TerraLex Guide to Data Protection

List: - Data Protection Act 2018 (DPA 2018)

• UK GDPR (being the retained EU-law version of the General Data Protection Regulation ((EU) 2016/679)) as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019
• Privacy and Electronic Communications Regulations 2003
• Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) (ePrivacy Directive)

The laws apply to the following: - Controllers: the person or legal entity that, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Processors: the person or legal entity that processes personal data on behalf of the controller.

The UK GDPR governs the processing of:

• Personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system, except where the processing (i) is by an individual in the course of a purely personal or household activity, (ii) is by a competent authority for any of the law enforcement purposes, or (iii) is processing to which Part 4 (intelligence services processing) of the DPA 2018 applies.

The DPA 2018 governs the processing of:

• The above, but with additional sections on (i) manual unstructured processing of personal data by a public authority that is subject to freedom of information legislation; (ii) law enforcement processing (Part 3 DPA 2018), and (iii) intelligence service processing, i.e., national security (Part 4 DPA 2018)

• Personal data (tier 1): any information relating to an identified or identifiable natural living person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• Special category data (tier 2): personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

• Additional category – personal data relating to criminal convictions and offences. This covers information relating to the alleged commission of offences by an individual and proceedings for an offence committee or alleged to have been committed by the data subject or the disposal of such proceedings including sentencing.

With conditions: - Crime, law, and public protection (including the protection and detection of crime, for the purpose of legal proceedings, obtaining legal advice or establishing, exercising, or defending legal rghts)

• Regulation, parliament, and the judiciary (including parliamentary privilege)
• Journalism, research, and archiving
• Health, social work, education, and child abuse
• Finance, management, and negotiations
• Legal professional privilege and professional duties of confidentiality owed by a professional legal advisor to their client
• Corporate finance, negotiations, and management forecasting
• Confidential references and exam scripts
• Protection of third-party rights (including the rights of third-party data subjects)

List: - The right to be informed: Data subjects have a right to be informed about the collection and use of their personal data.

• The right of access: Data subjects have a right to access and obtain a copy of the personal data that a controller processes about them.
• The right to rectification: Data subjects can request a controller corrects their inaccurate personal data, or complete incomplete information held about them.
• The right to erasure: Data subjects can request their personal data processed by a controller be erased.
• The right to restrict processing: Data subjects can request their personal data only be used for certain purposes, or suppressed altogether.
• The right to data portability: Where personal data is held in certain electronic forms, data subjects can request their information be transferred to a new controller which operates in a different IT environment so a data subject can accessand use their information for a different service.
• The right to object: Data subjects can request a controller stops processing their personal data.
• Rights in relation to automated decision making and profiling: Data subjects can in relation to a controller which utilises automated decision making and/or profiling, exercise the right to obtain human intervention, to express their view, and to contest any decisions which affect them.

A number of these exemptions are qualified – they only apply in certain circumstances.

Personal data: - Consent: the data subject has given consent to the processing of their personal data for one or more specific purposes.

• Performance of a contract: processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation: processing is necessary for compliance with a legal obligation to which the controller is subject.
• Vital interests: processing is necessary to protect the vital interests of the data subject or of another individual.
• Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Legitimate interests: processing is necessary for the purposes of the legitimate interests pursued by a controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, where the data subject is a child. This condition is not available to public authorities in the performance of their tasks.

Special category data – in addition, when processing special category data, the controller must identify an additional legal basis. The key conditions are set out below:

• Explicit consent: data subject has given explicit consent to the processing of those personal data for one or more specified purposes.
• Employment and social security: processing is necessary for the purposes of carrying out the obligations and exercising specific rights which are imposed or conferred by law on the controller or the data subject in connection with employment and social security and social protection.
• Vital interests: processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
• Not for profit bodies: processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious, or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects.
• Information made public: processing relates to personal data which are manifestly made public by the data subject.
• Legal claims/ judicial acts: processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Substantial public interest: processing is necessary for reasons of substantial public interest in relation to: (i) the exercise of functions conferred by statute or law; (ii) the administration of justice; (iii) monitoring equal opportunity or treatment or racial or ethnic diversity; (iv) preventing or detecting unlawful acts; (v) protecting the public against dishonesty; (vi) regulatory requirements relating to unlawful acts or dishonesty; (vii) journalism in connection with unlawful acts or dishonesty; preventing fraud; (viii) suspicion of terrorist funding or money laundering; (ix) support for individuals with a particular disability or medical condition; (x) counselling; (xi) safeguarding of children or vulnerable individuals; (xii) insurance; (xiii) occupational pensions; (xiv) political parties; (xv) provisions relating to elected represensatives; (xvi) publication of legal judgments and anti-doping and standards of behaviour in sport.
• Health/ social care: processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
• Public health.
• Archiving, research, and statistics: processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Criminal convictions and offences data:

• Criminal convictions and offences data can only be processed when the processing is either (a) under the control of official authority or (b) authorised by domestic law. For controllers or processors utilising option (b), a legal basis from the list applicable to special category data must be identified or one of limited number of additional conditions set out in the Data Protection Act 2018.

Personal data must be processed in compliance with the six data protection principles: - Lawfulness, fairness, and transparency: Identifying a lawful basis for processing of personal data, using data in a way that is in compliance with laws and in a way that is fair, and informing data subjects how their data will be collected and used.

• Purpose limitation: Personal data should only be processed for specified, explicit and legitimate purposes.
• Data minimisation: Personal data should be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy: Personal data should be accurate and, where necessary, kept up to date.
• Storage limitation: Personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Integrity and confidentiality: Personal data should be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

It is the controller's responsibility to ensure, and be able to demonstrate, compliance with these principles.

Additional obligations are summaried below. These include:

• Implementing appropriate technical and organisational security measures to protect personal data.
• Adhering to the principles of data protection by design and default
• Providing data subjects with a privacy notice and processing requests by data subjects to exercise their rights.
• Having written contracts in place with processors that process personal data on their behalf, to include the data processing clauses in Article 28 UK GDPR.
• Keeping records of processing activities.
• Keeping records of personal data breaches.
• Carrying out data protection impact assessments where required by Article 35 UK GDPR.
• In certain circumstances, appointing a data protection officer.

The UK GDPR includes a principle of "storage limitation" under which personal data must only be kept in a form which permits identification of data subjects for no longer than is necessary for which the personal data are processed.

Organisations must determine, independently, how long it is "necessary" to process personal data. Such timeframes should be communicated to data subjects (usually via privacy notices). The decisions should be documented and kept under review.

Unless an exemption applies, controllers and processors must keep a written record of processing activity (ROPA). Controllers must keep records which cover:

• Name and contact details of the controller
• Purposes of processing
• Description of the categories of data subjects and categories of personal data
• Categories of recipients to whom personal data have been or will be disclosed
• Transfers of personal data to third countries (i.e., countries outside the UK)
• Envisaged time limits for erasure of the different categories of personal data processed
• A description of the technical and organisational security measures referred to in Article 32(1) UK GDPR

Processors must keep records which cover:

• Name and contact details of the processor and of each controller on behalf of which it processes personal data
• Categories of processing carried out on behalf of each controller
• Transfers of personal data to third countries (i.e., countries outside the UK)
• A description of the technical and organisational security measures referred to in Article 32(1) UK GDPR

The Information Commissioner's Office (ICO) is the UK's independent authority to monitor and uphold compliance with data protection, prompte awareness, handle complaines and conduct investigations, and develop codes of practice and guidance.

Organisations which fall into any of the following categories must appoint a DPO: - Public authorities/ bodies (except courts)

• Core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale
• Core activities consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences

The role of a DPO is to have due regard to the risk associated with processing operations, considering the nature, scope, context, and purposes of processing. Its role contains the following tasks:

• Inform and advise the organisation and employees on processing obligations
• Monitor compliance with data protection laws, and internal compliance policies and procedures
• Provide advice on data protection impact assessments
• Cooperation with the ICO
• Acting as contact point for the ICO on issues relating to processing

Transfers to third countries (i.e., those outside the UK) must adhere to the rules in Chapter 5 UK GDPR. The bases on which personal data can be transferred are:

• Adequacy decision: This is when the supervisory authority has deemed a particular third country offers a level of data protection that provides adequate protection of personal data and data subects' rights and freedoms. Currently, the EEA and Gibraltar are each subject to an adequacy decision, as well as those third countries for which a finding of adequacy was found by the European Commission prior to the expiry of the post-Brexit transition period on 31 December 2020 – Andorra, Argentina, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay. Partial findings are in place for Japan and Canada.

• A legally binding and enforceable instrument between public authorities or bodies

• Binding corporate rules

• EU standard contractual clauses

• Standard data protection clauses made by the Secretary of State

• Standard data protection clauses approved by the ICO

• Approved code of conduct

• Certification under an approved certification scheme

• Administrative arrangements between public authorities or bodies

If none of the above apply, an exemption may apply:

• The data subject has given their explicit consent
• The transfer is necessary to perform a contract with a data subject
• The transfer is necessary in order to perform a contract with a data subject but which benefits another data subject
• The transfer is necessary for important reasons of public interest
• The transfer is necessary for the establishment, exercise or defence of legal claims
• The transfer is necessary to protect the vital interests of the data subject or third parties where the data subject is physically or legally incapable of giving consent
• The transfer is made from a register which is either open to the public or available to persons who have a legitimate interest
• The transfer is a one-off transfer restricted transfer made under compelling legitimate interests, and has been notified to the ICO

Yes – when the following bases from above are relied upon to transfer personal data to a third country: - Binding corporate rules (these need approved by the ICO)

• Standard data protection clauses approved by the ICO
• Administrative arrangements between public authorities or bodies
• One off transfers made under compelling legitimate interests

There are various security requirements in the data protection legislation outlined as applicable to both controllers and processors: - Integrity and confidentiality data protection principle: Personal data should be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.

• Organisations must, taking into account the state of the art, costs and nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk - (a) pseudonymization and encryption, (b) the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems, (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, (d) having a process for regularly testing and evaluating the effectiveness of security measures.
• Organisations must be mindful of the specific risks of its processing activities – in particular, from personal data breaches.
• Where applicable, a code of conduct or certification mechanism approved or issued by the ICO may be used to demonstrate compliance with the security requirements (none approved or issued to date).

In terms of security obligations imposed on controllers:

• In certain contexts, a data protection impact assessment must be carried out. This is a form of privacy risk assessment (DPIA) to be undertaken where an organisation will be processing using new technologies and considering the nature, scope, context, and purposes of processing, is likely to result in a high risk to the rights and freedoms of natural persons. A DPIA is mandatory where the processing activity involves (among other activities as designated by the ICO): (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects or similarly significantly affect individuals, (b) processing on a large scale of special categories of data or data relating to criminal onvictions and offences, and (c) a systematic monitoring of a publicly accessible area on a large scale. Each DPIA must describe the processing activity, assess the necessity, proportionality, and compliance measures, identify, and assess and risks to individuals and what additional measures may be required to mitigate such risks.
• There should be a continual focus on data protection by design and by default by controllers – this means implementing appropriate technical and organisational measures which are designed to implement data protection principles in an effective manner and to integrate necessary safeguards into the processing to meet the requirements of the data protection legislation and protect the rights of individuals.

In terms of security obligations imposed on processors:

• Processors must, when processing personal data on behalf of a controller, make all information available to the controller to demonstrate compliance with its obligations including allowing for audits.

In relation to personal data breaches: - A personal data breach is defined as "a breach of security leading to the accidental or unlawful destruction, loss, alternation, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed".

• The ICO must be informed of a personal data breach unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification must be made within 72 hours of the controller becoming aware.
• Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must also communicate the instance of the breach to the affected data subject without undue delay unless (a) the controller has been able to implement appropriate technical and organisational protection measures to the affected data making it unintelligible to any person not authorised to access it, (b) the controller has otherwise taken measures which ensure the high risk is no longer likely to materialise, or (c) it would involve a disproportionate effort.
• Processors must notify the relevant controller of a personal data breach without undue delay.

In relation to the obligation on controllers to pay an annual fee:

• The Data Protection (Charges and Information) Regulations 2018 require controllers subject to the UK GDPR and DPA 2018 pay an annual fee, unless exempt, to the ICO.

In relation to DPOs:

• Relevant contact details of an appointed DPO must be notified to the ICO.

In relation to DPIAs:

• Prior to processing where a DPIA has indicated that processing would result in a high risk in the absence of measures to mitigate the risk, controllers should consult the ICO.

The ICO has a range of investigative powers in relation to monitoring compliance: - To order controllers and processors to provide it with information for the performance of its tasks.

• To carry out investigations in the form of data protection audits.
• To carry out a review into compliance with any certifications issued.
• To notify the controller or processor of alleged infringements.
• To obtain access to all personal data and to all information necessary for the performance of the ICO's tasks.
• To obtain access to and inspect any premises including to any data processing equipment and means.
• To conduct audits of controllers' processing operations (on a consensual basis).

The ICO can impose the following sanctions for noncompliance:

• Issuing of warnings that intended processing operations are likely to infringe the data protection legislation.
• Issuing of reprimands where processing operations have infringed the data protection legislation.
• Ordering of processing operations to be brought into compliance with the data protection legislation within specific timeframes.
• Ordering of the communication of a personal data breach to a data subject.
• Imposing of temporary or definitive limitation including bans on processing.
• Ordering the rectification or erasure of personal data or restriction of processing and to notify these actions to recipients to whom the personal data have been disclosed.
• Withdrawing of a certification or ordering a certification body to withdraw a certification issued, or to order the certification body not to issue certification if the requirements for the certification are not or no longer met.
• Imposing of an administrative fine in addition to or instead of measures referred to above.
• Ordering the suspension of data flows to a recipient in a third country or to an international organisation.
• Issuing of assessment notice to require the controller or processor to permit the ICO to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
• Issuing of an information notice to require a controller or processor to provide the ICO with information that the ICO reasonably requires for the purposes of carrying out the ICO's functions.
• Issuing of an enforcement notice requiring the taking of steps specified in the notice or to refrain from taking steps as specified in the notice.
• The prosecution of controllers which commit offences under the DPA 2018.

The ICO can also utilise the following authorisation and advisory powers:

• To advise the controller in accordance with the prior consultation procedure.
• To issue the ICO's own initiative or on request, opinions to Parliament, government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.
• To issue an opinion and approve draft codes of conduct.
• To accredit certification bodies.
• To issue certifications and approve criteria of certification.
• To adopt standard data protection clauses.
• To authorise contractual clauses.
• To authorise administrative arrangements.

The ICO can also issue monetary penalty notices, as detailed:

• The first tier of administrative fine – up to £8,700,000 or up to 2% of total global annual turnover of the preceding financial year (whichever is higher) – is applicable for the following types of infringement: (a) obligations of the controller and processor, (b) obligations of a certification body, or (c) obligations of a monitoring body.
• The second tier of administrative fine – up to £17,500,000, or up to 4% of total global annual turnover of the preceding financial year (whichever is higher) – is appliable for the following types of infringement: (a) the basic principles for processing including conditions of consent, (b) data subjects' rights, (c) transfers of personal data to a recipient in a third country or international organisation, (d) obligations under the exemptions for reasons of freedom of expression and information and the derogations for research, statistics and archiving, or any further regulations made by the Secretary of State, (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the ICO, or (f) non-compliance with an order by the ICO in relation to an organisation's noncompliance with the data protection legislation.
• Monetary penalty notices can also be imposed for non-payment of the data protection fee.

N/A