Data Privacy Newsletter - March 2021

We were all relieved last week when the European Commission announced that they had published draft adequacy decisions for transfers of personal data to the UK. The news is all the more welcome given the current complexities around international transfers (and the additional challenges for many of having to deal with both EU and UK data protection regimes). As Elizabeth Denham said last week, the adequacy announcement ‘gets us a step closer to having a clear picture for organisations processing personal data from the EU’.

The focus will now be on whether the European adequacy process can be concluded ahead of the expiry of the temporary EU-UK data ‘bridge’ at the end of June and, unsurprisingly, how swiftly and in what form the inevitable challenges to the EU’s UK adequacy assessment will arrive (as we discuss here). Our January briefing contains further details on the ‘bridge’ arrangements for EU-UK data flows. Of course, international transfers generally are likely to remain a key area of focus for everyone in the coming months, with standard contractual clauses expected from the EU (in final form) and the UK.

In terms of other developments in 2021, e-Privacy is back on the EU’s agenda with progress made this month on the e-Privacy Regulation (ePR) in the European Council. Although the UK hasn’t yet stated whether it will enact equivalent provisions, the ePR’s extraterritorial reach means that UK businesses will need to keep monitoring privacy developments across the Channel as discussions heat-up between the EU institutions.

On the contentious side, the much-awaited Supreme Court decision is due in the first half of this year, and will provide some clarity on the future of representative actions in the UK.

Meanwhile, the Information Commissioner’s Office (ICO) anticipates that their workload for 2021 will focus on supporting organisations with pandemic-related privacy compliance challenges and ensuring that individuals’ rights continue to be upheld. The ICO has also indicated that it will pick up work paused due to pandemic such as its investigation into adtech which it has resumed. Elizabeth Denham will remain at the ICO’s helm through much of this next period, as her term as Information Commissioner has been extended until 31 October.

While we cannot meet face to face, we will continue to keep you up to date with developments and support you with your privacy compliance.

We hope to catch up for a virtual coffee soon.

Rebecca Cousin
Partner

Legal updates

EU Commission publishes draft UK adequacy decisions

As mentioned above, on 19 February the European Commission published two draft adequacy decisions for transfers of personal data to the UK, one under the GDPR and one under the Law Enforcement Directive. We discuss the next steps in the adequacy process and the challenges remaining in our recent briefing.

ePrivacy Regulation progresses as EU Council reach agreed stance

Following nearly four years of negotiations across eight EU Council Presidencies, the EU Member States have reached an agreement on a draft of the much delayed ePrivacy Regulation (ePR) that will now form the basis of their negotiations with the European Parliament (overseen by the European Commission). As discussed in past newsletter issues (see issue 7), the ePR is due to replace the EU’s 2002 ePrivacy Directive and was previously envisaged as taking effect at the same time as the GDPR. Now the log-jam in the EU Council has been cleared, the ePR is able to progress to these final trilogue negotiations. It is anticipated that there may be substantial revisions to the current EU Council draft text in the course of the negotiations given the differing views of the European Parliament.

Case law update

UK court extends deadline in BA data damages claim to gather more claimants

Following British Airways’ high-profile 2018 data breach that led to a £20 million regulatory fine from the ICO (see our previous blog post), the airline is now facing the largest ever group claim for a data breach. In a Costs and Case Management Conference for the ‘opt-in’ class action earlier this month, Mr Justice Saini agreed to extend the deadline for claimants to opt in to the litigation from 3 April to 3 June 2021. The Judge also concluded that the claimant’s lawyers cannot recover their advertising spend in building the group action, as we discuss in our recent blog post.

Meanwhile, two competing class actions have been filed against Facebook for the harvesting of data without users’ consent, following the ICO’s £500,000 fine against the social media company in 2018 (the maximum penalty under the pre-GDPR regime).

GDPR extraterritoriality considered by English court

In Soriano v Forensic News and Others, the High Court had to decide whether the processing of Mr Soriano’s personal data by a US-based investigative journalism website, Forensic News, fell within the scope of the GDPR’s extraterritoriality. This analysis came in the context of an application by Mr Soriano to serve proceedings on Forensic News in the US, under CPR Practice Direction 6B. Justice Jay’s judgment held that Forensic News had no establishment in the UK and the website in question was not UK orientated and had no UK employees. The Judge held that ‘less than a handful’ of UK subscribers was not enough to amount to a ‘stable arrangement’ for an establishment under the GDPR and that the website was not seeking to target individuals in the UK or EU. Although the judgement dismissed the GDPR elements of the application, it is useful to see the court’s practical application of the GDPR’s extraterritorial provisions.

Regulator guidance

Key pieces of guidance published by the ICO and the European Data Protection Board (EDPB) since November 2020 are included in the table below. Some of these are explained in more detail in the following sections.

ICO guidance on SCCs after the transition period ends

The ICO has published more detailed guidance on the application of Standard Contractual Clauses (SCCs) for international transfers now the UK-EU transition period has ended. It confirms that the existing EU SCCs can continue to be used for restricted transfers made from the UK ahead of the publication of the UK’s own SCCs, which the ICO intends to consult on and publish during 2021. As a temporary measure, the ICO has published two UK versions of the EU SCCs (controller-to-controller and controller-to-processor) that it has amended to refer to the UK context. In the guidance, the ICO reminds organisations that the European Commission’s draft EU SCCs will not be valid for transfers from the UK. The ICO also explains that the Schrems II decision continues to apply to restricted transfers from the UK. The ICO is intending to issue its own guidance on the ‘essential equivalence’ assessment organisations are required to make when using SCCs following Schrems II (which it acknowledges ‘is undoubtedly complex’) and the supplementary measures that may be required. We discussed international transfers following Schrems II in our briefing International transfers of personal data - a way forward?

EDPB & EDPS publish joint opinions on SCCs

The EDPB and the European Data Protection Supervisor (EDPS) have published a joint Opinion 2/2021 on the EU Commission’s draft decision on standard contractual clauses for international transfers of personal data (including comments on the draft clauses themselves). The opinion states that the draft SCCs present a reinforced level of protection for data subjects and the provisions intended to address the issues identified in the Schrems II judgement are particularly welcome. However, the EDPB and EPDS also put forward a number of suggested amendments, including in relation to third party beneficiary rights, obligations for onward transfers and aspects of the assessment of third country laws. 

The EDPB and the EDPS have also issued a joint Opinion 1/2021 on the EU Commission’s draft decision on standard clauses between controllers and processors (where a controller appoints a processor within the EEA), including comments on the draft clauses.

EDPB guidance on data breach notification examples

The EDPB draft guidelines 01/2021 provide practical guidance on data breach notification based on case studies to complement the Article 29 Working Party’s Guidelines on Personal Data Breach Notification under the GDPR published in 2017. We examine the new guidelines in our recent blog post.

ICO publishes final Data Sharing Code

In December 2020, the ICO published the final version of its Data Sharing Code of Practice and supplemented it with a set of resources available via a new data sharing information hub on its website. The Data Sharing Code was submitted to the Secretary of State on 17 December to be laid before Parliament as soon as reasonably practicable. Once the Code has been before Parliament for 40 sitting days it will come into force (i.e. later this Spring).

Enforcement overview

The table below sets out a selection of the most substantial GDPR fines brought by the European data protection supervisory authorities (DPAs) in the last 4 months, along with an indication of the principal areas of non-compliance addressed by each enforcement action.

We advise on all aspects of data privacy compliance across the world. This ranges from ad hoc GDPR compliance issues from UK, EU and non-EU clients to complex global data risk strategic advice. We regularly advise on data breaches; data protection issues arising in commercial and M&A transactions, global investigations and pension scheme arrangements; the privacy implications for tech such as blockchain or AI; individuals’ rights; and data sharing agreements, from simple processor agreements to more complex data pooling arrangements and large strategic sourcings.

Our global data privacy team comprises six expert partners, supported by several associates and professional support lawyers who specialise in this area. As data privacy issues affect all areas of a business, we train all of our other lawyers to advise on these issues within their practice areas. For more complex or novel queries, our specialist cross-practice data privacy team can provide the necessary expertise and support.