The impact of a no-deal Brexit on data protection

By Cynthia O’Donoghue and Karen Lee Lust on 27 September 2018 Posted in Privacy & Data Protection

The government has published guidance for UK organisations on transfers of personal data in the event of a so-called no-deal Brexit. In particular, the guidance sets out actions for UK organisations to take to enable the continued flow of personal data between the UK and the European Union (EU) in such an event.

While emphasising the fact that a no-deal Brexit is “unlikely”, the guidance notes that it is important to prepare for all eventualities.

The guidance forms part of the government’s series of notices on a no-deal Brexit, aimed at businesses and citizens.

The current position

The UK has a comprehensive data protection framework, consisting of the Data Protection Act 2018, which is a UK-specific law, and the General Data Protection Regulation (GDPR), which applies across the EU Member States.

The GDPR does not restrict transfers of personal data within the EU. Transfers can also be made outside of the EU if there is an appropriate legal basis for doing so.

Southeast Asian nations to form regional framework for cybersecurity cooperation

By Charmian Aw and Xiaoyan Zhang on 26 September 2018 Posted in Regulatory

The Association of Southeast Asian Nations (ASEAN) announced last week that it will create a rules-based framework for its 10 member states to cooperate on cybersecurity matters.

The 10 ASEAN members are Singapore (which is the chair for ASEAN this year), Malaysia, Indonesia, the Philippines, Thailand, Vietnam, Brunei, Myanmar, Laos and Cambodia.

Singapore is expected to take the lead in drawing up a mechanism that facilitates cross-country collaboration on cyber policy development, capacity building and operational issues. ASEAN recognized that such a system would need to be flexible and take into account the economic considerations of the different member states.

Although the framework is still in an early phase of development, greater cross-border cooperation will likely take place among regulatory authorities in the various ASEAN members, as well as the introduction of more cybersecurity laws at a national level. Continue Reading

ECJ ruling on fairness of disproportionately high default interest rate in consumer loan agreements

By Cynthia O’Donoghue and Eleanor Brooks on 21 September 2018 Posted in In the Courts

In the joined cases of Banco Santander SA v. Demba and another (Case C-96/16) and Cortes v. Banco de Sabadell SA (Case C-94/17), the European Court of Justice (ECJ) considered the application of the Unfair Contract Terms Directive (Directive) in two joined cases concerning the rate of default interest in consumer loan agreements, which were referred by the Spanish courts.

The Unfair Contract Terms Directive

The Directive protects consumers from unfair terms included in contracts. In Spain, the Directive is implemented into national law via the LGDCU (Ley General para la Defensa de los Consumidores y Usuarios y otras leyes complementarias (Royal Legislative Decree 1/2007)). The LGDCU provides that the test of fairness can be applied to all terms not individually negotiated and all practices not expressly agreed. A term may be deemed unfair if it causes a significant imbalance in the parties’ rights and obligations arising under the contract, to the detriment of the consumer.

Facts of the cases

The ECJ was asked to provide a preliminary ruling on certain questions referred by the Spanish courts in two joined cases:

(i) In the first case, the default interest rates on unsecured loan agreements (concluded between individual borrowers and Banco Santander) were 18.50 per cent and 23.70 per cent, compared to ordinary interest rates of 8.50 per cent and 11.20 per cent, respectively. After the borrower’s defaulted, the bank sought enforcement of its claim by assigning its debt to a third party in accordance with Spanish law.

(ii) In the second case, an individual’s mortgage loan agreement with a bank provided an ordinary interest rate of 5.5 per cent per annum, which was subject to change after the first year, and which was 4.75 per cent at the time of the main proceedings. The default interest rate was 25 per cent per annum. The consumer argued that this was unfair.

UK Code of Conduct for data-driven health and care technology

By Cynthia O’Donoghue and John O'Brien on 21 September 2018 Posted in Tech & Outsourcing

Earlier this month, the UK Department of Health and Social Care published an initial Code of Conduct for data-driven health and care technology. The code builds on the Department for Digital, Culture, Media and Sport’s Data Ethics Framework.

The code encourages the United Kingdom’s health and care system to form partnerships with suppliers of data-driven technologies, in order to deliver improved health care and position the United Kingdom as a “great place to do business on technology”.

Four key group stakeholders are identified by the code: patients and citizens, health and care professionals, commissioners, and innovators. The code aims to meet the “most important need” for each of these groups, which consist of those experiencing improved care, those delivering better care, those providing services that better meet users’ needs, and those working to make the United Kingdom become a centre for innovation.

The UK responds to NISD consultation

By Cynthia O’Donoghue and Curtis McCluskey on 6 September 2018 Posted in Privacy & Data Protection

The government has published its response to the April 2018 targeted consultation on the Security of Network and Information Systems Directive (NISD). The targeted consultation specifically addressed how NISD will apply to Digital Service Providers (DSPs) in the UK, focusing on the identification of DSPs, security measures and further guidance. This follows the government’s public consultation in August 2017 – see our recent blog on this here.

The targeted consultation received 12 responses that largely showed support for the government’s overall approach. Concerns were expressed, however, regarding the uncertainty over who falls within NISD’s scope and the subject of costs recovery.

As the Network and Information System Regulations 2018 (the NIS Regulations) are already in force, the targeted consultation process will be used to assist the Information Commissioner’s Office (ICO) in providing updated guidance to DSPs. The government’s response, therefore, provides a useful insight into the future guidance on this topic, which will directly affect the regulation of DSPs in the UK.