Social Events & Meetings
GDPR - WHAT NOW?
|
Writing this article in the first few weeks of the GDPR era, it is clear that the 25 May start date was just a milestone and that data protection will be a topic we must continue to focus on in the weeks and months ahead. I am already hearing anecdotes about subject access requests being made on 25 May in reliance on the improved rights which have been granted to data subjects. It is clear that this is a significant change in the way things are and for us, as lawyers, the consequences include even more scrutiny of our systems, processes and responses. |
 |
I would hope and anticipate that the Information Commissioner’s Office’s attention will be concentrated on the big guns – the online companies and the large-scale data processors – but we are nevertheless in the spotlight. We know that the ICO was expressing opinions about our handling of personal data long before GDPR was on the agenda. It is unlikely we will be forgotten in this new age of data protection.
Think back to 2014 if you will. The ICO published a notice directed at the legal profession. In it, the incumbent Commissioner reported that he was disturbed by the number of breach reports the ICO had received about the handling of data by barristers and solicitors. He had received reports of 15 data breaches in 3 months and had concerns about the serious personal data we processed and our over reliance on paper files. The warning was concluded in this way: “It is important that we sound the alarm at an early stage to make sure this problem is addressed before a barrister or solicitor is left counting the financial and reputational damage of a serious breach”. At first glance, this may appear to be a helpful ‘heads up”, but the body which can instigate the financial and reputational damage is the body which was issuing the warning! You’ll understand my unease.
Having said that, I am nevertheless confident that working in the legal services profession, we have a head start when considering the ways to respond to GDPR. After all, if there is one thing we know about, it’s confidentiality. Our clients expect us to keep the matters secret and most solicitors and most law firms have designed processes to manage the risk of inadvertent disclosure. This is a solid foundation stone on which to develop the GDPR response. My overriding message to the firms I have been working with over the last few months is not to panic about all of this. Another confidence-booster ought to be the familiarity of oversight and the understanding of the need to be able to have good conversations with stakeholders who have a right to be interested in what we do and how we do it. This is what we already experience with our relationship with the SRA.
So, whilst there is no need to panic, there is the need to make sure that answers to the GDPR questions are in your compliance response. Most of you will have revised and/or drafted new processes by now and, hopefully, rolled these out with suitable training within your firms. What’s next, in this honeymoon period with the new legislation?
My compliance response in the next few months would be as follows:
- Keep a watching brief on the guidance issued by both the ICO and from within our own industry. This has been a learning curve for all, including the thought leaders and their thinking is filtering down to us in a fragmentary fashion. The ICO publishes a monthly online newsletter. Subscribing to this (via the ICO website, ico.org.uk) will give you the alerts about additions to guidance, trends in their supervisory work and similar. The Law Society has also published its own downloadable guide to GDPR, available from www.lawsociety.org.uk.
- Ensure the topic is constantly part of your internal communications with your colleagues. It’s essential that everyone understands the impact of misunderstandings. Remind them about the need to think beyond the duties owed to the clients of the firm; be clear about the scope of the data subject definition; be clear about what happens if they are talking to a third party which may fall into the category of a data processor; have confidence that they will have the correct conversations with data subjects; that they know who to discuss data subject requests and all other concerns with; and that anyone undertaking any form of marketing or publicity is responding to the GDPR implications safely.
- Ensure, therefore, that this topic is part of your induction exercises with new colleagues and that supervisors are considering this as part of their risk identification responsibilities.
- Keep a watching brief on the system adaptations and new processes that you have rolled out. Your objective in doing this work will have been to manage the risk of breaching the GDPR data protection principles. Do your processes help with this?
- Finally, if you are one of those firms for whom this topic has highlighted storage and destruction pinch points, think about a project to tackle archived files and historic computer-based records. Also, now seems a good time to look again at file closure processes and ensure that the data you retain at this end of your relationship with your clients and other data subjects is not inconsistent with your GDPR policies.
Tracey Calvert, 14 June 2018
Oakalls Consultancy Limited
tcalvert@oakallsconsultancy.co.uk
Tracey Calvert is a lawyer who has worked as a senior ethics adviser with the Law Society and the SRA, and was part of the SRA policy team which drafted the SRA Handbook which was launched in 2011. She now provides compliance and ethics services to lawyers and others through her company, Oakalls Consultancy Limited, and also writes extensively on these topics. For further information about the services which Tracey can provide, please see her website, www.oakallsconsultancy.co.uk, or contact her by email or phone, tracey@oakalls.com, 07833 253057
Like Back to Top Seen 442 times Liked 0 times
Subscribe to Updates
If you enjoyed this, why not subscribe to free email updates and join over 1275 subscribers today!
Subscribe to updates
Alternatively, you can subscribe via RSS 
All email subscriptions must be confirmed to comply with GDPR.
Related Posts
04th July 2018 | July 2018
Two months in and what has the President been up to? In summary: one conference, one County Societies Group (CSG) meeting, one Parliamentary visit, four meetings relating to DASLS Awards, one Twin Bars meeting, one Sunday Legal Service, three formal dinners, one 10 kilometre walk, one Sub-Committee and one main Committee meeting. The conference was for Presidents and Honorary Secretaries and meant that, for the first time, I made it over the threshold of 113 Chancery Lane. The Friday was particularly busy, starting with the CSG Meeting at which Fraser Whitehead, Chair of the Council Membership Committee outlined the thoughts of his committee on the reform of The Law Society Council. Between addresses and debates, there were workshops to attend as well before the black tie dinner in the Common Room that evening. L-R DASLS President Stephen Mahoney, Law Society President Joe Egan, with CEO Paul Tennant and DASLS Hon Secretary Chris Hart I was back in London a few days later with several other DASLS Solicitors for a tea time meeting kindly sponsored by Kevin Foster, MP for Torbay. We were, for the first time, joined by representatives from our CSG colleagues from Kent, Leicestershire and Surrey. This enlarged deputation certainly grabbed the attention of MPs and Lords alike. The Lord Chancellor David Gauke attended and spoke early on. Then the Chair of the Justice Select Committee Bob Neill responded supportively on the subject of the reinstatement of legal aid for early advice in housing law and family law cases, one of the topics I highlighted in my speech. Kevin Foster, himself a former criminal litigator, also spoke recognising the looming crisis in the criminal legal aid system, brought about by cuts in legal aid rates, the resulting low numbers of duty solicitors, ageing community of criminal law specialists and few young solicitors choosing the specialism. Reception at Westminster on 15 May 2018 The good news to come out of the meetings about our Legal Awards is that DASLS has a new partner for the 2019 Awards and beyond in the shape of Grow Marketing. Based in Exeter, launched last year but with a wealth of experience amongst their staff of working for national news media groups, Grow have impressed us with their energy and enthusiasm. A shining example of this is Alice Bryan. Having previously worked for DC Media and Trinity Mirror, our partners for the past three years, Alice has been involved in the detailed planning and delivery of the Awards since their inception. To say that she is excited to be working with DASLS again is an understatement. On the international front, I was pleased to represent DASLS at the Twin Bars meeting hosted by the Young Bar of Leuven which was also attended by representatives from Bilbao, Erlangen, Gdańsk and Rennes. I was accompanied by trainee solicitor Lucy Ferrat who did sterling work researching the case study on criminal litigation prepared by Leuven and then assisting me on the day with the presentation itself. Lucy being a fluent French speaker was even more of an asset as she and the lawyers from Rennes got on like a house on fire. Much better than my stumbling efforts to recall my O Level French. Lucy Ferrat with Stephen Mahoney Within a couple of weeks it was DASLS’ turn to play host to our European colleagues for the Exeter Sunday Legal Service. The Saturday evening dinner and Sunday procession and service itself were attended by lawyers from Bilbao, Erlangen, Gdańsk, Leuven, Rotterdam and Verona. It was a privilege to also welcome the new President of the Federation of European Bars, Michele Lucherini and his wife Barbara, as well as immediate past President Prof. Sara Chandler QC (Hon) and her husband José. This year’s procession was between the Royal Albert Memorial Museum and the Cathedral, a longer route than last ye...
04th July 2018 | July 2018
We are excited to announce our partnership with Grow Marketing to deliver the Legal Awards Dinner to be held on Thursday 4 April 2019. http://www.daslslegalawards.co.uk/ ...
06th March 2020 | March 2020
Dear All, This year really is flying by. I have just had my birthday. After updating you previously on the excellent catch up I had with the Law Society CEO Paul Tennant on his visit to the south west last November, I had not expected to be back in touch with him quite so soon. Sadly, this time it was in less happy circumstances. I was, like many of you, shocked and saddened in January to hear the news and see the pictures of the substantial fire at Chancery Lane in London. I have emailed Paul Tennant and James Shepherd, our Law Society Relationship Management Executive, to send our best wishes and we are hoping that the building will be back to full use very soon. As I write this report, preparations are in full swing for the 2020 DASLS Legal Awards & Dinner. As you know the Annual Dinner is being held again this year at Exeter Cathedral. The event is to take place on the 30th April 2020. After the success of last year, we are hoping that once again the event is sold out which would mean we will have around 480 people attending. If you have not done so already, please contact Llew Nicholls and the team at our Awards partners ‘Grow Marketing’ who have worked very hard alongside our very own Tony and Monique to achieve full sponsorship of this event. You can contact Llew to book the remaining places by emailing Llew directly at Llew@growmarketinguk.com. There have been more nominations than ever before with more entries making the short list. Please do not miss this dazzling occasion. You will all have received DASLS latest 2020 training courses programme. Tony Steiner and the team have worked hard to arrange these events. You will see that as members you get preferential rates and if appropriate reduced rates for multiple attendees from your firms. Please take advantage of these services as a proportion of the monies do go to support our Society’s broad continuing education offering. If I do not see you individually before I look forward to catching up with you at the 2020 DASLS Legal Awards and Annual Dinner in April. With very best wishes Nigel Lyons President 2019-2020...
06th March 2020 | March 2020
New AML Regulations and the pursuit of the beneficial owner. Introduction The new Money Laundering & Terrorist Finance (Amendment) Regulations 2019 which came into force on 10 January have modified a number of aspects of the 2017 AML Regulations, with which we have been complying for some time. However, many firms’ procedures hark back to the earlier days of the 2007 Regulations and have not been modified or updated much over recent years. This article seeks to set out what the new Regulations in fact require, and the steps we should be taking in relevant cases. The Policy It has been true for some time that the ultimate aim of all the regulatory rules is transparency – it has always been the case that the use of artificial structures such as trusts, companies, bearer shares, foundations and charities – whilst perfectly legal – have to some extent also benefitted from the extra anonymity they offer to the true owner and recipient of the funds and services we provide. If we offer services to these types of entity, the Regulations require us to go some way to identifying the individuals who are actually benefitting from our services, and this entails uncovering the true ownership of the organisation. Whilst this would be difficult in many instances – Cayman Island companies with bearer shares, for example – we must nevertheless attempt to get some assurances from the creators of the companies, accountants or registrars as to the ownership of the shares, and have some way of being notified of any change in ownership. We also need to be aware of the PEP and Sanctions status of these individuals. Further, for UK companies, the PSC Regulations 2016 impose an exactly similar obligation on the companies themselves to identify their beneficial owners and notify Companies House of any shareholder with 25% or more of the shares or exercising control over management of the business. The Regulations The Regulations provide that we must, as part of our CDD procedures Identify the client – this means coming to know who they are, by name and some other characteristic, e.g. address, date of birth, date of incorporation Verify that identity – by means of reliable and independent data and documentation Identify the beneficial owner (if the client is an entity) – though not necessarily verifying that identity Identify and verify the identity of the person actually instructing us (if not already done). What this means for us When acting for a COMPANY (that is not a listed company) the Regulations require us to obtain Details of the company as registered (which must be proven by a copy of the register entries available from Companies House or equivalent registry) – name, number, registered office address, principal place of business the law to which it is subject details of its governing documentation (its memorandum) names of the directors. Names of any beneficial owners, and the identity of any individual owners of legal entities which own the client Names and verification of the persons instructing us on behalf of the company, and their authority to do so. Note that we cannot rely on the information provided by the company under the PSC Regulations but we must undertake our own research in order to fulfil our CDD duties. Further, if as part of that research, we discover that the Companies House data on PSC’s is incorrect, then we are now under a further obligation to notify the Registrar of Companies of this fact. We also need to establish that PEPs and Sanctions checks are also undertaken. If genuinely positive entries are revealed in response we should undertake enhanced CDD steps or cease to act, accordingly. Electronic searches are a permissible avenue to use provided the search provider can offer us the necessary assurances that the person actually claiming an identity is IN FACT that person. Check also whether ...
