Data Security – Data Protection Regulatory Framework

The Data Pro­tec­tion Act (DPA) 2018, which came into force on 23 May 2018, imple­ment­ed the GDPR, whilst also adding pro­vi­sion for UK law to extend the GDPR to areas such as the secu­ri­ty ser­vices and gov­ern­ment bod­ies, which were not cov­ered under the GDPR alone.

Post-Brex­it (fol­low­ing the end of the Brex­it tran­si­tion peri­od from 1 Jan­u­ary 2021 onwards), the UK GDPR is the retained ver­sion of the EU Reg­u­la­tion by virtue of sec­tion 3 of the Euro­pean Union (With­draw­al) Action 2018 and as amend­ed by the Data Pro­tec­tion, Pri­va­cy and Elec­tron­ic Com­mu­ni­ca­tions (Amend­ment Etc) (EU Exit) Reg­u­la­tions 2020.

The UK GDPR pro­tects the rights of UK cit­i­zens with regard to their data, the EU GDPR pro­tects the rights of EU cit­i­zens. For organ­i­sa­tions that han­dle data on both UK and EU cit­i­zens both GDPRs apply.

The prin­ci­ples and require­ments of the EU GDPR con­tin­ue to apply in the UK with its post-Brex­it ver­sion and here we look at the major areas of scope and some def­i­n­i­tions.

Controllers and processors

The GDPR applies to both con­trollers and proces­sors of data. Con­trollers say how and why per­son­al data is processed. The proces­sor acts on the controller’s behalf to process the data. Your organ­i­sa­tion may be a data proces­sor, or a data con­troller, or both.

There are spe­cif­ic legal oblig­a­tions on both con­trollers and proces­sors:

• con­trollers must specif­i­cal­ly ensure that con­tracts with proces­sors com­ply with the GDPR; and
• con­trollers and proces­sors have sep­a­rate, but explic­it, require­ments to main­tain records of per­son­al data and pro­cess­ing activ­i­ties
• proces­sors are also legal­ly respon­si­ble and liable for any secu­ri­ty breach­es.

Please see our relat­ed fact­sheet ‘Data Secu­ri­ty — Gen­er­al Data Pro­tec­tion Reg­u­la­tion — Ensur­ing Com­pli­ance’ for more detailed infor­ma­tion on the doc­u­men­ta­tion require­ments.

Data protection principles

Per­son­al data shall be:

• processed law­ful­ly, fair­ly and trans­par­ent­ly
• col­lect­ed for spec­i­fied, explic­it and legit­i­mate pur­pos­es
• ade­quate, rel­e­vant and lim­it­ed to what is nec­es­sary for the pur­pose
• accu­rate and kept up to date. Inac­cu­rate data should be erased or cor­rect­ed
• kept in an iden­ti­fi­able for­mat for no longer than is nec­es­sary
• processed secure­ly and pro­tect­ed from unau­tho­rised or unlaw­ful pro­cess­ing, acci­den­tal loss, or destruc­tion or dam­age.

GDPR rights for individuals

The right to be informed

Indi­vid­u­als have the right to know how their per­son­al data is going to be processed. The GDPR pro­motes trans­paren­cy over pro­cess­ing by way of a pri­va­cy notice encom­pass­ing (amongst oth­er things) details of the con­troller, the source of the data, recip­i­ents of the data, data trans­fers made out­side the EU, and the reten­tion peri­od of the data.

The right of access (subject access request)

Indi­vid­u­als have the right to obtain con­fir­ma­tion that their data is being processed, access to their per­son­al data, and oth­er infor­ma­tion, such as that pro­vid­ed in a pri­va­cy notice.

The max­i­mum amount of time allowed to deal with a sub­ject access request is 30 days and the right to charge a sub­ject access fee has been removed, unless the request is unfound­ed, exces­sive or repet­i­tive.

The right to rectification

Indi­vid­u­als have the right to have inac­cu­rate or incom­plete per­son­al data rec­ti­fied. This must also include per­son­al data which is shared or giv­en to third par­ties.

The right to erasure

Indi­vid­u­als have the right to request the dele­tion or removal of per­son­al data where there is no com­pelling rea­son for its con­tin­ued pro­cess­ing. Again, this must also include per­son­al data that is shared or giv­en to third par­ties.

It is impor­tant to note that there are extra require­ments when the request relates to a child.

There are some excep­tions to the right to era­sure, such as where data is held to com­ply with a legal oblig­a­tion.

The right to restrict processing

Indi­vid­u­als have the right to restrict the pro­cess­ing of per­son­al data. In these cir­cum­stances the per­son­al data can be stored, but not processed.

The right to data portability

Indi­vid­u­als have the right to obtain and reuse their per­son­al data across dif­fer­ent ser­vices. It allows them to move, copy or trans­fer per­son­al data. Per­son­al data must be pro­vid­ed in a struc­tured machine-read­able for­mat (such as .csv).

The right to object

Indi­vid­u­als have the right to object to the pro­cess­ing of per­son­al data. Pro­cess­ing must stop imme­di­ate­ly unless there are ‘com­pelling’ legit­i­mate grounds for the pro­cess­ing, or if pro­cess­ing is for the estab­lish­ment, exer­cise or defence of legal claims.

Rights in relation to automated decision making and profiling

Indi­vid­u­als have the right to ensure that safe­guards are in place to pro­tect against the risk of dam­ag­ing deci­sions being tak­en with­out human inter­ven­tion. This also extends to the safe­guard­ing of per­son­al data used for pro­fil­ing pur­pos­es.

Accountability and governance

The prin­ci­ple of account­abil­i­ty requires that appro­pri­ate gov­er­nance mea­sures are in place to doc­u­ment com­pli­ance. Organ­i­sa­tions there­fore need to:

• imple­ment mea­sures that meet the prin­ci­ples of data pro­tec­tion
• doc­u­ment poli­cies and pro­ce­dures in rela­tion to the stor­age and pro­cess­ing of per­son­al data
• imple­ment tech­ni­cal and organ­i­sa­tion­al mea­sures to ensure and demon­strate com­pli­ance.
• appoint a data pro­tec­tion offi­cer where nec­es­sary.

Please see our relat­ed fact­sheet ‘Data Secu­ri­ty — Ensur­ing Data Pro­tec­tion Com­pli­ance’ for more detailed infor­ma­tion.

Lawfulness of processing

It is impor­tant to under­stand and doc­u­ment the law­ful basis of your pro­cess­ing. There are six:

1. Con­sent
2. Con­trac­tu­al oblig­a­tion
3. Legal oblig­a­tion
4. Vital inter­ests
5. Pub­lic inter­est
6. Legit­i­mate inter­ests.

On the issue of con­sent, it must be spe­cif­ic, unam­bigu­ous and freely giv­en. Pos­i­tive con­sent can­not be assumed from inac­tion, such as fail­ing to click an online ‘unsub­scribe’ box, or from the use of pre-ticked box­es. Busi­ness­es need to make sure that they cap­ture the date, time, method and the actu­al word­ing used to gain con­sent, so it is impor­tant to ensure that your busi­ness has the means to record and doc­u­ment such infor­ma­tion.

ICO con­sent guid­ance

Legit­i­mate inter­est will grant you the abil­i­ty to process the indi­vid­u­als’ data but only with­in the bounds that they would expect. If you are to rely on legit­i­mate inter­ests, you will take on the respon­si­bil­i­ty for ensur­ing that:

• there is a basis to use legit­i­mate inter­est
• the pro­cess­ing of data is lim­it­ed to that inter­est and can be demon­strat­ed
• the indi­vid­u­al’s rights have been con­sid­ered in a bal­anc­ing process
• the indi­vid­ual is informed of the legit­i­mate inter­ests in your pri­va­cy poli­cies.

ICO legit­i­mate inter­ests guid­ance

Notification of breaches

A per­son­al data breach is the acci­den­tal or unlaw­ful destruc­tion, loss, alter­ation, unau­tho­rised dis­clo­sure or access to per­son­al data.

The UK Reg­u­la­tor the ICO has an online self-assess­ment tool which helps to deter­mine the sever­i­ty of the breach and whether or not it need be report­ed. Some breach­es need to be noti­fied to the rel­e­vant super­vi­so­ry author­i­ty with­in 72 hours. It is vital to under­take the assess­ment as soon as the breach is dis­cov­ered.

ICO per­son­al data breach assess­ment guid­ance

Transfer of data

On 28 June 2021 the EU Com­mis­sion adopt­ed an ade­qua­cy deci­sion for the UK which means that most data can con­tin­ue to flow between the UK and the EU EEA with­out the need for addi­tion­al safe­guards. (The excep­tion is data for the pur­pos­es of immi­gra­tion con­trol.)

When trans­fer­ring data to a ‘third coun­try’, then addi­tion­al safe­guards such as Stan­dard Con­trac­tu­al Claus­es or Bind­ing Cor­po­rate rules may be applic­a­ble. The first link below is from the UK’s reg­u­la­tor – the ICO. The sec­ond is from the Euro­pean Com­mis­sion.

ICO data trans­fer agree­ment guid­ance

EU rules for trans­fers out­side of the bloc

Sources and links

ICO home page for organ­i­sa­tions

EU GDPR por­tal — www.gdpreu.org