Hello and welcome to this episode of our series on data protection and pensions brought to you by the Pensions team at Gowling WLG.
I am Ian Chapman-Curry and I have been dealing with all things data as the pensions industry gets ready to comply with the GDPR.
As always, you can get more information on this and all our other pension insights at gowlingwlg.com/pensions-uk.
In this episode we will be looking at the new data protection regime that will apply in the UK from 25 May 2018.
This is the first in a new series of podcasts and webinars aimed at getting you ready for changes to the UK's data protection regime.
This episode is going to look at an overview of what we have learnt so far around the changing data protection laws.
On 25 May 2018 the General Data Protection Regulation or "GDPR" goes into effect in all member states of the European Union including the United Kingdom.
The GDPR is going to apply to trustees.
Pension scheme trustees are typically data controllers in respect of a scheme's personal data.
Pension schemes have plenty of personal data and they also process sensitive personal data so the new regime is going to have some effect.
Another key point focuses on the new legal duties and the higher fines.
The GDPR applies a range of legal duties on both data controllers and for the first time, directly on data processors.
In addition, the maximum level of fines for data breaches are materially higher.
Finally, a key point for this episode is that trustees will have to take action.
As data controllers trustees will need to take action to ensure that they can comply with the GDPR.
This will include making important decisions relating to data protection.
So what is the new data protection law?
The new data protection law is the General Data Protection Regulation, the GDPR.
As an EU Regulation it will apply directly in all of the EU's member states.
The GDPR will replace the current Member Data Protection regime under the EU's Data Protection Directive 1995.
The Data Protection Directive 1995 was brought into effect in the UK by the Data Protection Act 1998.
So when will the law on data protection change?
The GDPR goes into effect in all EU member states including the UK on 25 May 2018.
The UK will also have new domestic legislation in a new data protection act.
The Data Protection Bill 2017 to 2019 is currently passing through Parliament.
What are the biggest headline changes under the new data protection regime?
There are really two key changes that will transform how people think about data protection.
The first is that data processors will for the first time have direct legal duties under data protection legislation.
Under the Data Protection Act 1998 only data controllers owed direct legal duties.
Under the GDPR data processors will also have direct legal duties.
In a pensions context this means that service providers such as administers and professional advisors such as investment consultants
are likely to press for more comprehensive coverage of data protection issues in contracts
and push for stricter delineation of roles, responsibilities and liabilities in these agreements.
The second point is that fines will be materially higher.
Under the Data Protection Act 1998 the maximum fine for a serious breach of data protection law is currently £500,000.
Under the GDPR the maximum fine will, depending on the type of breach, be either the higher of €20 million
or 4% of the global turnover of the undertaking
or the higher of €10 million or 2% of the global turnover of the undertaking for less material breaches.
Most of the obligations under the GDPR will fall under at least one of these two sets of fines.
In the pensions industry this means that data protection issues will be far more central to negotiations on contracts
and are likely to feature far more prominently on everyone's' list of priorities.
In addition it is likely that employers will be more concerned to ensure that trustees are complying with their data protection obligations.
So what are the data protection principles under the GDPR?
The Data Protection Act 1998 set out eight data protection principles that guided the legislation and the regulatory regime.
This approach has been followed in the GDPR.
There are six principles set out in the GDPR along with an additional overriding principle of accountability that applies to all aspects of the regime.
So let us just take a moment and go through the six principles as they are set out in the GDPR.
The first one is that the processing would be lawful, fair and transparent.
The second principle is around purpose limitation, so not going beyond the initial purpose for having obtained and processed the data.
The third principle is around data minimisation.
You do not necessarily need 30 strands of information to sign up to receive email news alerts from your favourite band or to sign up for offer codes for retailers.
Similarly it might be appropriate to have a whole range of important information
if you are signing up to something as important as a passport or drivers' licence.
The fourth point is a really key one especially in pensions and it looks at the accuracy of the data.
So the data controller having a duty to ensure the information is accurate and kept up to date
and that really chimes with TPR's messages on the accuracy of record keeping
and being able to ensure good member outcomes by having a focus on record keeping in pension schemes.
The fifth principle is around storage limitation and this one is a bit of an issue for pension schemes.
Pension schemes and their advisors have traditionally been keen to hold on to member's data for as long as possible
with an eye to the fact that pension schemes provide long term benefits which should last decades into the future.
So there is a real tension there between keeping good records and archives and not straying so far that you breach this principle.
The final of the six principles is on integrity and confidentiality and this is the real data security and cyber security point
that there will be data processed in a way that can ensure that it is kept safe and secure
and that the personal information that is processed will be kept confidential.
And it is not just electronic systems, we will also be looking here at physical storage of information, printing off papers, keeping them in briefcases,
it is important not to overlook paper copies of documents.
And then finally we have the overriding principle of accountability.
In plain English the principles can be understood as requiring that when the personal data is processed
the person doing that processing or the data controller who is responsible for the processing, is accountable.
They know what they are processing, they know why they are processing it, they have told the individuals whose personal data they process,
they have records, they have maintained records of decisions that they have taken, they have thought about it,
they have evidence, what some people are calling a paper shield if regulators ever do come
and want to know what the data controller has done on data protection.
So why is there also a Data Protection Bill in the UK?
The Government has brought a new Data Protection Bill before Parliament and this is not intended to duplicate or transpose the provisions of the GDPR into UK law.
Instead, the Data Protection Act 2018 as it will become is intended to extend the scope of the GDPR,
so the GDPR sets out a general albeit quite detailed framework but it does still member states or further EU legislation to provide a comprehensive data protection framework.
The UK's Data Protection Bill will provide the UK member state legislation to ensure that the GDPR works in the UK context.
It is also designed to fill in some of the gaps in the GDPR with UK legislation.
The GDPR is a framework and principle based piece of legislation for an EU wide data protection regime but more detailed provisions,
or country specific provisions are then expected to be set out in follow-on member state legislation.
In the UK the Data Protection Bill is providing this additional legislation and is going to help ensure that the GDPR works as intended.
The third point is that the Data Protection Bill when it becomes law is aiming at setting higher standards in respect of control over personal data
and this was part of the Conservative Party's election manifesto in the run up to the general election held in June 2017.
The Government is therefore committed to give people more control over the use of their data and providing new rights to move or delete personal data.
These will go over and above what is required in the GDPR.
Fourthly, the Data Protection Bill will preserve, where possible, the tailored exemptions under the current data protection regime.
The Data Protection Act 1998 contains a whole series of exemptions which help UK businesses, researchers, financial services, journalists and lawyers do their business.
The Data Protection Bill seeks, as far as possible, to retain these exemptions and provide continuity for anyone engaged in these areas in the UK.
And finally, the Data Protection Bill will seek to repeal the Data Protection Act 1998.
It is important to note some things that the Data Protection Bill is not seeking to do.
The Data Protection Bill does not transpose the GDPR into UK legislation; this will be achieved by the European Union Withdrawal Bill.
The Government and the ICO have however confirmed that the UK's data protection regime will not be materially changed as a result of the UK's withdrawal from the EU.
So why is data protection relevant to pension scheme trustees?
The GDPR's main focus is to regulate the processing of personal data.
Pension scheme trustees need to process personal data for a whole number of reasons
including administering their schemes in line with the scheme's governing documentation,
paying the correct pension benefits to the right people at the right time and exercising discretion
and taking decisions in line with the scheme's governing documents and their duties under trust law.
Trustees will usually be data controllers in respect of their scheme's personal data.
Under the GDPR data controllers are required to process personal data in line with the data protection principles and comply with a range of specific legal requirements.
So, what are the main things that pension scheme trustees will have to do next?
The GDPR encourages data controllers to put in place data protection by design and data protection by default.
In practice this means that data controllers such as trustees will need to think about the policies,
processes and procedures that they have in place and ensure that they reflect the new data protection principles.
Trustees should consider the following key issues.
Understanding your scheme's data and your legal obligations.
Pension scheme data is usually held on paper files and/or computer systems.
This data is often shared with third party service providers.
As data controllers trustees will need to understand what personal and sensitive personal data the scheme and any third parties hold, use and share.
As a data controller trustees will be expected to understand their legal duties and demonstrate how they have complied.
Third party service providers are key to the administration and running of many pension schemes.
Trustees need to understand and review how the scheme's administrators, actuaries, lawyers and other advisors use the scheme's data.
They will also need to review and possibly renegotiate the contractual terms that are in place with any third parties.
Trustees are also going to have to make decisions on a range of issues relating to data protection.
One of the most important decisions will be to agree the legal basis upon which the trustees process the scheme's personal and sensitive personal data.
Trustees will also have to record these decisions in order to demonstrate accountability.
The GDPR has specific requirements for data controllers to communicate with individuals whose data they are processing.
Data controllers communicate with data subjects by issuing data protection notices.
Data controllers are required to give certain information to individuals about how and why their personal data is used.
This is usually done by issuing what is called a data protection notice but it might also be referred to as a fair use notice or a privacy notice.
Under the GDPR data protection notices need to be more detailed and specific than under the current data protection legislation.
Trustees are also going to have to have a look at the scheme's policies and procedures.
Data controllers will need to ensure that they have put in place appropriate, technical
and organisational measures to ensure that the trustee can comply with the GDPR and ensure the security of individual's data.
This means understanding and reviewing how the scheme and any third parties store, secure, share, back-up and monitor personal data.
Data controllers will also have to demonstrate how they have complied.
A compliance record can help with focusing on the key tasks managing the compliance project and documenting the steps taken.
And if that has whet your appetite for all things data protection, do not forget, there is far more information available at gowlingwlg.com.
We have made all of these episodes available to read, watch or listen to whenever you want.
Please do share them with anyone who is dealing with data protection issues.
Thanks for making the time to join us.
I hope you can join us for another episode of Gowling WLG's Data Protection and Pension series soon.