UK risk managers warned to comply with GDPR despite Brexit

Uk risk managers and their bosses need to forget the idea that Brexit will somehow let them off the hook when it comes to the EU’s forthcoming General Data Protection Regulations (GDPR). The UK will have to apply the tough new rules for at least ten months and probably beyond if its companies want to continue receiving personal data from EU territories, according to Joanne Howie, deputy general counsel (global) at AXA Corporate Solutions. Ms Howie told UK risk managers and brokers at AXA Corporate Solutions’ annual UK customer event in York at the start of November that these rules need to be taken seriously because they raise the level of risk faced by almost all companies in a potentially significant way. Ms Howie said it is not “crystal clear” at this stage exactly how the fines included with GDPR will be applied in practice. The largest fine to date imposed by the Information Commissioners Office (ICO) in the UK under the Data Protection Act 1998 was against Talk Talk for £400,000. Ms Howie pointed out that under GDPR this may have cost the mobile operator about £59m. The AXA Corporate Solutions’ deputy general counsel also warned risk managers not to be lulled into a false sense of security by recent words from the ICO that suggest it prefers to use the carrot rather than the stick. “They will use a sledgehammer if they need to!” said Ms Howie. The lawyer said that responsibilities need to be made clear at each and every company. Risk managers will have an important role to play in GDPR programmes and must work with data protection officers, IT and others to identify and assess the risks of non-compliance, she continued. But boards need to make sure that the message comes right from the top. “Everyone has a role in data protection compliance,” stressed Ms Howie. Julia Graham, deputy CEO and technical director at Airmic, the UK risk management association, agreed with Ms Howie that 2018 will be a big year for the GDPR and urged members to take it seriously. During a later panel debate on the rise of the digital age, Ms Graham said the one thing that might persuade directors to take the GDPR more seriously is the real threat that failure to comply and carry out duties could void D&O cover, always a matter likely to grab their attention. Ms Howie’s message to risk managers that Brexit provides no relief from GDPR was loud and clear. “Brexit will not give us a lucky escape unfortunately. The GDPR will be applicable despite Brexit. Given the timeline, on current estimates, the UK will be formally subject to the GDPR for at least ten months. All other indications both from government and the ICO are that they intend to retain the GDPR at least for the short to medium term following Brexit. Importantly, in order to be considered an adequate jurisdiction for receipt of personal data from the European Union, the UK must have an ‘equivalent’ level of protection. It therefore does not look like it is going away,” Ms Howie explained. The in-house lawyer said risk managers and their companies need to appreciate that under the GDPR, the ICO has a range of enhanced enforcement powers. “Those powers can’t be underestimated,” said Ms Howie. “EU member states can put in place criminal sanctions. The UK data protection bill has introduced a new criminal offence for intentionally or recklessly processing data. This applies if an organisation has knowingly or recklessly re-identified information that has been anonymised, without the consent of the data controller responsible for anonymising that data,” she added. Ms Howie advised that data terms and definitions need to be carefully considered because they could wind up being interpreted in a much broader manner than many currently think. “What is meant by personal data? It is broader than what many people think. It includes any information relating to a living identifiable data subject and includes names, contact details, addresses, bank details, photos and information you might not expect such as car registration numbers, supermarket loyalty cards, CCTV and the like. Processing too is much broader than you might initially think. It is safe to say that where you have someone’s personal data, no matter what you do with it, it is likely to be processing,” she explained. Ms Howie also stressed that this is clearly an enterprise-wide issue that needs to be managed in a truly collective manner and understood across the organisation. “There is a whole range of people who are likely to be involved in the data protection programme at your companies, starting at board level but also encompassing almost everyone in the company in some way,” explained Ms Howie. “Every company will need to look at what they do to see whether they need to appoint a data privacy officer (DPO). Companies that regularly and systematically monitor data subjects on a large scale, or do large-scale processing of special categories of data or personal data relating to criminal convictions and offences, will likely need to have a DPO,” she said. Ms Howie added that boards must ensure the right message on data privacy comes from the top. “They must support the DPO with the right resources, must not instruct the DPO how to carry out the role and cannot dismiss or penalise the DPO for performing his or her role. They must also ensure that the DPO reports directly to the highest level of management,” she added. “Risk managers are likely to have an important role in GDPR programmes as well, working with the DPO, IT and other staff to identify and assess the risks of non-compliance. Everyone has a role in data protection compliance. Ultimately, every staff member is responsible for compliance, in particular adherence with all policies and procedures and reporting any breaches,” she pointed out. Ms Howie also said data privacy will not work without “incredibly close” coordination between IT and information security officers. She said it is important to monitor access to premises or equipment given to anyone outside the organisation and the additional security considerations this will generate. “Companies should also be ensuring that there are business continuity arrangements that identify how to protect and recover any personal data the organisation holds, and periodic checks to ensure that the organisation’s security measures remain appropriate and up to date,” she said. And of course, the company needs to be ready to act swiftly in a proactive manner when a breach occurs. Under the GDPR, where feasible, organisations must notify the supervisory authority no later than 72 hours after being made aware of a data breach. Notification is not needed when the breach is unlikely to result in a risk to the rights and freedoms of data subjects. But if a lost list of names is deemed likely to result in a high risk to the individuals’ rights and freedoms, then the individuals themselves need to be notified. “Ultimately, the most important thing in dealing with data breaches is being able to respond appropriately within the 72-hour deadline, and large businesses should not underestimate how difficult that can be,” warned Ms Howie. “There are a number of things companies can be doing now to prepare. Most companies have big GDPR programmes underway in the run up to the May 2018 deadline. Getting it right now will allow companies to make the best use of all the exciting data opportunities out there. Getting it wrong, however, could prove to be very costly indeed,” she concluded.

UK risk managers warned to comply with GDPR despite Brexit

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Want to read this article?

Read Next

Action needed to bridge $800bn Asian climate finance gap

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Related Articles