When asked recently to write an article about data protection good practice for a valued social media friend and influencer, it took some time to decide the tone, wording and delivery. The topic is often deemed boring, overly complicated and confusing.
So, I decided to go back to basics, remembering my training and that if I wrote/quoted anything to do with my business I would be bound by the professional indemnity insurance. Also as public bodies have to employ their own data protection officer (DPO), I would not be mentioning the Freedom of Information Act (FOI).
Having written the piece, I thought that I should share it here for others, so here we go.
Data Protection and Privacy Legislation
The legislation governs Personal data, which is information that relates to an identified or identifiable individual. and does not apply to an individual who has died.
As the reader of this post and an individual in your own right, hopefully you will find the information interesting, in knowing how organisations deal with your own personal data.
It's not all about the dreaded General Data Protection Regulations (GDPR), there really is more to it and to be totally honest most of it is just common sense. In its basic form GDPR is about Getting Data Protection Right, and it's perhaps the kick up the backside some (not all) organisations needed to get them thinking about the personal data there were processing; its' introduction definitely helped individuals know more about their information rights.
Let's break it down into the main constituent parts, and see how they interact in a UK context.
Information Commissioners Office (ICO)
In the United Kingdom, the Information Commissioners Office (ICO) regulates the legislation. The ICO is mainly funded by fees paid by "data Controllers".
Data Controllers are the legal entity (sole trader, partnership, company, organisation etc.) who ultimately decide the purposes and means of the processing of personal data.
Data Protection (Charges and Information) Regulations 2018
This is often referred to as the Data Protection Fee. There are three 'tiers' of payments depending on:
- how many members of staff a data controller has;
- the annual turnover of the data controller;
- whether the data controller is a public authority;
- whether the data controller is a charity;
- whether the data controller a small occupational pension scheme.
There are also exemptions to paying the 'fee'. Exemption Information can be found here
Myth: "We're registered with the ICO so we're compliant with the GDPR". No - Paying the data protection fee does NOT mean that an organisation is compliant with the GDPR, it just makes them compliant with the DPCIR.
Good Practice: If a data controller is registered with Companies House and relying on any of the exemptions, it is strongly advisable to contact the ICO to let them know. Failure to do so could lead to enforcement action by the ICO and a default fine of the highest tier fee.
Data Protection Act 2018 (DPA2018)
Also referred to just at DPA2018 sets out the framework for data protection law in the UK. It sits alongside and supplements the UK GDPR (more below) – for example by providing exemptions. It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence.
The DPA2018 is split into a number of different parts, which apply in different situations and perform different functions. Some of the parts include:
- Part 1: Preliminary introduction;
- Part 2: General processing (UK GDPR);
- Part 3: Law enforcement processing; and
- Part 4: Intelligence services processing.
The other parts contain provisions of general application, including interpretation and the functions and powers of the ICO.
What is the general processing regime?
Part 2 of the DPA2018 supplements and tailors the UK GDPR. For most organisations, this is the part that will apply. You need to read it alongside the UK GDPR itself, as both sets of provisions apply directly to you. The key provisions of this part are:
- Sections 4-28 (pages 4-19);
- Schedule 1 (conditions for processing some sensitive types of data) (page 131);
- Schedules 2-4 (exemptions) (pages 147-181); and
- Schedules 20-21 (transitional provisions) (pages 320-end)
The DPA2018 can be found here.
Myth: "The DPA2018 replaces the GDPR". Wrong, the DPA2018 sits alongside the UK GDPR.
Good Practice: When using the DPA2018 it is important to be clear which set of provisions apply and where/if necessary (or legally obliged to), document it - more on documentation later.
General Data Protection Regulations (GDPR)
The GDPR is relatively easy to navigate; it has chapters, which are each divided into ‘Articles’, then usually into paragraphs; some chapters are also divided into ‘sections’, then ‘Articles’.
As the UK has now left the European Union, the initial GDPR as it relates to the European Union is now known as the EU GDPR.
The EU GDPR has 11 Chapters containing 99 Articles. The Articles constitute the legal requirements organisations must follow to demonstrate compliance. In addition to the Articles the legislation also includes Recitals. The recitals provide additional information and supporting context to supplement the Articles.
Processing by UK data controllers between 25th May 2018 and 23:00, 31st December 2020 is still governed by the EU GDPR, and also applies to personal data in the Territorial Scope of the EU GDPR.
UK GDPR
The UK GDPR also has 99 Articles (remember it’s derived from the EU version), but the wording has been changed in some Articles to make it relevant to the United Kingdom and some have been redacted (scrubbed through) and don’t apply. For example:
- Redacted Chapter: VII (Articles 60-76)
- Redacted Articles: 48, 53-56, 60-76, 81, 87-88, 90-93, 97-99.
- There is also a new Article, (86A), which is not in the EU GDPR.
The UK GDPR applies to processing of personal data carried out by organisations operating within the UK. It also applies to organisations outside the UK that offer goods or services to individuals in the UK.
Key Articles
Reading through any legislation can be daunting, however when you get to Article 4 (Definitions); they explain some if not most of the terminology used throughout.
Article 5 is all about the principles of processing personal data, the mainstay of the legislation especially the first paragraph, the "Lawful, fairness and transparency" principle. Why's this? Well to satisfy the lawful and fairness part there needs to be a lawful basis of processing personal data (Article 6) and where the processing special category personal data (Article 9). For the transparency criteria data controllers have to provide individuals with all the details about the who, where, what, when, how they are processing personal data (Articles 12-23) - usually by way of privacy/fair processing notice.
In fact, as I've mentioned Articles 12-23 of the UK GDPR, it's important to know that exact information to be given to individuals in the privacy/fair processing notice is a legal requirement, (Articles 13 and 14).
Equally, Article 15 (Right of Access) allows individuals to ask about and receive confirmation about the processing of their own personal data (often referred to as a Subject Access Request (SAR)). Controllers need to ensure they can identify and respond to such requests, that requests can be made verbally, and that they have a time limit to respond.
While all the Articles are important, the next one I'd like to highlight is Article 30 - Records of Processing Activities. Yes, the dreaded documentation that we all hate. But there's good news on this front and while it's always advisable to document your processing activities, there are limited exceptions contained in paragraph 5. However, caution is needed when establishing whether the processing is "occasional".
Myth: "We don't need to abide by the GDPR we've left the EU". Well for personal data processed before 25th May 2018 that may be true (that would be processed under the Data Protection Act 1998). After that date it will either be being processed under the EU GDPR (GDPR), or UK GDPR.
Good Practice: Get to know the personal data you or your organisation processes. Review the amount and validity of the data (Article 5 conditions), ensure it is secure and only those authorised have access to it. Train your staff in the processing off personal data, it's a legal requirement.
Remember personal data that your organisation processes are not your data, you are just the custodian on it while it's being processed.
Privacy and Electronic Communications Regulations (PECR)
The PECR sit alongside the Data Protection Act and the UK GDPR. They give people specific privacy rights in relation to electronic communications.
There are specific rules on:
- marketing calls, emails, texts and faxes;
- cookies (and similar technologies);
- keeping communications services secure; and
- customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.
Where these rules apply, they take precedence over the DPA2018 and the UK GDPR. This is important, because if a data controller proposes setting cookies on, for example their website, they need to consider PECR compliance first before they look to the UK GDPR.
With the exception of cookies being set that are strictly necessary for the operation and security of the Information Society Service (ISS) (Defined in Article 4(25)), no cookies should be set without gaining valid consent beforehand.
Additionally, PECR depends on data protection law for some of its definitions. For example, PECR takes the UK GDPR’s standard of consent. The UK GDPR also talks about cookies within the definition of personal data.
The rules are generally stricter for marketing to individuals (B2C) than for marketing to companies (B2B).
Myth: "Our organisation needs to set analytic cookies for the operation of the website". No, the organisation may want to set analytic cookies, but they are not strictly necessary for the operation of it.
Good Practice:
- Individuals; consider browser extensions to stop cookies being set without your permission. Look for privacy centric browsers which have been developed to protect you more (I've recently looked at the 'Brave' browser and it's looking promising).
- Data Controllers: check, check and double check what cookies you are, or propose to set on multiple browsers and devices. Group them into categories and facilitate true choice for individuals using your ISS. Ensure any cookies that are truly essential to the operation of the service is set on by default and that all others are off by default. If you truly need analytics consider hosting them locally, or within your 'home' jurisdiction.
Okay that's more than enough for one post.
General Information
The legislation is there to protect individuals and their information rights. I've only covered the mainstay should I say, the "day to day" legislation. The ICO regulates more and information can be found on the ICO Website.
Individuals
As an individual, when being asked to disclose your personal data, perhaps consider:
- Is the information I am being asked to disclose, necessary for the purpose?
- If you're being asked for some information that you are not happy to disclose in the first instance, refer to the organisation's privacy notice and check the purpose of processing, lawful basis, data retention period, where the data is going to be processed etc. If you are not happy with anything - don't disclose the information in the first instance.
- Does the organisation allow you to keep your information accurate, up-to-date perhaps via an online portal?
- Really check each and every cookie pop-up and ensure you only consent to those necessary for you to get what you want.
Controllers
Technology is evolving all the time. Just because you can process person data in a particular way doesn't necessarily mean that you should do so.
- Remember the consent conditions of processing personal data. Can you demonstrate where, when, who consented etc?
- When considering new ways of working or processing you should conduct a Data Protection Impact Assessment before processing in the new way and that it cannot be processed in a manner that is incompatible with the initial purposes.
- Double check your privacy/fair processing notice. Is it clear, concise and include all the requirement of the law? (If you can't understand it, how is someone else reading it supposed to?).
- Keep all hardware and software up to date on all devices.
- Ensure you train your employees, staff, contractors who are processing personal data.
- When using any third-party processor to process personal data on your behalf to get a Data Processing Agreement in place, in writing.
- Cookies and similar technologies - I think I've said enough, but you can see by the ICO's enforcement page where others have perhaps made mistakes.
I'm here to help, of course.
Data Protection Advice, Guidance: https://enaych.com/
Employee Data Protection Training: https://enaychlearning.co.uk/our-courses/
Sole Trader & Start-up Data Protection Courses: https://enaychlearning.co.uk/#startup