Click the following link to bring up a new window with an automated collection of images related to the term: Symptomlessness Images
Today is the day! Companies around the world have had two years to prepare for implementation of the General Data Protection Regulation, the comprehensive legal regime with the self-stated goal of putting the European Union at the forefront of safeguarding individuals’ data privacy rights. Well, now that GDPR is finally in effect, we can safely assume that every company that may be impacted by it has performed a full analysis of applicability and has a complete grasp of all 99 of its Articles…right?
For all of the buzz and media coverage of GDPR, business leaders can be forgiven if they’ve missed or misunderstood some of the finer points embedded within the voluminous text of the regulation. Even the guidance issued by regulatory bodies like the EU Commission, Article 29 Working Party, and UK Information Commissioner’s Office acknowledge that there is ambiguity in some of the provisions of GDPR. Of course, it goes without saying that it’s better not to be surprised by GDPR’s various requirements and exceptions, so here are five aspects of GDPR that every corporate data steward should keep in mind:
Consent is not the only “lawful basis” for processing data. There’s been some panic around the idea that consumers can revoke consent for the use of their data, throwing millions or billions of dollars worth of transactions into jeopardy and causing administrative headaches. But, in accordance with Article 6(1)(b), when data is necessary for the performance of a contract, a consumer can’t force a business to stop using that data as long as the contract is in force. That contract can be formed as simply as a consumer clicking “I agree” on an online vendor’s terms of use when purchasing a product or subscribing to a service. In such a case, a consumer who agrees to purchase a product or service from that vendor and provides her credit card information can’t then demand that the vendor erase that data before the sale has been processed.
The right to be forgotten is not absolute. As with consent, the right to erasure has emerged as a bogeyman of sorts for companies concerned with maintaining access to data critical to their businesses. Some may worry that GDPR will force them to delete all of an individual’s data immediately once such a request is made. In reality, Article 17 of GDPR states that immediate erasure is required only on certain grounds, such as when the data is no longer necessary for the purposes for which it was collected or if it was collected unlawfully in the first place. GDPR also allows important exceptions to the right of erasure. Among them: when EU member state laws specify the retention of data to meet legal obligations, and when data processing is necessary for the sake of freedom of expression — for instance, newsworthy information published by a journalistic outfit.
There’s a difference between legal representatives and data protection officers (DPOs). GDPR creates a need for new roles inside and outside organizations, and there’s been some confusion as to whether two of these roles are one in the same: legal representatives and data protection officers. In fact, these roles are distinct. Here’s a quick breakdown:Data protection officers are required under Article 37 for certain companies that monitor individuals on a large scale or perform large-scale processing of certain categories of data. A DPO is an individual that can be a company employee or an external professional and is charged with essentially functioning as a watchdog: he or she reports to the highest levels of the company and conducts internal investigations when concerns or complaints arise about how the company manages data. The DPO is charged with remaining independent of the company when investigating these complaints and cannot be fired by companies in retaliation for performing his or her duties.Legal representatives are required under Article 27 for certain companies based outside the EU that process data subject to GDPR. These representatives, which may be individuals or separate entities, act as liaisons to data protection authorities. When a European regulator wants to get in touch with a company about a data breach or other issue, they call the representative. That representative, as the name suggests, is charged with representing the interests of the company.Both roles require a thorough understanding of a company’s data practices, but the key duties of each differ and, ideally, should be fulfilled by different people/entities, to prevent a conflict of interest.
Rules governing data portability may create uneasy cooperation between competitors. Under Article 20, companies must provide a person his or her personal data in a structured, commonly used, machine-readable format so long as the data processing was automated in the first place. At the person’s request, a company must also transmit the data to another company, meaning that a consumer could conceivably ask a business to transfer his or her data to a competitor. For instance, a person using a wearable fitness tracker could decide to switch to a different product and essentially order wearable vendor A to provide information on the person’s heart rate patterns, sleep cycles, and more to wearable vendor B. Where the hassle of transferring data may have previously made a customer hesitate to switch products or vendors, now switching may be more seamless than ever. While that may be welcome news for consumers, businesses should be aware of the potential impact to their bottom line.
Specific employee data privacy rules may apply. GDPR applies to both a company’s individual customers and its employees. But for EU-based companies, GDPR is just a baseline for employee data privacy protections — Article 88 permits individual member states to set their own, more far-reaching rules governing employee data privacy (such as the employment-specific rules in Germany’s Federal Data Protection Act).For companies with no offices or employees in the EU and not offering goods or services to the EU, complying with the employee data privacy rules of GDPR isn’t something they typically have to worry about… . . . unless those employees travel to the EU. Here’s where it gets tricky: If a company is collecting data on the behavior (e.g., location) of its employees while those employees happen to be visiting EU member states, the processing of that particular data is arguably subject to GDPR under Article 3(2)(b). How closely regulators will be holding non-EU businesses accountable for following GDPR in such specialized cases is not completely clear, but being aware of this issue could be worthwhile for companies with employees who frequently travel to Europe.
With a better understanding of GDPR, businesses have the opportunity to focus their attention on issues that matter most and proactively address complications before they evolve into real problems.
Proposed Supervision Framework and Publishing Principles for FCAC Decisions Released for Consultation - Lexology
Proposed Supervision Framework and Publishing Principles for FCAC Decisions Released for Consultation
The Financial Consumer Agency of Canada (FCAC) recently published the following two documents for comment: Proposed Supervision Framework and Publishing Principles for FCAC Decisions (Consultation). The consultation period runs until November 14, 2016, and written comments can be submitted here.
The FCAC last updated its Compliance Framework in 2011 (2011 Compliance Framework) and the current Consultation aims to address the expansion of FCAC’s mandate since that period to “new types of regulated entities and new activities”, as well as its increasing focus on “proactive and risk-based supervision”. This Consultation is part of a larger modernization process that Canada’s Department of Finance has begun in order to address the evolving nature of the financial services sector (see our August 2016 Blakes Bulletin: Canada’s Financial Sector: Legislation for the Future).
The Consultation documents differ from the 2011 Compliance Framework and the previous Publishing Principles in several respects and this bulletin highlights some key points for regulated entities.
The Proposed Supervision Framework outlines the FCAC’s general approach to supervising and monitoring federally regulated financial institutions, external complaints bodies and payment card network operators (regulated entities) and describes “the principles and processes FCAC uses to supervise the market conduct of federally regulated financial entities and to ensure that financial consumers an​d merchants continue to benefit from the applicable protections”.
Further initiatives to support the Proposed Supervision Framework (including additional guidance documents and redesigned internal processes) will be developed by the FCAC and phased-in over time.
The Proposed Supervision Framework states at the outset that all supervisory activities and decisions will be driven by the four guiding principles of transparency, proactivity, proportionality and accountability. The FCAC’s newly stated commitment to transparency and providing predictability for regulated entities marks a potential shift within the federal regulatory agency.
Additionally, the Proposed Supervision Framework sets out the FCAC’s three interdependent pillars of supervision of promoting responsible market conduct, monitoring market conduct, and enforcing market conduct obligations. The three pillars of supervision provide a clearer framework and improve upon the complicated flow chart previously provided under the 2011 Compliance Framework.
In line with its risk-based approach to supervision, the Proposed Supervision Framework puts forth a new two-tiered system for classifying regulated entities that will “guide the nature and intensity of FCAC’s supervisory interactions” with such entities. The FCAC had previously noted in its 2011 Compliance Framework that it utilized a risk assessment model to evaluate the relative levels of risk of regulated entities. The new two-tier classification system sets out how the risk assessments of regulated entities will impact their supervisory interactions with the FCAC.
Regulated entities will be classified as tier 1 if they present a “higher inherent risk of breaching their market conduct obligations, due principally to their business models and/or their product and service offerings”. The FCAC cites examples of tier 1 entities as those offering retail products and services to consumers, those whose participants offer payment services to merchants and those offering dispute resolution services to their member banks.
Tier 1 entities will be subject to the new monitoring tool of Market Conduct Profiling. Under this tool, the senior officer assigned to a tier 1 regulated entity will devise annual supervision plans and then compile and assess information on the entity focusing on factors such as the effectiveness of its oversight functions of compliance, risk management, internal audit, senior management and board of directors, and its history of investigations and breaches. The senior officer will then use the information collected to update the Market Conduct Profile, which will subsequently be shared, either individually or in aggregate, with FCAC senior management.
Tier 2 entities present a “lower inherent risk of breaching their market conduct obligations” and examples of tier 2 entities listed by the FCAC include entities that do not offer retail products and services or those whose businesses are restricted to the sale of insurance. Tier 2 entities are not typically assigned a senior officer, but will have access to a liaison officer to address questions. Monitoring of tier 2 entities will be less intensive and will be carried out through activities such as annual examinations.
The introduction of a rulings process has the potential to be one of the major improvements proposed by the new framework. The Proposed Supervision Framework states that a rulings process would “assist regulated entities in the interpretation of their market conduct obligations” by providing “direction to entities whose situations are substantially similar”. However, the FCAC also emphasizes that the rulings are case-specific and that rulings would “not restrict the FCAC in its approach to similar situations”. This language mirrors OSFI’s approach to rulings, which also states their rulings are not necessarily binding on their consideration of subsequent issues; while rulings are informative for situations with the same or similar facts, additional or different considerations may be raised in a different case.
The Proposed Supervision Framework does not currently included detailed information on how the rulings process would operate, but the introduction of a rulings process by the FCAC could allow regulated industries to gain clarification and guidance on FCAC expectations and interpretations.
Notices of Breach are a new enforcement tool introduced in the Proposed Supervision Framework in addition to Notices of Violation and Notices of Non-Compliance. A Notice of Breach may be issued following the investigation process and will be issued if the breach falls within one of the three levels outlined by the Proposed Supervision Framework:
Level 2 notices are issued if a regulated entity is “required to take specific action to address the breach”. Entities that are issued level 2 notices must enter into an action plan to correct the breach and recurrence of the breach could lead to an escalation in enforcement action.
Level 3 notices are issued when there is a heightened sense of urgency, the breach is a symptom of a broader compliance deficiency, the entity has demonstrated a low level of cooperation towards voluntary compliance or there is a specific need to escalate related concerns within the regulated entity. Entities issued level 3 notices will generally be required to enter into an action plan or compliance agreement.
FCAC’s principles with regard to publishing of Commissioner’s decisions were published on its website to provide guidance following the change in FCAC practice from publishing condensed summaries of decisions to publishing the decisions in their original form. The proposed new Publishing Principles clarify FCAC’s policies with respect to published decisions and make a new distinction between the publication of Notices of Violation and Notices of Decision and the publication of Notices of Non-Compliance.
Under the previous Publishing Principles, the FCAC had generally stated that it was “essential to preserve the factual circumstances and the legal requirements that feature in a decision”. The proposed Publishing Principles specify that when a regulated entity commits a violation, the FCAC “will always make public the nature of the violation and the [administrative monetary penalty] AMP imposed” once all the related proceedings are complete.
The proposed Publishing Principles includes references to the statutory discretion of the Commissioner to disclose the name of the regulated entity. If the Commissioner exercises its discretion not to disclose the name of the regulated entity, the FCAC will publish a redacted version of the Notice of Violation or Notice of Decision that omits the name of the regulated entity and the facts of the violation. Additional information may “be redacted on privacy or confidentiality grounds”. In cases where the Commissioner decides to release the name of the entity, the FCAC will publish the final copy of the Notice of Violation or Notice of Decision. The final copies of these decisions will include the facts of the violation; however some information may still be redacted where deemed necessary due to privacy or confidentiality concerns. In either case, the Commissioner may issue a press release.
The proposed Publishing Principles also stipulates that when a decision is redacted, the “FCAC will provide the regulated entity with advance notice of the redacted version before it is posted”. This documents the current practice.
If the FCAC issues a Notice of Non-Compliance to a regulated entity that breaches its obligations under a voluntary code of conduct or public commitment, the FCAC will publish this information anonymously and may redact information to protect the privacy of consumers or confidential or sensitive business information. The Commissioner may also issue a press release.
Similarly to Notice of Violations and Notices of Decision, the FCAC will provide the regulated entity with advance notice of the redacted Notice of Non-Compliance before it is published.