Are you processing personal data lawfully? 19 January 2018 Mark Williamson and Isabel Ost, Clyde & Co LLP

Introduction to the General Data Protection Regulation and the Data Protection Bill Context Aims Scope/Timings

What does the GDPR cover? New Principle of Accountability Data Protection Principles Data Handling Obligations Legal Basis for Processing & Consent Security Data Subject Rights & Privacy Policies Breach Notification Data Protection Officers Enforcement

The Seven Data Protection Principles Lawfulness, Fairness and Transparency Purpose Limitation Data Minimisation Accuracy Storage Limitation Integrity and Confidentiality Accountability

Top GDPR Challenges for the insurance market Lawful and transparent processing Data breach notification Data subject rights International data transfers

What does lawful, fair and transparent mean? You have to justify each piece of Personal Data you process with a specific rule Lawful Fair and transparent You have to provide certain information to the data subject and give them certain rights

What does “personal data” mean for the insurance sector? What’s at risk? €20million or 4% of worldwide turnover whichever is greater Personal Data Touchpoints Business Core Purposes Quotation/Inception Policy administration Claims processing Business Secondary Purposes Marketing Wider risk analysis Product improvements Support HR – Employee personal data IT Legal Compliance Third party advisers

Personal Data flows through the insurance market 3rd Party Claimants 3rd Party Insureds Policy holder/Insured Processing Broker Insurer Reinsurer

Are you a “Data Controller” or a “Data Processor” Are you a “Data Controller” or a “Data Processor”? Dealing with a misconception Can you be both? At the same time? Under the same contract? What does “Joint Controllers” mean?

Fair and Transparent: Information Notices Controller must “take appropriate measures” to provide the privacy notice Must be in a “concise, transparent, intelligible and easily accessible form, using clear and plain language” Two lists of information to be provided: when you are collecting the information from the individual – when? when a third party passes on that information to you – when? Solution – LMA Privacy Notice

Lawful: Key justifications Personal data Special categories of data 1 Consent Explicit Consent 2 Performance of a contract with the data subject Legal claims 3 Legitimate interests In substantial public interest & set out in UK law

Consent: A higher standard Separate and distinct Clear, demonstrable, freely given & capable of withdrawal Revocable When not necessary, not conditional

The challenges around consent Getting it: Chain Data subjects where the insured is a Corporate and not the data subject Imbalance of power- is it “freely given”? Once you have it: Right to withdraw Consequences of withdrawal

Can you justify your processing with another lawful basis? Ordinary Personal Data: Performance of a contract with the data subject Legitimate interests Special Category Data: Legal claims In the substantial public interest and set out in UK law The insurance derogations

Policy Holder/Insured Core Business Purpose 1 Fair and Transparent Policy Holder/Insured Lawful Lawful Quotation/Inception Fair and Transparent 3rd Party Insureds Lawful Lawful Fair and Transparent 3rd Party Claimants Lawful Lawful

Policy Holder/Insured Policy Administration Core Business Purpose 2 Fair and Transparent Policy Holder/Insured Lawful Lawful Policy Administration Fair and Transparent 3rd Party Insureds Lawful Lawful Fair and Transparent 3rd Party Claimants Lawful Lawful

Policy Holder/Insured Core Business Purpose 3 Fair and Transparent Policy Holder/Insured Lawful Lawful Claims Process Fair and Transparent 3rd Party Insureds Lawful Lawful Fair and Transparent 3rd Party Claimants Lawful Lawful

Recap An imperfect position- how is it different to our current one? Stand united Insurance market will continue to lobby DCMS International

Contact details Mark Williamson Partner Commercial Insurance Tel: +44 (0)20 7876 5341 E-mail: mark.williamson@clydeco.com Isabel Ost Senior Associate Data Protection Tel: +44 (0)20 7876 5313 E-mail: isabel.ost@clydeco.com

1,800 1st 360+ 45 Lawyers and fee earners worldwide Law Firm of the Year Legal Business Awards 2011 Partners worldwide Offices across Europe, Americas, Middle East, Africa and Asia. Clyde & Co LLP accepts no responsibility for loss occasioned to any person acting or refraining from acting as a result of material contained in this summary. No part of this summary may be used, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, reading or otherwise without the prior permission of Clyde & Co LLP. © Clyde & Co LLP 2018