GDPR: What you need to know
From 25 May 2018 the Data Protection Act 1998 (DPA) will be replaced by The General Data Protection Regulation (GDPR), and it will bring important changes to the ways data is stored and processed by businesses. The introduction of GDPR is designed to set clear rules for businesses to follow when collecting and storing personal data, it also allows everyone to understand their rights in relation to the information held about them. The new regulation was created as a reaction to increased internet usage and sales of personal information, allowing consumers more power over their personal data.
The new law will bring data protection in the UK in line with the rest of the EU and nothing (not even Brexit) will stop it – So it is best to start preparing now! Your business must have strong policies in place to avoid scrutiny and potential fines. This article will highlight some of the key elements of the GDPR, and the best practice for companies.
What is meant by ‘Data’?
Data can be anything that can relate back to a single person, this includes name, address, fingerprints, DNA, recorded calls and date of birth. The laws relating to data protection have become much more stringent, and under the GDPR, all of this information will be covered and protected by the new regulation.
What are the new GDPR principles?
In essence the basic framework of the GDPR is very similar to that of the DPA, and the level of compliance correlates with the amount and type of data collected by your company. Meaning the more data collected and processed by your company – the more compliant you must be to the GDPR.
However, no matter the size of your company, you must still afford privacy protection, notification and consent and protect all information stored with a secure storage method. Due to the focus GDPR puts on protecting an individual’s rights about their data companies must be able to fully justify the legality of why they are collecting and storing the data.
Individuals now have complete control over their data
The GDPR regulations will allow individuals to have complete control over the data that is stored about them and companies must be able to, upon request, identify, retrieve and provide any data they have. It is worth noting that should anyone request data stored about them to be removed, the company has the responsibility to make this happen with immediate effect. Therefore, all businesses must implement an efficient process of doing so on demand, it is best to discuss the feasibility of any policy of implementing this with IT and call recording providers to ensure any claims can be fulfilled.
How can I ensure I am recording calls legally?
To ensure that any phone call that is being recorded is done so legally, you must comply to the following conditions:
1. Receive consent from the individual(s) in the phone call to record.
2. Justify the necessity of the recording, i.e. to fulfil a contract, or for legal requirements.
3. It is necessary to protect the interests of one or more participants.
4. The recording is in the public interest, or necessary for the exercise the official authority.
5. It is in the interest of the recorder, only overridden if they conflict with the interest of the participant of the call.
Should call recording be used to monitor customer service, the first condition must be followed to ensure compliance. However, this reason can be outweighed by the fifth policy, as it could be argued that quality assurance of staff is les important than the interest of privacy.
Under the DPA, when a recording takes place the individual must be informed of the purpose and how the information will be processed. If the participant continued the call consent was assumed, and this was acceptable and common practice. But, how does this change under the new regulation? The GDPR implements tighter regulations, meaning implied/assumed consent is no longer enough. There must be express consent given, either by recording verbal consent or having AI terminate the call if consent is not given.
Compliance
Under the ‘Principle of Accountability,’ all businesses should be able to actively display their compliance to the new rules and regulations. It is stressed by the GDPR that data protection systems must be implemented with immediate effect. Merely creating an extensive policy is not enough – you must be able to effectively display your staff and provider’s ability to fulfil the obligations. Having a realistic policy is the best policy as it will be easier to demonstrate should you need to prove fulfilment.
These are the steps you must complete to ensure any policy is effectively and efficiently implemented:
· Drafting policies and protocols
· Training staff to the new provisions and practices
· Careful implementation and management to ensure full compliance
Penalties
The new policies bring new punishments for lack of compliance. Under the DPA, organisations could be fined up to £500,000 should they deviate from the rules. Under the regulations of the GDPR fines can range from 2-4% of global turnover, depending on the severity of the case. These new fines are designed to deter non compliance and have a huge impact on those who do not follow the rules – So it is important to act now!
What should your lawyer do to help?
We believe that the best place to decide what improvements and changes need to be made you must have a full understanding of your business, its operations and what data you really need to be collecting. Any policy that is created should be bespoke on a client by client basis, decided by what can be realistically achieved by the company. Talking to your providers will also help you see whether you are compliant by the time GDPR comes into effect.
Karen Holden is Founder of A City Law Firm
