Updates Archives - Page 3 of 4

Archive for the ‘Updates’ Category

Who owns the copyright in software created by your employees?

12/03/21 – In accordance with the Copyright, Designs and Patents Act 1988 where any work “is made by an employee in the course of his employment, his employer is the first owner of any copyright in the work, subject to any agreement to the contrary”. (more…)

Tags: CDPA 1988, copyright, employees, IP, MD5, penhallurick, software
Posted in Technology, Updates | Comments Off on Who owns the copyright in software created by your employees?

Transfer Impact Assessment – what is it, and do I need to do one?

In July 2020 the European Court of Justice in its ‘Schrems II’ judgment invalidated the EU-U.S. Privacy Shield. In their judgement the ECJ, whilst upholding Standard Contractual Clauses (SCCs) as a transfer tool, made it clear that data exporters (i.e. organisations within the EEA which transfer personal data to countries outside the EEA) must “verify, prior to any transfer, whether the level of protection required by EU law is respected in the third country concerned”.

Following the Schrems II judgment, the European Data Protection Board (EDPB) issued two pieces of guidance to help data exporters with the analysis required by the ECJ: Measures that supplement transfer tools (Recommendations 01/2020); and European Essential Guarantees (Recommendations 02/2020). In addition, the European Commission published updated draft SCCs for consultation, which are expected to be adopted in March 2021.

In practice, this means that businesses which propose to transfer – or to continue to transfer – personal data using SCCs (or another transfer tool) to a third country must first carry out a transfer impact assessment (TIA) with a successful outcome in accordance with the six-step process set out in the EDPB’s Measures that supplement transfer tools (Recommendations 01/2020):

Step 1: Map your data flow, i.e. the scope and categories of personal data to be transferred, the data subjects concerned, and the purposes for which the data is being transferred.

Step 2: Identify your transfer tool, which will usually be SCCs but could be for example Binding Corporate Rules (BCRs).

Step 3: Assess the laws of the third country for the purpose of identifying any respects in which those laws may not permit the data importer to comply with its obligations under the SCCs (or other transfer tool), and therefore not provide protection which is essentially equivalent to that provided by EU law. The EDPB’s European Essential Guarantees (Recommendations 02/2020) sets out the minimum standards by which the third country’s laws can be assessed.

Step 4: Identify appropriate supplementary measures to remedy any shortcomings disclosed by the assessment in Step 3. Supplementary measures may contractual, technical or organisational in nature.

Step 5: Implement your supplementary measures.

Step 6: Re-evaluate your assessment at appropriate intervals.

Also, note that the TIA must be properly documented, and include appropriate supporting documentation such as data mapping records and legal opinions from local counsel. And if the TIA discloses the existence of local laws which impinge on the effectiveness of the SCCs (or other transfer tool), and no supplementary measures are available to mitigate the risk, then the transfer cannot proceed/must be suspended immediately.

Reaction to the brave new, post-Schrems II world of data transfers has been mixed… Ensuring EU-standard privacy protection for data that is transferred outside the EEA is of course commendable, at least in principle. But requiring all businesses to not only put in place comprehensive contractual protections (e.g by way of SCCs) but also to carry out a time consuming, technically difficult and potentially very costly TIA for each type of transfer is arguably so onerous that many businesses, particularly SMEs, will take a risk-based view and simply dispense with the TIA. Other businesses may take the view that exporting data outside the EEA is simply too difficult, and replace its existing service providers with EEA-based providers.

The European Commission (EC) is of course aware of the difficulties that Schrems II has created for EEA organisations, including those which already have established global data sharing networks, and those looking to transfer data to non-EEA service providers for which are no equivalents available in the EEA. But while we wait for the EC to come up with some more workable alternative options, businesses which are exporting, or looking to export, personal data to third countries may now want to start:

Looking at their data flows to non-EEA countries, and considering whether any personal data (and especially special category data) can be removed from the data export.
Setting up a TIA process, supported by appropriate documentation.
Developing a toolbox of risk mitigating measures, such as data encryption/pseudonymisation, privacy-friendly data sharing procedures etc.

Tags: adequacy, data transfer, gdpr, tia, transfer impact assessment
Posted in Privacy, Updates | Comments Off on Transfer Impact Assessment – what is it, and do I need to do one?

How to draft a privacy policy

Article 13 of the UK GDPR states that at the time you collect personal data from individuals you must provide them with certain information. The usual way of providing this information is via a privacy notice (also called a ‘privacy policy’ or, in GDPR-speak, a ‘fair processing notice’), which is made available to the individual when their personal data is collected, often via a website link like this one. The privacy notice must be in a “concise, transparent, intelligible and easily accessible form, using clear and plain language” (Article 12(1)).

Where you are not collecting the personal data directly from the individual, Article 14 requires you to provide the individual with the same information as under Article 13 “within a reasonable period after obtaining the personal data, but at the latest within one month”.

Information audit

The first step is to carry out an information audit (also called a ‘data mapping exercise’) so that you understand:

What personal data your organisation collects, including from customers, suppliers, employees, visitors, job applicants etc.
How the personal data is collected.
Where the personal data is stored, and what technical and organisational measures are in place to ensure security.
What your organisation does with the personal data.
Whom the personal data is shared with, including data storage and SaaS providers.
Whether the personal data is transferred to locations outside the UK, and if so where.
Whether the personal data includes any ‘special category data’, and if so whether any additional safeguards have been put in place.
How long the personal data is kept.

Privacy notice

The next step is then to create the privacy notice by documenting the output of your information audit. The format and content of an organisation’s privacy notice will of course vary from organisation to organisation, but for many businesses the following list should be a useful start:

Name of and contact details for the organisation(s) collecting the personal data, i.e. the identity of the controller providing the privacy notice.
The types of personal data the controller collects, and how the personal data is collected.
Whether any of the personal data constitutes special category data.
What the controller intends to do with the personal data.
The lawful basis for processing the personal data.
Whom the controller shares the personal data with, and why.
Whether the controller transfers any personal data outside the UK, and if so details of the relevant transfer mechanism.
How long the controller keeps the personal data.
How the controller keeps the personal data secure.
If the individual is required by law or by contract to provide the personal data, consequences of not providing it.
Whether the controller uses automated decision-making, including profiling, and if so details of logic involved and consequences of processing for the individual.
What rights the individual has in relation to their personal data.

Final thoughts…

When drafting a privacy notice, it’s tempting to take a broad, catch-all approach – “we will or may use your information for some or all of the following purposes…”, followed by a long list covering pretty much everything you can think of. Although strictly speaking accurate, the broad brush approach is likely to struggle to satisfy the “concise, transparent, intelligible” requirement. Put yourself in the data subject’s shoes: having read the privacy notice, would you understand how your personal information will in fact be used, stored, shared, etc?
Because of the amount of information that you may need (or want) to include, consider adopting a ‘layered’ approach for the privacy notice. This is where you have a high-level, top-layer notice with the key privacy information, with links enabling the data subject to click through a second layer with a bit more detail, and then from the second layer there may be further links to a third layer with the full detail. This layered approach may be particularly useful for mobile or smart devices with small screens.
There is no requirement for all the privacy notice content to be provided to the data subject in one go, and it may make sense for you to provide the data subject with privacy information at the time that they are actually providing you with their personal data – so-called ‘just-in-time’ notices.
As your organisation evolves through the use of new technologies and/or you offer of new products and services, it’s likely that personal data will be collected and used in different ways. Put in place a process which ensures that your privacy notice is updated in line with these changes, and then for the updated notice to be communicated to your data subjects.

Tags: data protection, gdpr, information audit, layered privacy notice, privacy notice, privacy policy
Posted in Privacy, Updates | Comments Off on How to draft a privacy policy

What is a Data Processing Agreement (DPA)?

A Data Processing Agreement (DPA) confirms the terms on which one party (the ‘processor’) processes personal data provided or made available by another party (the ‘controller’).

Examples of data processing include arrangements where an organisation provides details of its employees and their remuneration packages to a payroll services provider, or provides lists of its clients’ and stakeholders’ email addresses to an email marketing platform, or uploads its business data to a hosted data storage provider.

As well as being the right thing to do commercially, controllers and processors are required by Art 28(3) of the GDPR (now incorporated into UK law, as amended) to enter into a contract which sets out:

The subject-matter and duration of the processing
The nature and purpose of the processing
The type of personal data and categories of data subjects
The obligations and rights of the controller

The contract must also stipulate the processor obligations listed in paragraphs (a) – (h) of Art 28(3):

Only process personal data in accordance with the controller’s documented instructions.
Ensure that individuals authorised to process personal data have committed themselves to confidentiality.
Implement appropriate technical and organizational measures to ensure the information’s security.
Assist the controller with its response to any request by a data subject.
Co-operate with the controller in the event of a personal data breach.
Co-operate with the controller if the controller carries out a data protection impact assessment.
Delete or return the personal data at the end of the engagement.
Not transfer personal data outside of the UK without the controller’s permission.

If a processor wants to engages its own processor (a ‘sub-processor’), the processor must obtain the controller’s specific or general prior authorisation. If the authorisation is general, then the processor must notify the controller of any additional or replacement sub-processor (Art 28(2)). The processor must also enter into a DPA with the sub-processor which imposes on the sub-processor the same data protection obligations as are set out in the DPA between the processor and the controller (Art 28(4)).

Posted in Privacy, Updates | Comments Off on What is a Data Processing Agreement (DPA)?

European Commission publishes new draft SCCs for consultation

19/11/20 – By way of background, transfers of EU citizens’ personal data to locations outside the European Economic Area (EEA) require a GDPR-permitted transfer mechanism. (more…)

Tags: data protection, modular SCCs, privacy, SCCs, Schrems II, Standard Contractual Clauses, transfer mechanism
Posted in Privacy, Updates | Comments Off on European Commission publishes new draft SCCs for consultation

Special category data – what do I need to know?

Ok, let’s start with the basics. What is ‘special category data’?

Article 9 of the GDPR (as incorporated into UK law, and amended) (“UK GDPR”) defines special category data as:

Personal data revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership.
Data concerning:
- health
- a person’s sex life
- a person’s sexual orientation.

Genetic data.
Biometric data (where used for identification purposes).

In short, special category data is personal data that needs more protection because it is sensitive.

And what does ‘more protection’ mean?

It means that, in addition to ensuring that the processing is generally lawful, fair and transparent, and that it complies with all the other principles and requirements of the UK GDPR, you must comply with the following requirements:

Prior to processing any special category data, you must not only identify and document a lawful basis under Article 6 (as required for all processing of personal data), but you must also satisfy at least one of the conditions for processing special category data listed in Article 9.
Of the 10 conditions for processing special category data in Article 9, five require you to meet additional conditions and safeguards set out in Schedule 1 of the Data Protection Act 2018 (“Schedule 1 conditions”). For some Schedule 1 conditions you also need to put in place an ‘appropriate policy document’. The ICO has provided an appropriate policy document template.
In practice, you may need to use the explicit consent condition for the special category data processing (Article 9(2)(a)). If so, then bear in mind that the individual’s consent must be:
- freely given
- specific, i.e. it must specify the nature of the special category data, and be separate from any other consents
- affirmative, i.e. opt-in
- unambiguous
- capable of being withdrawn at any time.
Article 35 requires you to do a Data Protection Impact Assessment (DPIA) for any type of processing that “is likely to result in a high risk to the rights and freedoms of natural persons”. This is more likely to be the case when processing special category data.
Article 30 requires controllers to maintain a record of processing activities. The exemption from this obligation for organisations employing fewer than 250 persons (Article 30(5)) does not apply where the processing includes special categories of data.
Update your privacy notice with specific information about your processing of special category data.

Tags: Article 9 conditions, dpa 2018, gdpr, lawful basis, lexoo, sensitive data, special category data, UK gdpr
Posted in Privacy, Updates | Comments Off on Special category data – what do I need to know?

EDPB Guidelines on controllers and processors

21/09/20 – On 2 September 2020, the European Data Protection Board (EDPB) adopted ‘Guidelines 07/2020 on the concepts of controller and processor in the GDPR’. The Guidelines deal with the principles underpinning the differences between controllers and processors, and also delve into the more esoteric world of joint controllers. (more…)

Posted in Updates | Comments Off on EDPB Guidelines on controllers and processors

Demise of the EU-U.S. Privacy Shield

23/07/20 – If you, as a ‘data exporter’, want to transfer personal data to a country outside the EEA (and which is not one of the 12 countries that have been granted an adequacy decision by the European Commission), then you need to use one of the GDPR-approved ‘transfer mechanisms’. (more…)

Tags: data protection, essentially equivalent, FISA, gdpr, privacy shield, SCCs, tia, transfer impact assessment
Posted in Privacy, Updates | Comments Off on Demise of the EU-U.S. Privacy Shield

Next Page »« Previous Page

Get in touch

"*" indicates required fields