In this webinar, we will be exploring the issues that organizations faced in the final run-up to the GDPR taking effect on 25th May, and the lessons learned so far in regards to the GDPR compliance. Main points covered: • Website privacy policies – is it a Policy or is it a notice? • Personal data breaches: when to put your hand up? • Do we need a DPO? Presenter: Our presenter for this webinar, James Castro-Edwards is a partner and Head of Data Protection at Wedlake Bell LLP. James advises domestic and multinational organizations on data protection issues. His experience includes managing global data protection compliance projects for multinationals and advising domestic companies on complex data protection issues. He has also developed and delivered innovative data protection training programs for multinational clients, including a data protection officers’ training course which was accredited by a European government. James leads the firm’s outsourced data protection officer service, ProDPO. James frequently speaks on data protection and cybersecurity issues and is widely published, having written articles for a wide variety of titles including The Times and The Guardian, and wrote The Law Society textbook on the General Data Protection Regulation (GDPR).

1. 1

2. OVERVIEW
1. The great re-consenting swindle
2. Updating processor contracts re-papering the world?
3. Are we joint controllers?
4. Website privacy policies: is it a Policy or is it a Notice?
5. Data subjects’ rights: opening the floodgates.
6. Personal data breaches: when to put your hand up.
7. Do we need a DPO?
8. When do we need a DPIA?
9. We’re a processor, so what exactly are we supposed to do?
10. But is this all just like the Y2K bug, right?

3. 1. THE GREAT RE-CONSENTING SWINDLE
Please tick the box if you would like to stay in touch…
• Fairness, lawfulness and transparency
• Lawful basis
+
• Transparency
• One potential lawful basis is consent, but there are others…

4. 1. THE GREAT RE-CONSENTING SWINDLE
Lawful grounds for processing personal data
Controllers must establish at least one of the following grounds:
1. Data subject’s consent
2. Contractual performance, or pre-contractual steps at data subject’s request
3. Compliance with controller’s legal obligation
4. The vital interests of the data subject (or another person)
5. Performance of a task carried out in the public interest, or exercise of official authority
6. The processing is necessary for legitimate interests pursued by the controller or a third
party, except where the interests are overridden by the fundamental rights and freedoms of
the data subject which require protection of personal data. (i.e. legitimate interests ≠ ‘get
out of jail free’)
Note the conditions for processing special categories of personal data are different.

5. 1. THE GREAT RE-CONSENTING SWINDLE
Consent:
• Valid consent must be:
• freely given
• specific
• informed (concise, transparent, intelligible and easily accessible)
• unambiguous
• positive affirmation
• Sensitive personal data requires explicit consent
• The data controller bears the burden of proof
• Capable of withdrawal at any time, without detriment

6. 1. THE GREAT RE-CONSENTING SWINDLE
So do we need to ‘re-consent?’
• The Privacy and Electronic Communications (EC Directive) Regulations 2003
(PECR)
• Regulates unsolicited, direct marketing by electronic means:
• ‘Electronic’ = Email, text, telephone (live & automated) or fax.
• ‘Direct marketing’ = directed to a specific individual (calls, texts and emails are
inevitably ‘direct marketing’ and hence covered by this definition)
• ‘Unsolicited’ = not actively requested by the individual
• Genuine market research ≠ direct marketing
• Routine customer services messages ≠ direct marketing
• ‘Opt-in’ consent generally required – subject to exceptions
• What if you have already sent the ‘re-consent’ email?

7. 2. UPDATING PROCESSOR CONTRACTS - RE-PAPERING
THE WORLD?
The GDPR applies to processors as well as controllers…
1. Controllers must only use processors that provide sufficient guarantees
2. Controllers must ensure processors are bound by an appropriate contract – significantly
more detailed than under the Data Protection Act 1998
3. Failure may be a breach of organisational security measures
4. May come under scrutiny following a breach

8. Controllers in common vs. joint controllers
1. Controllers in common may process the same personal data for different
purposes
2. Joint controllers are engaged in the same processing should consider a data
sharing agreement apportioning the parties’ responsibilities
3. So what? Organisations must consider their arrangements with third parties,
and ensure they are appropriately documented
3. ARE WE JOINT CONTROLLERS?

9. What’s the difference?
1. The GDPR is prescriptive vis-à-vis transparency information
2. Erroneously named ‘privacy policies’ are likely to require attention:
i. External – to the outside world
ii. Internal – to staff
3. Privacy policies – internal document explaining to staff how they must process
personal data in order for the organisation to comply with the GDPR -
necessary to demonstrate compliance with the Accountability principle.
4. WEBSITE PRIVACY POLICIES - IS IT A POLICY OR IS
IT A NOTICE?

10. Data subjects’ rights
1. Transparency
2. Access
3. Rectification
4. Erasure
5. Restriction of processing
6. Portability
7. To object
8. Rights in automated decision-making (including profiling)
 BUT no fee, and 30-day response period
5. DATA SUBJECTS’ RIGHTS: OPENING THE
FLOODGATES

11. 6. PERSONAL DATA BREACHES: WHEN TO PUT YOUR
HAND UP.
New rules on data breach notification
• Notification to national DPAs
• Notification without undue delay and where feasible, no later than 72
hours of becoming aware of breach (unless delay justified)
• No obligation to report where unlikely to result in risk to individuals
• Notification to data subjects
• Only if breach is likely to pose a ‘high risk’ to rights and freedoms
• Notification without delay and in clear language
• Processors are only obligated to notify breaches to controllers and this must
be done without undue delay

12. 7. DO WE NEED A DPO?
Mandatory DPOs - Requirement criteria:
1. Processing is carried out by a public authority (except courts)
2. The core activities of the controller or processor requires regular and
systematic monitoring of data subjects on a large scale
3. The core activities of the controller or processor consist of processing on a
large scale of special categories of data (i.e. sensitive personal data)
• Consider appointing a DPO even if not mandatory
• Supervisory Authorities likely to look favourably on organisations that do so
• Recommended by Art. 29 Working Party

13. 7. DO WE NEED A DPO?
Mandatory DPOs - Continued
• DPOs must have sufficient expert knowledge and the necessary professional
qualities to fulfil the role – candidates may be hard to find
• DPO can be a full/part time employee or appointed by a service contract (i.e.
outsourced) – e.g.
• A DPO's tasks include at least the following -
• informing the organisation and its employees of its obligations under GDPR
• monitoring compliance
• advising on DPIAs and
• co-operating with EU DPIAs

14. 8. WHEN DO WE NEED A DPIA?
Data Protection Impact Assessments (DPIAs)
• Requirement for organisations to conduct DPIAs for any new technologies or
activities that involve high risk to individuals
• DPIAs contrast with an audit – aims to identify risks in advance
• DPIAs not limited to new technologies (i.e. software etc.) but should also be
conducted for any activity that may involve the collection/processing of
personal data, such as new CCTV system or company intranet, or corporate
acquisition / disposal (e.g. Facebook acquisition of WhatsApp)
• Organisations must implement privacy by design and privacy by default and
ensure new products/services take protection of data into consideration (e.g.
adequate security, pseudonymisation and data minimisation)

15. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
GDPR Obligations upon processors
The GDPR applies to the processing of personal data:
 in the context of the activities of an establishment of a controller or processor
in the EU, regardless of whether the processing takes place in the Union or
not. (Art. 3(1)).
 of data subjects who are in the union by a controller or processor not
established in the Union, where the processing activities are related to:
 offering goods or services to data subjects in the Union’ or
 monitoring of their behaviour that takes place in the Union.
(Art. 3(2))

16. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
Controllers’ obligations
The following obligations fall upon the controller (but not the processor):
 Provide transparency language (Art. 12, 13 & 14);
 Comply with data subjects’ requests to exercise their right to:
 access,
 rectification,
 erasure,
 restriction of processing,
 portability
 object to processing; and
 rights around automated decision taking (Art. 15-22)

17. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
Controllers’ obligations
 Use only processors that provide sufficient guarantees to implement measures
that will ensure the requirements of the GDPR are met (Art. 28(1))
 Ensure processors are bound by an engagement contract incorporating the
provisions of Article 28 (3)
 Notify breaches to the supervisory authorities (Art. 33) and data subjects (Art.
34)
 Conduct data protection impact assessments (DPIAs) (Art. 35).

18. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
GDPR Obligations upon processors
Under the GDPR, processors must:
 Appoint a representative if they are established outside the EU (Art. 27)
 Not appoint sub-processors without specific or general authorisation of the
controller (Art 28(2))
 Process personal data in accordance with a contract including the provisions of
Article 28(3).
 Cooperate with the supervisory authority if required (Art. 31)

19. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
Obligations upon controllers and processors
 Maintain a record of processing activities (Art. 30)
 Implement appropriate security measures (Art. 32)
 Appoint a DPO (if they meet the Art. 37(1) criteria)
 Only transfer personal data to third countries where there are adequate
safeguards (Art. 46)

20. 9. WE’RE A PROCESSOR, SO WHAT EXACTLY ARE WE
SUPPOSED TO DO?
Controllers’ and processors’ liability
 Controllers and processors may be subject to fines of up to 4% worldwide
annual turnover, or €20,000,000 (Art. 83)
 Where one or more controller or processor involved in the same processing
are liable for damage each controller or processor shall be geld liable for the
entire damage to ensure the data subject is effectively compensated (Art.
82(4))
 A controller or processor that has paid the full compensation is entitled to claim
back from the other controllers or processors compensation corresponding to
their part of responsibility for the damage (Art. 82(5))
 A processor that determines the purposes of processing will be considered a
controller in respect of that processing (Art. 28(10))

21. 10. BUT IS THIS ALL JUST LIKE THE Y2K BUG, RIGHT?
Data protection, post GDPR
 GDPR compliance has been mandatory since 25th May; but the flurry of activity
marked the beginning, rather than the end.
 The GDPR obliges organisations to report serious data breaches to the ICO
 Data breaches reported to the ICO have increased from 2,447 last year to
3,156 this year. (a 29% increase)
 The ICO received 1,700 breach notifications in June, a dramatic increase
compared with previous levels (360-390 breach notifications / month).

22. 10. BUT IS THIS ALL JUST LIKE THE Y2K BUG, RIGHT?
Data protection, post GDPR
 In the UK the ICO intends to recruit 200 more staff over the next two years to
manage the increased workload the GDPR introduces.
 Mandatory breach notification, better informed general public, high profile
incidents such as Cambridge Analytica / Facebook are likely to keep data
protection in the spotlight for the forseeable future.
 Organisations that were previously unware can’t ‘un-see’ the GDPR
 Organisations must remain compliant with the new law on an ongoing basis

23. GDPR
Training Courses
• GDPR Introduction
1 Day Course
• GDPR Foundation
2 Days Course
• Certified Data Protection Officer
5 Days Course
Exam and certification fees are included in the training price.
https://pecb.com/en/education-and-certification-for-individuals/gdpr
www.pecb.com/events

24. THANK YOU
?
jcastro-edwards@wedlakebell.com
www.wedlakebell.com
linkedin.com/in/james-castro-edwards-7775a72