GDPR – 5 YEARS ON

Much has happened since the EU published the General Data Protection Regulation (GDPR) in April 2018! It’s not even called that in the UK anymore!

Brexit, Covid and the Ukraine war have inflicted unprecedented disruptions on business with many companies struggling to keep trading. In the circumstances it would come as no surprise if businesses had prioritised pressing issues such as survival and risk management, putting data protection on the back burner.

They however ignore data protection at their peril! What became enshrined in UK law as the Data Protection Act 2018 was deemed adequate and merged with the requirements of GDPR forming a new, UK-specific data protection regime that works post Brexit.

The standards set by the EU have been adopted by the UK, the ICO (Information Commissioner’s Office) taking over from the European Board as the enforcer and regulator of what is now known as UK GDPR.

The core GDPR principles remain unchanged, granting clear rights to individuals:?

• Information
• Access?
• Rectification
• Erasure
• Process restriction
• Data portability
• Objection
• Not be subject to automated decision-making including profiling

?with sensitive personal data (health, race, religion…) requiring a higher level of protection.

In determining whether GDPR rules apply to them businesses must not only assess their own processing but also consider activities processed on their behalf (payroll, outsourced contractors…) and all businesses with a website collecting cookies need a Privacy Policy stating how the data is being used.

Businesses of all sizes need to be clear who fulfils the roles of Data Controller and Data Processor in their organisation (it can be the same entity), and should be clear about who within their organisation is responsible for data protection and, where necessary appoint a Data Protection Officer to ensure the rules are adhered to, data processed correctly, and data breaches (however small) reported to the ICO.

As the UK is no longer an EU member state, new tools for data transfers have come in force including:

• International Data Transfer Agreement (IDTA)
• International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Strict deadlines were set to update transfers mechanisms:

• 21 September 2022: any transfer subject to UK GDPR using the old Standard Contractual Clauses (“SCC’s”) to be concluded
• 27 December 2022: any transfers subject to EU GDPR to old SCC’s to be updated
• 21 March 2024: ALL UK transfers to be updated to the new SCC’s.

If you are transferring data outside of the UK, you must take action to review how you do this. The ICO is taking action to ensure organisations meet their information rights obligations and heavy fines have been issued – see ico.org.uk.

All organisations should review their data audit and data protection policies annually, and ensure their staff are fully trained as the ramifications impact on every aspect of the business. Inadvertent breaches can be costly, both in monetary and reputation terms.

?

Please contact me with any questions on [email protected] or at 020 4539 5800.

Erika Moralez-Perez

Commercial Lawyer and CEO

Iconos Group Ltd