2. DATA PROTECTION AND THE IMPACT OF BREXIT   29 NOVEMBER 2016   Robin White Old Square Chambers

3. This talk covers:
The legal framework – an outline
The General Data Protection Regulation & Brexit

4. The legal framework (an outline)
DPA ss.1(1), 2
Data processor
Data controller
Personal data
Sensitive personal data
Processing

5. Personal data
 Durant v Financial Services Authority
The information relates to the individual, and it must be found to do so in a way which might affect their privacy
The information must have the data subject as its focus and be information of a biographical nature

6. EU Working Party Opinion 4/2007: a wider interpretation
EU Working Party Opinion 4/2007: a wider interpretation
ICO Technical Guidance Note: trying to reconcile Durant with the EU opinion
R (on the application of Kelway) v The Upper Tribunal
Edem v The ICO & Anor

7. Data protection principles
Sch. 1, Part I and interpreted in Part II. The first principle states:
Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

8. Rights of data subjects
Request under s.7
s.7(9): (where) the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.
R (On the Application of Alan Lord) v The Secretary of State for the Home Department [2003]:
“The discretion conferred by section 7(9) is general and untrammelled.

9. Exemptions Includes: NB: National security Crime Tax Health Education
Social work
Regulatory activity
S.35: Disclosures required by law or made in connection with legal proceedings

10. GDPR
Came into force May 2016
Must be transposed by May 2018

11. What is it? A comprehensive re-writing of the rules
Increased obligations on controllers and processors
Definition of personal data more detailed
Accountability requirement

12. Individuals’ rights To be informed Access Rectification
Erasure (i.e. the right to be forgotten)
Restrict processing
Data portability
Object
Automated decision making and profiling

13. Hard Brexit Repeal unlikely; but Less control on processing
Fewer rights for individuals
A different/lower standard of data protection than under GDPR

14. Soft Brexit EU adequacy requirement Therefore need to comply
But – e.g. Art.88 – only follow GDPR where required to do so

15. Thank you Contact London 10 - 11 Bedford Row London WC1R 4BU
DX 1046 London / Chancery Lane T
Bristol
3 Orchard Court, St Augustines Yard
Bristol BS1 5DP
DX Bristol 1 T E
W oldsquare.co.uk
@OldSqChambers