Global Data & Privacy Update - August 2017

Welcome to the August Global Data & Privacy Update. This update is dedicated to covering the latest legislative developments affecting the way data is managed and protected, as well as reporting on the most recent news governing data breaches and industry developments.

UK Government issues further information about the implementation of the GDPR

The Government has published a Statement of Intent, which sets out further information about how the General Data Protection Regulation (GDPR) and the accompanying Data Protection Law Enforcement Directive will be implemented.

The GDPR is immediately enforceable throughout the EU without the need for it to be transposed directly in to Member States' national law. It does, however, provide discretion over the application of certain provisions (derogations). The Government plans to pass a Data Protection Bill which will exercise the permitted derogations in the GDPR, repeal the Data Protection Act 1998 and implement into UK law the Data Protection Law Enforcement Directive.

Derogations

In the Government's Statement of Intent, the Government has not set out all of the derogations which it may make in the Data Protection Bill, however, it has published information relating to some of these exemptions:

The GDPR, without amendment, restricts the processing of criminal conviction and offence data to those authorised by law or under the control of official authority. The effect of this would be to severely restrict current private sector employers from being able to obtain details of criminal convictions and carry out criminal records check. The Government states that it plans to extend the right to process personal data on criminal convictions and offences under the GDPR to organisations not under the control of official authority. The GDPR provides individuals with the right not to be subject to automated decision making (including profiling). The UK government has decided to create an exemption to this right. It is not clear exactly what this will look like, except that the exemption will require a legitimate ground to do so and that the automated decision must not create legal effects without any human intervention. The age at which a person can consent to use of their personal data without parental or guardian approval will be set at 13 years old. Research organisations will not have to comply with data subject rights (such as to rectify data or restrict further processing) where this will seriously...