<\/p>\n\n\n\n
Business Legal is a regulatory compliance firm assisting businesses with general regulatory compliance. All businesses are <\/strong> Business Legal provides expert support and assistance the 3 main compliance areas of Employment Law, Data Protection <\/strong> SMEs often don\u2019t have an in-house legal function, and to assist in ensuring cost \u2013 effective, competent advisers are retained we also provide a General Counsel service to SMEs whereby we source legal services for our clients from niche specialists in each area. <\/strong><\/p>\n\n\n\n The Public Services Card (PSC) <\/strong><\/p>\n\n\n\n The Data Protection Commission (DPC) has determined that the PSC may not be used on a mandatory or compulsory basis by government departments other than the De- partment of Social Protection, which is the Department which issued the card. This <\/p>\n\n\n\n means that it is not lawful for a PSC to be demanded in a driving licence or passport More problematically, the DPC has ordered the destruction of 3.2 million data subjects\u2019 records on the basis that there are no longer required once the primary purpose for gathering that data was achieved, namely the identification of the individual. <\/p>\n\n\n\n The government appears to be inclined to try and retrospectively legislate to legitimise its unlawful actions, rather than to \u201ccollected for specified, explicit and legitimate purposes\u201d, and the data has already been collected. Any attempt to retain the personal data held in respect of the PSC, or to respectively legitimise its collection would likely be resisted by recourse to liti- gation. The PSC has put a 21 day stay on its order for the destruction of the personal data, so we will be reporting on further developments in our September edition of this newsletter. <\/p>\n\n\n\n Privacy Notices\/Policies<\/strong> <\/p>\n\n\n\n You must provide clear, intelligible and easily accessible information to individuals about the collection and use of their personal data. <\/p>\n\n\n\n This must be provided at the time personal data is obtained from individuals (or within one month when ob- The categories of information to be provided include the purposes of processing, the legal basis for processing, the legitimate interest of the company which the company claims legitimises the processing (if applicable), any data sharing, any international transfers, and the data retention periods which apply to each processing. <\/p>\n\n\n\n Working this out, with documentation to meet the requirements of accountability, can be challenging. You may need to re- (customers, staff, etc.). Privacy Notices are not a once-off exercise and must be kept under review to reflect processing activi- ties. <\/strong>They are part of your GDPR transparency obligations. It should be transparent to individuals that their personal data is We can help you with your Privacy Notice which is the shop window for your organisation How do you verify the identity of an individual requesting access to their data or that data be deleted? The Dutch Data Protection Authority, Autoriteitpersoonsgegevens, has provided guidance <\/strong> <\/p>\n\n\n\n If at all possible, refrain from asking for a copy of a formal ID <\/p>\n\n\n\n 1. Via an existing login system. <\/p>\n\n\n\n 2. A form of two-factor authentication. For example: <\/p>\n\n\n\n \u2022 after receiving a request via e-mail request a confirmation by SMS. This mobile number <\/p>\n\n\n\n must then match the customer data from your administration. <\/p>\n\n\n\n \u2022 request confirmation of the telephone request by e-mail. This e-mail address must match <\/p>\n\n\n\n the customer data from your administration. <\/p>\n\n\n\n \u2022 ask for the last 3 digits of the account number, the date of birth and \/ or the customer <\/p>\n\n\n\n number for verification. <\/p>\n\n\n\n \u2022 ask someone to come by and show you his\/her ID proof without making a copy. Note, <\/p>\n\n\n\n however, that this cannot be used to set up a threshold to allow access and should only GDPR fine in Romania. <\/strong><\/p>\n\n\n\n UniCredit Bank was fined \u20ac130,000 for not applying adequate technical and organizational measures to protect personal data. Customers’ ID number and address were exposed in bank statements for payments made to other persons. If a customer was transferring funds or making a payment to an account the beneficiary would see this data. <\/p>\n\n\n\n EU Standard Contractual Clauses (SCCs) and EU-US Privacy Shield <\/strong><\/p>\n\n\n\n The major case of C-311\/18 – Data Protection Commissioner (Ireland) v Facebook Ireland Limited & Schrems<\/em> has now been <\/p>\n\n\n\n heard by the CJEU. At issue is the validity of two key international data transfer mechanisms: the EU Standard Contractual While we can\u2019t pre-empt the decision of the CJEU, if the SCCs and\/or Privacy Shield were invalidated that would mean that These include: <\/p>\n\n\n\n \u2022 Binding Corporate Rules (BCRs<\/strong>) \u2022 Consent <\/p>\n\n\n\n Given the lack of any practical alternatives, should the SCCs and\/or Privacy shield be struck down, the European Data Protec- \u2022 analyse data flows outside the EEA, what mechanism(s) \u2022 assess the potential impact of having to stop transferring How should companies plan for BREXIT? <\/strong><\/p>\n\n\n\n If Brexit proceeds on the 31st October next the UK will be- Although the UK has passed a Data Protection Act 2018, with roughly equivalent provisions to the GDPR, in the absence of a Withdrawal Agreement being concluded between the EU and the UK the transition from being a member of the EU, to being an unsafe third \u2013 country destination for EU personal data will be immediate. <\/p>\n\n\n\n Existing contractual provisions between controllers based in the EU, and processors based in the UK. <\/strong><\/p>\n\n\n\n Currently, when a controller based in the EU (including in the UK) proposes to retain a processor based in the UK, they are In addition however, the EU-based controller will have 2 legiti- mise the transfer of personal data from the EU to the UK. In simple terms, every EU-based controller who has a UK <\/p>\n\n\n\n based processor, will have to ensure that in addition to a con- troller \u2013 processor contract, they also have in place a Model This is not as simple as it sounds, as processors often refuse to sign controller \u2013 processor contract, or Model Clause con- Article 27 Representatives <\/strong><\/p>\n\n\n\n in circumstances where a UK based company is targeting EU residents for the offering of goods or services, or is monitoring the behaviour of EU-based residents, such as behavioural advertising, then it will be subject to the EU GDPR, and will have to ap- UK arrangements are similar <\/strong><\/p>\n\n\n\n The UK has put in place similar provisions with regard to the transfer of UK data to third \u2013 countries, and there are require- ments for third \u2013 country based controllers and processors to have a UK Representative appointed. <\/p>\n\n\n\n Miscellaneous <\/strong><\/p>\n\n\n\n in circumstances where a UK company is the lead controller for a group of companies, then it will be necessary for an alterna- tive group company in an EU jurisdiction to take over this role. <\/p>\n","protected":false},"excerpt":{"rendered":" Business Legal is a regulatory compliance firm assisting businesses with general regulatory compliance. All businesses are subject to compliance with Employment Law, Data Protection Law and Health and Safety. In addition, businesses may also be subject to sector specific compliance regulations, such as insurance industry regulations, food standards regulations et cetera. Business Legal provides expert support and …<\/p>\n
subject to compliance with Employment Law, Data Protection Law and Health and Safety. In addition, businesses may also be subject to sector specific compliance regulations, such as insurance industry regulations, food standards regulations et <\/strong>
cetera. <\/strong><\/p>\n\n\n\n
Law and Health and Safety Law, and can provide specialist consultants in more specific areas. <\/strong><\/p>\n\n\n\n<\/td><\/tr> <\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
application, or any other application to any department other than the Department of Social Protection. <\/p>\n\n\n\n
take on board the criticism of data protection practitioners, and the DPC with regard to its actions over the last number of
years. There are very strong legal objections to this approach, as Article 5.1.b of the GDPR requires that personal data be <\/p>\n\n\n\nWith the prospect of increased GDPR regulatory activity ahead, it is important for organisations to ensure their Privacy Notices are compliant. <\/p>\n\n\n\n
tained from another source). <\/p>\n\n\n\n
fresh data mapping or review justifications for legal basis. Privacy Notices should also align with your Records of Processing
Activities (as required by Article 30). You may need more than one Privacy Notice depending on the individuals involved <\/p>\n\n\n\n
being processed and to what extent. <\/strong><\/p>\n\n\n\n
<\/p>\n\n\n\nSome alternatives may be: <\/p>\n\n\n\n
offered as an alternative <\/p>\n\n\n\n
Clauses (SCCs<\/strong>) and EU-US Privacy Shield, both widely-used mechanisms by EEA businesses to legitimise the transfer of personal data to countries outside the EEA (e.g. the US). A decision is expected on December 19th<\/sup> 2019. <\/p>\n\n\n\n
businesses that have heretofore been relying on these mechanisms would need to consider alternative mechanisms for trans- ferring their personal data to third countries. <\/p>\n\n\n\n
\u2022 Derogations <\/p>\n\n\n\n
tion Board will come under significant pressure to allow for some kind of moratorium during which no enforcement action will <\/p>\n\n\n\nbe taken by a national regulator, as happened previously when the precursor to Privacy
Shield (Safe Harbour) was deemed invalid. <\/p>\n\n\n\n\u2022 educate senior management on the implications of a
declaration of invalidity; <\/p>\n\n\n\n
underpin these transfers and how important these
transfers are; <\/p>\n\n\n\n
data abroad and how any fall out may be mitigated. E.g
cease certain data processing activities or cross-border
transfers, bring the personal data back into the EEA or
continue processing outside of the EEA;
<\/p>\n\n\n\n
come a third \u2013 country, and it (and by extension its companies processing data in the UK) will no longer be considered a safe destination for EU personal data. <\/p>\n\n\n\n
required to put in place an agreement complying with Article 28.3 of the GDPR (often called a controller \u2013 processor agree- ment). This requirement will remain, but it will become more important, as the UK will now be considered an unsafe third \u2013 country destination for EU personal data. <\/p>\n\n\n\n
There are a number of ways of doing this, but the most com-
mon, and most practically useful method is the execution of
Standard Contractual Clauses (SCCs), often also called Model Clauses. <\/p>\n\n\n\n
Clause contract between themselves and that UK based pro-
cessor. <\/p>\n\n\n\n
tracts. In the absence of both these agreements being signed, the controller has no legal option but to sever the relationship with the processor. This can create contractual difficulties in
itself, as there can be contractual or statutory consequences from terminating the contract with the processor. <\/p>\n\n\n\n
point an EU-based representative in accordance with Article 27 of the GDPR. Business Legal can assist with the provision of a
specialist Article 27 Representative service, with specific Article 27 Representative liability insurance. <\/p>\n\n\n\n