář Nile House Karolinská 654/ Praha 8 - Karlín Czech Republic Tel.: Fax: Subscribe to dreport and other newsletters and invitations here

10 Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ( DTTL ), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as Deloitte Global ) does not provide services to clients. Please see to learn more about our global network of member firms. Deloitte provides audit, consulting, legal, financial advisory, risk advisory, tax and related services to public and private clients spanning multiple industries. Deloitte serves four out of five Fortune Global 500 companies through a globally connected network of member firms in more than 150 countries and territories bringing world-class capabilities, insights, and high-quality service to address clients most complex business challenges. To learn more about how Deloitte s approximately 244,000 professionals make an impact that matters, please connect with us on Facebook, LinkedIn, or Twitter. This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively, the Deloitte Network ) is, by means of this communication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional advisor. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this communication For information, contact Deloitte Czech Republic.