GDPR & Cyber Security

Key changes under the GDPR affect almost all businesses. The rights of EU citizens to control their personal details have been enhanced and new unified obligations have been placed on those dealing with personal data. However, this is not the end of the compliance journey for organisations, and they must act now to ensure they fully comply with the new rules.

Previous data protection legislation (the Data Protection Act 1998 in the UK) was based on the Data Protection Directive of 1995 (the 1995 Directive) which set out key legal principles for dealing with personal data. For the past 15 to 20 years these principles have been adopted in national legislation throughout the EU Member States in different ways resulting in a disjointed approach to data protection in Europe. The GDPR replaced the 1995 Directive and is directly applicable in every EU Member State. This means there is now a single set of rules to avoid contradictory approaches across the EU.

What does the EU General Data Protection Regulation (GDPR) mean for businesses?

New obligations for data processors

Under the GDPR both data controllers and data processors can be responsible for data protection compliance. This means not only the owners of personal data are responsible for meeting the requirements of the GDPR, but those holding or using that data (such as external marketing or IT suppliers) also have new responsibilities.

Affirmative consent requirements for processing

One of the key principles for processing data is that the procedure must be fair and lawful. The bases on which data is processed are a key area of reform. The previous rules were often interpreted too widely by data controllers. One basis for fair and lawful processing is gaining the individual’s consent. Under previous legislation, practice arose in many industries whereby consent was implied by the actions or inactions of the data subject. Under the GDPR this practice is no longer accepted. Consent must be freely-given, specific, informed and unambiguous.

Privacy by design obligations

Organisations are obliged under the GDPR to adopt an approach that promotes privacy and data protection compliance from the outset. All businesses in high risk situations should consider carrying out Data Protection Privacy Impact Assessments.

Potential fines for security breaches

The GDPR introduced stronger enforcement action where there is a breach of the data protection rules, including fines of up to 4% of an organisation’s turnover. Enforcement action is unified across the EU with each national supervisory authority authorised to take action.

Enhanced rights of data subjects

The rights of individuals in relation to their personal data have been enhanced under the GDPR. This impacts on the information which should be included in privacy policies and procedures and the way in which data subject access requests from individuals should be handled.

Appointment of Data Protection officers

A properly equipped Data Protection Officer (DPO) can prove invaluable to an organisation dealing with vast amounts of data. The GDPR requires certain organisations to appoint a DPO to oversee compliance with data protection due to their size or business operations. This is a new requirement for those dealing with personal data in the UK although other EU Member States already require some organisations to have a DPO in place.

International reach

The GDPR applies to the personal data of all individuals within the EU and organisations processing their data are required to comply with the GDPR, regardless of whether those organisations are based within the EU themselves. In the age of data sharing, personal data may be processed in a number of different jurisdictions and the GDPR makes provision for identifying which data protection authority will supervise cross-border organisations.

Does your business comply with the EU General Data Protection Regulation?

Although the 25 May 2018 deadline has passed, this is not the end of the compliance journey for organisations. Initial preparation was made easier for businesses by the introduction of a 12 step checklist by the Information Commissioner’s Office (the ICO), which we have detailed here. This checklist highlights and codifies the essential steps for businesses to take in order to prepare for the GDPR.

The 12 Steps Checklist

Step 1 – Awareness

GDPR change: The GDPR will significantly amend current data protection law. Not everyone within an organisation will be aware of this.

Action to be taken: Make the GDPR reforms known to key people in the business (e.g. those with supervisory or decision making powers), and make them aware of the effects of such reforms.

Step 2 – Information you hold

GDPR change: If a business has shared inaccurate personal data with another organisation, the GDPR requires that the business notify that other organisation of the inaccuracy. As part of the new accountability principle, businesses will also have to be able to show how they comply with the data protection principles.

Action to be taken: Businesses should consider undergoing an information audit which documents the personal data held by them, the source of such data and details of with whom they share the data.

Step 3 – Communicating privacy information

GDPR change: Additional information must be given to individuals when their personal data is obtained.

Action to be taken: Review current privacy notices/policies and identify those areas which will require updating to ensure compliance with the GDPR.

Step 4 – Individuals’ rights

GDPR change: Individuals will have enhanced rights to:

• Access their information
• Have inaccuracies corrected
• Have information erased
• Prevent direct marketing
• Prevent automated decision making and profiling
• Data portability

Action to be taken: Review privacy/data protection procedures and policies to ensure that they provide for each enhanced right under the GDPR.

Step 5 – Subject access requests

GDPR change: Current rules for subject access requests are changing – timescales for compliance will be reduced, fees will generally no longer be chargeable and additional information will require to be provided to individuals e.g. about data retention periods and the right to have inaccuracies corrected.

Action to be taken: Review and update current procedures for handling subject access requests.

Step 6 – Legal basis for processing personal data

GDPR change: The legal basis for processing will need to be explained in privacy notices and when responding to subject access requests. The rights afforded to individuals will vary on the legal basis for data processing.

Action to be taken: Review the data processing carried out by the business and then identify and document the legal basis for processing.

Step 7 – Consent

GDPR change: The threshold for valid consent has been enhanced significantly and now includes additional requirements. Pre-ticked consent boxes are specifically banned and clear records to demonstrate consent must be kept. GDPR also gives a specific right to withdraw consent.

Action to be taken: Review how your business seeks, records and manages consent and whether you need to make any changes to your processes. Refresh existing consents if they don’t meet the GDPR standard.

Step 8 – Children

GDPR change: Parental or guardian consent must be obtained to process personal information of children (i.e. those under 13 years of age in the UK).  Consent must be verifiable and written in child friendly language.

Action to be taken: Create and implement new practices for (i) verifying the age of individuals and (ii) obtaining parental or guardian consent when processing the data of children.

Step 9 – Data breaches

GDPR change: The GDPR widens the number of businesses obliged to notify the ICO and private individuals of data breaches. Failure to comply with this obligation may lead to significant fines by the ICO.

Action to be taken: Ensure that there are procedures in place to detect, investigate and report on personal data breaches. The ICO suggests assessing the types of data held and documenting which ones would trigger notification in the event of a breach.

Step 10 – Data protection by design and data protection impact assessments

GDPR change: Organisations must adopt ‘privacy by design’ (i.e. an approach that promotes privacy and data protection compliance from the outset). Organisations should also carry out a Data Protection Impact Assessment (“DPIA”) in high-risk situations.  If processing is high risk, the ICO should be consulted on whether processing complies with the GDPR.

Action to be taken: Know when DPIAs should be used, who should be involved and the process to be adopted.

Step 11 – Data Protection Officers

GDPR change: Public authorities and large businesses will be required to appoint a Data Protection Officer to oversee compliance.

Action to be taken: Where required, identify and designate a Data Protection Officer – this can be someone within or outside the organisation. This will be an important role for the organisation in terms of ensuring compliance with the GDPR. Select someone who has suitable experience.

Step 12 – International

The GDPR applies to the personal data of all individuals within the EU and organisations processing their data are required to comply with the GDPR, regardless of whether those organisations are based within the EU themselves. In the age of data sharing, personal data may be processed in a number of different jurisdictions and the GDPR makes provision for identifying which data protection authority will supervise cross-border organisations.

GDPR change: The GDPR creates a system for determining which data protection supervisory authority takes the lead when investigating a complaint which is international in nature.

Action to be taken: If operating internationally, determine which data protection supervisory authority will be the lead supervisory authority for the business. If the organisation is complex with decisions regarding data processing activities being made in different places, the ICO recommends that businesses map out where the most significant decisions are made to determine the main establishments and then the lead supervisory authority.

The law concerning the use of technology to conduct criminal activity has developed greatly in recent years in response to the volume of crimes involving technology.

The law concerning cyber security is evolving into a very sophisticated framework of rules and regulations, which can be difficult to navigate without a specialist solicitor. MacRoberts has experience in assisting clients with cyber security.  

Cyber crime is any kind of criminal activity that is committed with the use of a computer. This makes cyber crime and cyber security a vast area of law, with greatly varying offences, including hacking, fraud, harassment and espionage. Cyber crime and cyber security are not limited by borders, and investigation of such offences may involve a number of international agencies. The main regulator of cyber crime in the UK is is the National Cyber Crime Unit of the National Crime Agency. This agency investigates, prosecutes and polices instances of cyber crime and breaches of cyber security across the UK.

The main cyber crime offences that we see in relation to corporate offences are:

• Unauthorised access to computer material
• Unauthorised access with intent to commit or facilitate a crime
• Unauthorised modification of computer material
• Making, supplying or obtaining information which can be used in computer misuse offences

These offences are also very broad, and if you are caught at any stage of the process of assisting in cyber crime you may be held liable for committing an offence. The offence of ‘making, supplying or obtaining information which can be used in computer misuse offences’ is designed to catch individuals or organisations which create viruses or spyware designed to be released into a computer network.

The penalties for cyber crime depend on the crime’s severity. Under the Misuse of Computers Act, the lowest offence carries a maximum penalty of six months’ imprisonment in addition to a fine. All other cyber crime offences can attract up to five years in prison and in certain circumstances an unlimited fine.

Cyber Crime Legal Advice & Criminal Defence Scotland

Cyber crime is a fast moving area of law under constant review and changing regularly. If you have been affected by cyber crime in any way it is crucial that you contact a specialist team of cyber crime lawyers to handle your case. Our team has specialist knowledge and experience in dealing with cyber crime cases and can navigate the complex rules and regulations in this area. We have many years of experience in advising our clients who have been involved in cyber crime investigations, and can offer expert representation at all stages should you require it.

We can help organisations, both controllers and processors, in a number of ways to suit business needs, from template documents to tailored advice and assistance:

Auditing and data mapping

To work towards compliance you need to know where you stand currently. We can assist you by performing a data protection audit to identify any compliance gaps in your processes and recommending compliance solutions using a ‘traffic light’ coded action plan. As part of this process we help clients to ‘map-out’ their data flows, which forms the basis of an organisation’s record of processing activities (which means from the process we undertake you are already on your way to working towards compliance requirements).

Training and workshops

Online training 

We can provide online training for employees and managers on a subscription basis which is a really useful tool for reaching large audiences quickly at a time and place that is convenient to them.

Face-to-face training

We can also provide interactive face-to-face training (on-site or off-site) to allow staff to ask questions and to work through practical examples. This training can be a general overview of data protection or we can provide specific tailored workshops for your market sector and on key issues such as, for example, responding to SARs, dealing with personal data breaches, drafting GDPR compliant contracts, fundraising and direct marketing, etc.

Template and tailored documents

We have a number of template guidance tools, policies and procedures, and contracts that we can offer and tailor to your organisation’s functions, including:

• Legal Basis Flowcharts
• Privacy Notice Checklist
• Direct Marketing / Fundraising Flowcharts
• DPO Advice Note and Questionnaire
• Template DPIA 
• Data Protection Policy and Privacy Standard 
• Procedure for Data Subjects Rights 
• Personal Data Breach Policy and Procedure 
• Guidance Tool – Determining Roles of Parties 
• Data Processor GDPR Checklist
• Contracts 
• Consent

Tailored advice and assistance

As well as assisting with your documents, we can also provide advice and assistance on all matters related to data protection and privacy, and we have assisted a number of clients in various sectors with tailored advice on many practical areas, including, SARs; personal data breaches; direct marketing; monitoring and tracking employees; internal transfers; data sharing arrangements and international transfers.

International transfers

We provide advice and assistance on all matters relating to international transfers; whether this is within a group structure or simply as part of an on-going business relationship. We can assist you to ensure that your international transfers are carried out in a lawful way whether that be providing advice on Standard Contractual Clauses; or how to join the EU-US Privacy Shield or where your business needs guidance on particular jurisdictions, we can assist you in getting that guidance through our worldwide network of data protection experts.