The UK’s third generation of data protection law has entered Parliament.
The Data Protection Bill was published on 14 September 2017 and aims to modernise data protection laws to ensure they are effective in the years to come.
This explains the relationship between the Bill and the GDPR, detailing the additional areas the proposed new legislation covers. It also includes links to the ICO’s GDPR and Law Enforcement pages and to a Data Protection Bill fact sheet.
When the General Data Protection Regulations (GDPR) come into effect next year there will no longer be a requirement to notify the Information Commissioner’s Office (ICO) as there is now.
There is a provision in the Digital Economy Act which means it will remain a legal requirement for data controllers to pay the ICO a data protection fee. These fees will be used to fund the ICO’s data protection work. As now, any money the ICO receives in fines will be passed directly back to the Government.
The new system will aim to make sure the fees are fair and reflect the relative risk of the organisation’s processing of personal data. The size of the data protection fee will still be based on the organisation’s size and turnover and will also take into account the amount of personal data it is processing. The final fees will be approved by Parliament before being put into place.
For the purposes of the Data Protection Act the quick definition is data which identifies a living individual.
The Information Commissioners Office has put together a quick reference guide to help. Please click here to access the guide which will open in a new window.
Why does Health & Safety just seems to get in the way of getting anything done these days?
After years of bearing the brunt of this question, workplace safety advisor and Reputation Advocate John Simmons of Sim Compliance will give his views.
There are plenty of databases out there but whether they can be used to send marketing material will depend on the basis on which the personal information concerned was collected. The general rule is that unsolicited marketing can be sent to individuals where they have agreed to this or where it is likely to be within their reasonable expectations. For example, if an individual goes on holiday with a particular travel company then it is reasonable for that company to send a brochure advertising similar holidays the next year, unless the individual has made it clear that they do not wish to receive such marketing.
Therefore, the buyer of a list needs to check the basis on which the information was collected and whether any of the individuals have objected. The buyer should also establish whether the individuals would only expect to receive marketing via a particular medium, for example by mail. When using the telephone or email the special rules governing electronic marketing should also be complied with.
Unsolicited marketing emails should only be sent to individuals who have consented (and consent cannot be assumed if an individual does not respond).
If it is established that the list buyer can use the personal information for marketing they should only market products and services which are similar to those that the information has been used to market previously. Further guidance on electronic mail marketing can be found here.
The Data Protection Act requires that any personal information held should be adequate, relevant and not excessive, and that it should not be kept for longer than is necessary. The new owner of a database should decide how much of the information they need to keep. Any unnecessary personal information should be deleted. Personal information should not be held simply on the basis that it might become useful one day.
The Government has committed to updating and strengthening data protection laws through a new Data Protection Bill which will:
Make it simpler to withdraw consent for the use of personal data
Allow people to ask for their personal data held by companies to be erased
Enable parents and guardians to give consent for their child’s data to be used
Require ‘explicit’ consent to be necessary for processing sensitive personal data
Expand the definition of ‘personal data’ to include IP addresses, internet cookies and DNA
Update and strengthen data protection law to reflect the changing nature and scope of the digital economy
Make it easier and free for individuals to require an organisation to disclose the personal data it holds on them
Make it easier for customers to move data between service providers
New criminal offences will be created to deter organisations from either intentionally or recklessly creating situations where someone could be identified from anonymised data.
Businesses will be supported to ensure they are able to manage and secure data properly. The data protection regulator, the Information Commissioner’s Office (ICO), will also be given more power to defend consumer interests and issue higher fines, of up to £17 million or 4 per cent of global turnover, in cases of the most serious data breaches.
The intention of the Data Protection Bill is to implement the GDPR in full, put the UK in a strong position to secure unhindered data flows once it has left the EU, and give businesses the clarity they need about their new obligations.
The GDPR will apply fully from 25th May 2018. If you would like to know the steps to take to comply with the new rules please register for our series of email guides here.
Recently we seem to have had a spate of marketing emails from people without any regard for the rules on privacy!
We all make mistakes but a lack of knowledge of the rules puts their business reputation at risk and exposes them to a substantial fine.
If you provide unsolicited marketing material, the Information Commissioner’s Office produces a handy Direct Marketing Checklist which includes a guide to the marketing rules. You can download it here.
The European Commission has proposed new regulations that would limit the way companies track users on the internet.
Part of that plan would see the removal of website banners that provide disclaimers on cookie policies and instead have the user’s browser preferences automatically apply to each site they visit. In addition companies will need to get explicit consent from a user before being allowed to track their online activities.
If passed, the new rules will come into effect by May 2018.
The ICO has issued a £60,000 fine to Boomerang Video Ltd after it suffered a cyber attack. An investigation by the ICO found the Berkshire-based company failed to take basic steps to stop its website being attacked.
Denvilles House,
