TerraLex Cross-Border Guide to Global Crisis Management Regulatory Guide

List: - UK Information Commissioner’s Office (ICO) – any organisation which is a controller of personal data has a responsibility to report personal data breaches to the ICO within 72 hours unless it concludes that the breach will be unlikely to pose a risk to the individuals concerned.

• Essential services – providers of services in the energy, transport, health, water and digital infrastructure sectors, must notify significant network and information systems incidents, for example cyber‑attacks, to competent authorities designated under the Network and Information Systems Regulations 2018.

• Other sectors – other regulated industries are required to report breaches involving personal data to their sector regulator eg duty on financial services institutions to report data security breaches to the UK Financial Conduct Authority.

• National Cyber Security Centre – part of the UK Government’s GCHQ, the NCSC. While there is no legal obligation to notify the NCSC about an incident, the NCSC encourages early engagement so that it can provide advice and assistance to victim organisations. The NCSC does not share information with the ICO or other regulators unless the victim organisation requests that it does so.

Relevant legislation in this area includes: - The Data Protection Act 2018: this covers civil wrongs and criminal offences. The main criminal offence that relates to data breaches is unlawfully obtaining or disclosing personal data without the consent of the controller.

• UK GDPR (the version of the General Data Protection Regulation incorporated into UK domestic law upon the expiry of the post-Brexit transition period)

• The Privacy and Electronic Communications Regulations 2003

• The Network and Information Systems Regulations 2018

• The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

• Financial Services and Markets Act 2000

List: - Competition and Markets Authority: Enterprise Act 2002; Competition Act 1998

• Serious Fraud Office: Criminal Justice Act 1987

• The Police: Serious Organised Crime and Police Act 2005

• HM Revenue & Customs: Serious Organised Crime and Police Act 2005

• Revenue Scotland: Revenue Scotland and Tax Powers Act 2014

• Prudential Regulation Authority: Financial Services and Markets Act 2000

• Financial Conduct Authority: Financial Services and Markets Act 2000

• Information Commissioners Officer: Data Protection Act 2018

• Health and Safety Executive: Health and Safety at Work etc. Act 1974

• Scottish Environment Protection Agency: Environment Act 1995

Investigators are not entitled to review documents which are privileged, or outside the scope of the warrant or authorisation held by the investigators , for example due to their date or subject matter (see questions 11 and 12 for more information on privilege). Common practice is for disputed documents to be placed in sealed envelopes so that the question of privilege or scope may be considered after the raid. Documents cannot be withheld from investigators on the grounds of commercial confidentiality or sensitivity.

A worker is entitled to legal protection if they have made a “qualifying protected disclosure” but certain conditions must be met. Firstly, the worker must make a disclosure of information. Gathering evidence or threatening to make a disclosure is not enough for protection to apply.

Secondly, the information must fall under one of the six types of “relevant failure”. These are:

• Criminal offences
• Legal obligation breach
• Miscarriages of justice
• Dangers to health and safety
• Damage to the environment and
• Deliberate concealing of information about the above.

Thirdly, the worker must have a reasonable belief that the information shows one of the relevant failures and that the disclosure is in the public interest.

Whether a qualifying disclosure is protected also depends on who the disclosure is made to.

Workers are protected under the Public Interest Disclosure Act 1998 and the Employment Rights Act 1996 as follows: the right not to be subjected to any detriment, such as facing disciplinary action, or being bullied or harassed, on the ground that they have made a protected disclosure. Claims can be made against the employer and/or against other workers individually.

The dismissal of an employee will be automatically unfair if the principal reason for the dismissal is that they have made a protected disclosure.

The UK-wide Bribery Act 2010 (“the Act”) sets out four principal corruption offences, the most significant for corporates being failure of a commercial organisation to prevent bribery by associated persons. The Act applies to both public and private sector bribery. A commercial organisation has a statutory defence if it can prove that it had “adequate procedures” in place to prevent bribery.

The offences apply to those with a close connection to the UK wherever they are located. If a commercial organisation operates a business, or part of a business, in Scotland, the Act applies to its global operations and the entity can be prosecuted in Scotland for bribery conducted by it or on its behalf in another jurisdiction. Associated persons acting on behalf of the corporate anywhere in the world can expose the corporate to criminal prosecution in Scotland if the bribe is to obtain or retain a business advantage for the corporate.

In Scotland, bribery offences are enforced by the Crown Office and Procurator Fiscal Service which is the sole prosecutorial authority in Scotland. Police Scotland conducts investigations into allegations of bribery in Scotland.

Self-reporting obligations will vary according to the sector in which the business operates and what obligations it has under any relevant regulatory regime, as well as the nature and seriousness of the issue itself.

The main bodies to consider are:

• Crown Office and Procurator Fiscal Service – there is no obligation to self-report fraud, bribery or corruption. The Crown Office operates a self-reporting regime for Bribery Act and older corruption offences. Self-reporting may result in civil recovery rather than criminal prosecution.

• National Crime Agency – the Proceeds of Crime Act 2002 and the Terrorism Act 2000 place obligations on regulated sectors to make a Suspicious Activity Report to the NCA if there is a suspicion of money laundering, and this should be made as soon as possible to the NCA (online reporting systems/templates available).

• Competition and Markets Authority – self-reporting is not mandatory but issues of possible competition law infringements can be self-reported to the CMA under its leniency programme -the first company to report may obtain a reduction or immunity from a fines and criminal penalties (though not from possible civil claims). Timing is critical

• Financial Conduct Authority – the FCA’s Supervision Manual imposes self-reporting obligations on FCA‑authorised financial services companies for issues, including fraud (victims must report too) or other circumstances which could have a significant adverse impact on the firm’s reputation or customers, or on the UK financial system.

• Information Commissioner’s Office – see section 1.

• Publicly Listed Companies – must make public announcements in respect of certain non-public information which, if released, would have the potential to significantly impact the value of the company’s shares.

Documentation generated in the course of an investigation can be protected from disclosure if the criteria for asserting legal privilege are met. There are two sub-heads of privilege:

• Legal advice privilege applies to all communications between a lawyer and client for the purpose of obtaining/receiving legal advice. In a corporate context, it is important to clearly define who is “the client” by ensuring that those seeking/receiving legal advice have explicit authority to do so on behalf of the entity.

• Litigation privilege can protect both communications and other documentation if: (i) litigation is reasonably in contemplation; (ii) the communication / document’s dominant purpose is seeking or providing information or advice in connection with the conduct of that litigation; and (iii) the litigation is adversarial in nature. Privilege can only apply if all criteria are met when the document is created. Litigation privilege can apply to documentation created by third parties if it has been instructed by the client or the lawyer and meets the criteria.

Privilege can be lost or waived unless arrangements are made to maintain privilege once it has been established. Importantly, until there is a real likelihood of adversarial litigation, only legal advice privilege may apply which does not protect as broad a spectrum of documentation as litigation privilege.

If the criteria in section 11 are met, privilege may should apply, but care should be taken in communications between in-house lawyers and employees without explicit authority to seek legal advice.