Updates Archives - Page 2 of 4

Archive for the ‘Updates’ Category

EU-UK data transfers – final update

05/07/21 (updated) – As part of the Trade and Cooperation Agreement the EU and the UK agreed a six-month ‘bridging period’, allowing transfers of personal data from the EEA to the UK to continue freely until 30^th June 2021, to give the European Commission enough time to adopt the adequacy decisions which are necessary to allow personal data to continue to flow from the EEA to the UK. (If you’re not sure what I’m talking about, then you catch up here and here.)

Anyway, good news. With a full two days to spare, the Commission formally adopted the adequacy decisions for the UK on 28th June – one for transfers of personal data under the GDPR and the other under the Law Enforcement Directive. As a result personal data continues to flow freely from EEA countries to the UK after the end bridging period.

Unlike the adequacy decisions adopted by the Commission for other third countries, the ones adopted for the UK have ‘sunset clauses’ which means that, unless renewed by the Commission, the decisions automatically expire in four years’ time. Furthermore, the Commission can intervene at any time during the four-year period if it considers that changes to UK law reduce the level of protection currently in place.

Tags: adequacy decision, data protection, gdpr, SCCs, sunset clause, third country, Trade and Cooperation Agreement
Posted in Privacy, Updates | No Comments »

What’s happening with SCCs? – Part 2

09/06/21 – At the end of last week, and more than three months later than originally expected, the European Commission published final versions of its new standard contractual clauses (SCCs) for the transfer of personal data to third countries (New EU SCCs).

The New EU SCCs replace the standard contractual clauses adopted by the European Commission in 2004 and 2010. They have been significantly updated to be consistent with the GDPR, and also address many of the issues raised by the CJEU in its Schrems II judgment. Unlike their rather inflexible predecessors, the New EU SCCs are modular in format and can be adapted to accommodate various data transfer scenarios, including processor-to-processor transfers which will be welcomed by many B2B service providers.

Until the beginning of last month, it was assumed by most privacy geeks that the New EU SCCs, when adopted, would simply be topped-and-tailed by the ICO and then rolled out for use by UK companies transferring personal data to ‘third countries’ (i.e. countries without a UK adequacy finding, which currently includes the U.S.). However, last month we were somewhat taken by surprise when the ICO announced that it is currently working on bespoke standard contractual clauses for the UK (UK SCCs), expected to be published in draft form for consultation later this month.

Schrems II underlined the importance that the EU attaches to protecting its citizens’ personal data after it has been transferred out of the EU. The UK government on the other hand has stated its post-Brexit intention to ‘strike [its] own international data partnerships’ and to be more ‘agile’. It will therefore be interesting to see if the UK SCCs take a more permissive approach than the rigorous, post-Schrems II approach adopted by the New EU SCCs. And if the UK SCCs are significantly less protective than the New EU SCCs, whether the European Commission will threaten to take another look at the adequacy decisions for the UK… Given that we’re now only three weeks away from the 30^th June deadline (when, in the absence of an extension, the UK becomes a ‘third country’ for GDPR purposes), this could be very bad news for UK businesses receiving personal data from customers and other data partners within the EEA.

Part 3 to follow once the UK SCCs have been issued for consultation.

Posted in Privacy, Updates | No Comments »

UKJT’s Digital Dispute Resolution Rules

26/05/21 – The UK Jurisdiction Taskforce (UKJT) received extensive and overwhelmingly positive publicity for the Legal Statement on the Status of Cryptoassets and Smart Contracts that it published in December 2019 – you can read more about the Legal Statement here.

On 22nd April 2021 the UKJT published its Digital Dispute Resolution Rules (Rules) which:

Give legal effect to automatic dispute resolution processes incorporated into digital asset systems, and
Create a streamlined arbitration process to ensure prompt and cost-effective resolution of disputes arising out of digital technologies such as smart contracts, cryptoassets and cryptocurrencies, as well as DLT-based contracts (think blockchain) where there the parties in dispute may have transacted anonymously.

Key features of the Rules:

Automatic dispute resolution processes: If a digital asset system includes an automatic dispute resolution process (aka ‘on chain’ resolution), then incorporating the Rules into the system will result in an outcome of the automatic dispute resolution being legally binding on the parties.
Incorporation: The parties can agree that the Rules will apply either before or after a dispute has arisen. The Rules can be incorporated (including in electronic or encoded form) into any relevant contract or digital asset/system by using the following text: ‘Any dispute shall be resolved in accordance with the UKJT Digital Dispute Resolution Rules’. The parties can also include their preferences, including arbitration or expert determination, procedure to be adopted, and identity (or key characteristics) of the arbitrators and/or experts.
Starting proceedings: The claimant starts proceedings by giving a notice of claim to the respondent and the Society for Computers and Law (‘SCL‘). The notice may, among other things, include a proposal regarding the way the dispute should be managed.
Responding to proceedings: The respondent then has three days to send an initial response to the notice of claim. Among other things the initial response may include comments on the claimant’s proposal for managing the dispute.
Arbitrators and experts: On receipt of the initial response, the SCL appoints the tribunal of arbitrators and any experts. Although the SCL will have regard to the parties’ preferences regarding procedure and identity of the arbitrators etc, it is not bound by those preferences. Similarly, although the tribunal of arbitrators has regard to the parties’ preferences regarding procedure, it is not bound by those preferences, and is free to adopt whatever procedure it considers appropriate, without any requirement for disclosure, witness evidence, expert evidence, or even an oral hearing.
Anonymity: Unless the tribunal considers that disclosure of the parties’ names is necessary for fair resolution of the dispute or effective enforcement of any order, or disclosure is required by law, the tribunal will respect any agreement of the parties that they are to remain anonymous to each other (but not to the tribunal).
Determination of dispute: Unless a different period has been agreed, the tribunal will use best endeavours to determine the dispute within 30 days. Yes, 30 days. Except in the limited circumstances set out in the Arbitration Act 1996, the tribunal’s decision is final and binding, i.e. there is no automatic right to appeal.
Digital assets: To help it to implement or enforce its decision, the tribunal has the right to operate, modify, sign or cancel any digital assets relevant to the dispute using any digital signature, cryptographic key, password or other control mechanism available to it, or to order a party to the dispute to do so.

Since their publication a few weeks ago, the reaction has been largely favourable, with praise for the simplicity, flexibility, speed and certainty of the Rules. Whether the positive initial reaction now translates into broad uptake by participants in the new digital technologies remains to be seen.

Posted in Technology, Updates | No Comments »

What’s happening with SCCs? – Part 1

05/05/21 – If your organisation does not transfer personal data to ‘third countries’, i.e. countries outside the EEA that do not have a UK adequacy finding, then breathe a sigh of relief and feel free to go and do something else. If, however, your organisation does transfer personal data to a ‘third country’ (which for these purposes includes the U.S.), then this is likely to be relevant to your data processing arrangements.

During an IAPP/LinkedIn Live event last week, the European Commission’s Head of International Data Flows and Protection, Bruno Gencarelli, explained that the delay to the adoption of the EU’s new Standard Contractual Clauses (New EU SCCs) is principally due to the volume of feedback that the European Commission has received since the publication of the draft New EU SCCs last November. However, according to Mr Gencarelli, it is now ‘a question of weeks‘ until the New EU SCCs are adopted by the Commission.

Most privacy lawyers – including me – have been assuming that once the New EU SCCs are adopted by the Commission, then the UK’s ICO will adopt pretty much identical standard contractual clauses for UK data exporters. This assumption has been based in part on the ‘copy & paste’ approach that the UK has so far taken to incorporating the EU GDPR (and for that matter the existing EU SCCs) into UK law, and in part on the fact that the UK is currently looking to secure a ‘clean’ EU adequacy decision while fully aware of the importance that the EU attaches to maintaining ongoing alignment of the EU and UK data protection frameworks.

It therefore came as a bit of a surprise when the ICO’s Deputy Information Commissioner, Steve Wood, announced today that the ICO ‘is working on bespoke UK standard clauses for international transfers, and intend to go to consultation on them in the summer‘. No details yet, but the message is clear – if you’re expecting the UK’s new SCCs to be a ‘copy & paste’ of the EU’s New SCCs, then don’t. And in terms of timing, it looks like UK data exporters may have to wait for another few months before they have access to updated SCCs for their transfers.

Part 2 to follow as soon as we have some more detail.

Tags: adequacy decision, data protection, gdpr, SCCs, Standard Contractual Clauses
Posted in Privacy, Updates | No Comments »

Overview of the European Commission’s proposed AI regulation

26/04/21 – The European Commission aims to turn the EU into ‘the global hub for trustworthy Artificial Intelligence (AI)’. With that objective in mind, on 21^st April 2021 the Commission published its Proposal for a Regulation on a European approach for Artificial Intelligence.

Very interesting, I’m sure. But presumably not relevant to those of us who are no longer in the EU? Or to those of us who aren’t building robots to conquer the human race, haha?

On the EU point, the regulation applies to both EU and non-EU providers who market or deploy AI system in the EU, all users of AI systems in the EU, as well as providers and users of AI systems that are located outside the EU but where the outputs of the AI systems are used in the EU. In other words, the regulation potentially extends far beyond the EU’s borders.

And for the Asimov fans out there, the regulation’s definition of ‘AI system’ is perhaps a little disappointing: ‘software that is developed with one or more of the techniques and approaches listed in Annex I and [which] can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing environments they interact with’.

Annex I in full:

‘(a) Machine learning approaches, including supervised, unsupervised and reinforcement learning, using a wide variety of methods including deep learning;

(b) Logic- and knowledge-based approaches, including knowledge representation, inductive (logic) programming, knowledge bases, inference and deductive engines, (symbolic) reasoning and expert systems;

(c) Statistical approaches, Bayesian estimation, search and optimization methods.’

Ah I see what you mean. So what do I need to know?

Well, the proposed regulation runs to 107 pages (not including the Annexes), so there’s quite a bit to digest. But by way of an overview:

Timing. The regulation will now be reviewed and debated by the European Parliament, and then by the Council of Europe. Given the subject matter, the regulation is also likely to generate extensive comments from AI providers and other interested parties. Once adopted by the Commission, the regulation is then subject to a 24-month grace period before it applies fully (Article 85(2)). Being realistic we’re looking at go-live in 2023, and very possibly 2024.
Risk-based approach. The regulation takes a risk-based approach, with AI systems falling into one of three categories: prohibited AI practices, high-risk systems, and lower-risk systems.
Prohibited AI practices. The regulation prohibits four specific practices involving AI (Article 5):
1. Marketing or deploying AI systems that ‘deploy subliminal techniques beyond a person’s consciousness’ in order to distort their behaviour in a way that causes or may cause harm.
2. Marketing or deploying AI systems that exploit vulnerabilities due to age, physical or mental disability in order to distort someone’s behaviour in a manner that causes or may cause harm.
3. Marketing or deploying by public authorities AI systems that evaluate or classify the trustworthiness of people with a social score (social scoring).
4. Use of ‘real-time’ remote biometric identification systems (e.g. facial recognition systems) for law enforcement purposes, with broad exemptions for certain criminal justice-related purposes. Biometric testing is likely to be one of the more controversial aspects of the regulation; the European Data Protection Supervisor (EDPS) has already issued a press release criticising the Commission for not adopting a stricter approach.
High-risk systems. The regulation specifies two categories of high-risk AI systems:
1. The first category consists of AI systems used as safety components of products, or AI systems which are themselves products, that are regulated under the ‘New Legislative Framework’ legislation listed in Annex II to the regulation, e.g. toys, medical devices, motor vehicles, gas appliances etc. Checking that these AI safety components, or AI systems, comply with the regulation (‘conformity assessments’) will be incorporated into the existing third-party compliance and enforcement mechanisms for the relevant products.
2. The second category are stand-alone AI systems that the Commission considers have ‘fundamental rights implications’. These are listed in Annex III to the regulation, and include AI systems used for:

- - - - biometric identification (to the extent not a prohibited AI practice).
      - management of road traffic and other critical infrastructure (water, gas, heating and electricity)
      - education and vocational training
      - recruitment and hiring of candidates
      - making decisions in connection with management and termination of workers

Stand-alone systems will be subject to conformity assessments, as well as quality and risk management systems and post-market monitoring. Following the conformity assessments, the AI systems must then be registered in a European Commission-managed database, to ensure public transparency and assist ongoing supervision.

Lower-risk systems. AI systems which are not prohibited or high-risk are subject to relatively light-touch regulation. There are no conformity assessment for lower-risk systems. And although all providers must inform individual users that they are interacting with an AI system (unless it is ‘obvious from the circumstances and the context of use’), there is no obligation for providers of lower-risk AI systems to provide information about the system’s algorithm or how it operates, as is the case for providers of high-risk systems.
Data governance. Providers of high-risk systems are required to adopt rigorous data governance and management practices in relation to training, validation and testing datasets to reduce the risk of potential biases and other inaccuracies.
Sandboxes. The regulation encourages EU member states to establish sandboxes (i.e. controlled environments) to enable providers to test innovative technologies on the basis of an agreed testing plan, and to reduce the regulatory burden (including conformity assessment fees) for SMEs and start-ups.
Penalties. For corporate providers of AI systems there are three levels of fines:
1. Non-compliance with Article 5 (prohibited AI practices, see para 3 above) or Article 10 (data governance, see para 6 above) is subject to a fine of up to €30,000,000 or 6% of total annual worldwide turnover, whichever is the higher.
2. For non-compliance of any other provision of the regulation, up to €20,000,000 or 4% of total annual worldwide turnover, whichever is the higher.
3. For the supply of incorrect, incomplete or misleading information to regulatory bodies, up to €10,000,000 or 2% of total annual worldwide turnover, whichever is the higher.

I see what you mean about quite a bit to digest. Anything I need to do now?

Although the regulation is likely to be subject to various changes over the next few months – particularly in the areas of biometric testing and social scoring – the fundamental principles are unlikely to change. So if you’re involved with the development, marketing, sale or distribution of software that constitutes a high-risk AI system then you may want to start thinking about how the regulation will impact areas such the accuracy of your datasets, risk of bias, and algorithmic transparency.

Tags: AI, artificial intelligence, brexit, EU, machine learning, ML
Posted in Technology, Updates | No Comments »

EU-UK data transfers – update

30/03/21 – As part of the Trade and Cooperation Agreement announced just before Christmas, the EU and the UK agreed a six-month ‘bridging period’ allowing transfers of personal data from the EEA to the UK to continue freely until 30^th June 2021 – more detail here. Half-way through the bridging period is probably a good time for an update.

Update? Didn’t I read a few weeks ago that the EU issued the UK adequacy decision, and it’s now all done and dusted?

No, not really. What happened is that on 19^th February 2021 the European Commission issued two UK adequacy decisions (one for transfers under the GDPR, and the other for transfers under the Law Enforcement Directive), but only in draft form. The drafts have now been passed to the European Data Protection Board (EDPB) for them to review and issue their non-binding (but influential) ‘advisory opinions’. After the advisory opinions have been issued, and any EDPB-recommended changes have been incorporated into the text of the adequacy decisions, the drafts will then need to be approved by representatives of all 27 EU member states via the so-called ‘comitology procedure’. Once approved, the adequacy decisions can be formally adopted by the Commission, and become legally effective.

Ah, so not quite done and dusted. Will this all be wrapped up by 30^th June?

Probably. The good news is that the draft adequacy decisions were issued by the European Commission without any material conditions attached to them, i.e. the Commission considers that the UK’s data protection laws and systems are adequate. Also positive was the prediction of the EU Head of International Data Flows, Bruno Gencarelli, who said in a LinkedIn webinar on 27^th January 2021 that he was confident the UK adequacy decisions would be adopted “by the end of the bridging period”. Ditto the prediction of the EU Commissioner for Justice, Didier Reynders, who, according to Vincent Manancourt of politico.eu, said on 16^th February 2021 that the EDPB’s “opinion on UK data flows decision [is] expected mid-April […] Whole process to be wrapped up by Brussels by end of May/early June”.

Less positive were the widely-publicised comments of the UK culture secretary Oliver Dowden, who in his FT article on 27^th February said: “we do not need to copy and paste the EU’s rule book, the General Data Protection Regulation, word-for-word”; and that the UK can now be more “agile” when it comes to “[striking] our own international data partnerships with some of the world’s fastest growing economies. […] The EU has been slow to act on this, declaring only 12 countries ’adequate’ in the past few decades”. Announcing the UK’s intention to diverge from the GDPR and criticising the EU’s historic approach to adopting adequacy decisions, all while the EDPB is busy considering the UK’s application, may not have been Mr Dowden’s best idea.

All very interesting, but I’ve got data flows with EU customers and other data partners which need to continue after 30^th June. What do I need to do?

You’ve got a number of options, including:

Do nothing. If the GDPR adequacy decision isn’t adopted by 30^th June 2021 (and the bridging period isn’t extended), then deal with the situation on 1^st If this option appeals, then bear in mind that although you may be willing to take a risk-based view on the legality of your post-30^th June data flows, your EEA data partner may not.
Put in place a valid transfer mechanism or safeguard (most likely Standard Contractual Clauses (SCCs)) ASAP, even though they may end up not being needed. This is clearly ‘best practice’, and consistent with the ICO’s recommendation: “If you receive personal data from the EEA, we recommend you put alternative safeguards in place before the end of April”.
Contact each of your EEA data partners, and suggest to them that if the GDPR adequacy decision has not been adopted by say end of May, or even mid-June, then you will both work together with a view to putting in place SCCs by 30^th June.

Tags: adequacy decision, brexit, EDPB, gdpr, SCCs, TCA
Posted in Privacy, Updates | No Comments »

Who owns the copyright in software created by your employees?

12/03/21 – In accordance with the Copyright, Designs and Patents Act 1988 where any work “is made by an employee in the course of his employment, his employer is the first owner of any copyright in the work, subject to any agreement to the contrary”. (more…)

Tags: CDPA 1988, copyright, employees, IP, MD5, penhallurick, software
Posted in Technology, Updates | No Comments »

Transfer Impact Assessment – what is it, and do I need to do one?

In July 2020 the European Court of Justice in its ‘Schrems II’ judgment invalidated the EU-U.S. Privacy Shield. In their judgement the ECJ, whilst upholding Standard Contractual Clauses (SCCs) as a transfer tool, made it clear that data exporters (i.e. organisations within the EEA which transfer personal data to countries outside the EEA) must “verify, prior to any transfer, whether the level of protection required by EU law is respected in the third country concerned”.

Following the Schrems II judgment, the European Data Protection Board (EDPB) issued two pieces of guidance to help data exporters with the analysis required by the ECJ: Measures that supplement transfer tools (Recommendations 01/2020); and European Essential Guarantees (Recommendations 02/2020). In addition, the European Commission published updated draft SCCs for consultation, which are expected to be adopted in March 2021.

In practice, this means that businesses which propose to transfer – or to continue to transfer – personal data using SCCs (or another transfer tool) to a third country must first carry out a transfer impact assessment (TIA) with a successful outcome in accordance with the six-step process set out in the EDPB’s Measures that supplement transfer tools (Recommendations 01/2020):

Step 1: Map your data flow, i.e. the scope and categories of personal data to be transferred, the data subjects concerned, and the purposes for which the data is being transferred.

Step 2: Identify your transfer tool, which will usually be SCCs but could be for example Binding Corporate Rules (BCRs).

Step 3: Assess the laws of the third country for the purpose of identifying any respects in which those laws may not permit the data importer to comply with its obligations under the SCCs (or other transfer tool), and therefore not provide protection which is essentially equivalent to that provided by EU law. The EDPB’s European Essential Guarantees (Recommendations 02/2020) sets out the minimum standards by which the third country’s laws can be assessed.

Step 4: Identify appropriate supplementary measures to remedy any shortcomings disclosed by the assessment in Step 3. Supplementary measures may contractual, technical or organisational in nature.

Step 5: Implement your supplementary measures.

Step 6: Re-evaluate your assessment at appropriate intervals.

Also, note that the TIA must be properly documented, and include appropriate supporting documentation such as data mapping records and legal opinions from local counsel. And if the TIA discloses the existence of local laws which impinge on the effectiveness of the SCCs (or other transfer tool), and no supplementary measures are available to mitigate the risk, then the transfer cannot proceed/must be suspended immediately.

Reaction to the brave new, post-Schrems II world of data transfers has been mixed… Ensuring EU-standard privacy protection for data that is transferred outside the EEA is of course commendable, at least in principle. But requiring all businesses to not only put in place comprehensive contractual protections (e.g by way of SCCs) but also to carry out a time consuming, technically difficult and potentially very costly TIA for each type of transfer is arguably so onerous that many businesses, particularly SMEs, will take a risk-based view and simply dispense with the TIA. Other businesses may take the view that exporting data outside the EEA is simply too difficult, and replace its existing service providers with EEA-based providers.

The European Commission (EC) is of course aware of the difficulties that Schrems II has created for EEA organisations, including those which already have established global data sharing networks, and those looking to transfer data to non-EEA service providers for which are no equivalents available in the EEA. But while we wait for the EC to come up with some more workable alternative options, businesses which are exporting, or looking to export, personal data to third countries may now want to start:

Looking at their data flows to non-EEA countries, and considering whether any personal data (and especially special category data) can be removed from the data export.
Setting up a TIA process, supported by appropriate documentation.
Developing a toolbox of risk mitigating measures, such as data encryption/pseudonymisation, privacy-friendly data sharing procedures etc.

Tags: adequacy, data transfer, gdpr, tia, transfer impact assessment
Posted in Privacy, Updates | No Comments »

Next Page »« Previous Page

Archive for the ‘Updates’ Category

What’s happening with SCCs? – Part 2

UKJT’s Digital Dispute Resolution Rules

Overview of the European Commission’s proposed AI regulation

Who owns the copyright in software created by your employees?

Search

Recent posts

Get in touch