Emailed about DPA and contractual agreements
Dear Sir/Madam
Data protection and contractual arrangements
The Data Protection Act 2018 and UK GDPR (data protection legislation) imposes legal obligations on controllers and processors to formalise their working relationship, in line with the law and our requirements. This is to ensure the parties are clear about their role regarding compliance and protection of personal and special category data that is being processed.
West Northamptonshire Council (WNC) is undertaking a review of all contracts that involve the processing of personal and special category data as defined by articles 5 and 9 of the UK General Data Protection Regulation (UK GDPR). The purpose of this review is to demonstrate accountability and due diligence when engaging a data processor to work on behalf of WNC; and ensure that those organisations
are fully aware of their legal responsibilities when processing data.
Personal data may include sensitive special category data.
Examples of personal date may include and is not limited to the following identifiers:
Article 9 UK GDPR defines the special categories of personal data, that relate to sensitive personal information regarding an individual’s:
We take this opportunity to set out below the main areas of law which impact you as a data processor acting on our behalf.
The UK GDPR states that:
Processing must meet the requirements of the Regulation
Data processors are required to process personal and special category data in accordance with the data controller's instructions. It is in the interest of both parties to make sure their obligations are clearly set out.
Imposes restrictions on Sub-Contracting
UK GDPR gives data controllers a wide degree of control regarding the processor’s ability to sub-contract. Data processors require prior written consent from the data controller. The data processor is required to inform the data controller of any new sub-processors, giving the data controller time to object. If there is an objection, the sub-processing may not continue. The lead processor in a sub-contracting arrangement is required to reflect the same contractual obligations it has with the data controller, in a contract with any sub-processors. The data processor remains liable to the controller for the actions or inactions of any sub-processor (Article 28(4) UK GDPR).
Highlights the need for a Controller / Processor Contract
A contract is required where a data controller uses a data processor to process personal data, to bind the processor to the controller in respect of its processing activities (Article 28(3) UK GDPR).
There are several specific requirements including that the personal data is processed only on documented instructions from the controller, and requirements to assist the controller in complying with many of its obligations. The data processor has an obligation to tell the data controller if it believes an instruction to hand information to the data controller breaches the GDPR or any other law.
Imposes the need for security measures
Data controllers may only appoint data processors that provide sufficient guarantees over appropriate technical and organisational measures to ensure processing meets the requirements of UK GDPR.
Data processors are required to implement ‘appropriate’ security measures. What is ‘appropriate’ is assessed in terms of a variety of factors including the sensitivity of the data, the risks to individuals associated with any processing or breaches of security, the state of the currently available technologies, the costs of implementation and the nature of the processing. These measures might include pseudonymisation and encryption. Regular testing of the effectiveness of any security measures is also required where appropriate.
Has a breach notification requirement
Processors are required to notify the data controller of any breach without undue delay after becoming aware of it. This is to allow data controllers to assess the breach and notify the Information Commissioner’s Office within the 72-hour required timeframe.
Imposes rules around transfers to third countries
The data processor must exercise a degree of independence from the data controller when deciding whether it can transfer personal data to a third country. While
processors are required to follow the data controller's instructions, they may only transfer personal data to a third country (in the absence of an adequacy decision) if appropriate safeguards have been provided and data subjects have enforceable rights in that country with respect to the data.
We are therefore writing to you in relation to our respective contractual obligations to request:
Contracts must also include as a minimum the following terms. When amending terms, please ensure that thefollowing information is included:
In the interests of the parties concerned and our data subjects, we would like to ensure that contracts are appropriately varied, and our respective data protection obligations are clarified and adhered to. We please request that you promptly respond to this letter with either a variation or a new contract, which includes the UK GDPR data protection requirements.
If you do not have ready prepared documentation covering the above points and the contract is based on WNC’s terms and conditions, please complete and return the processing schedule template (Appendix A).
If the contract is based on your terms and conditions, please complete and return the processing guidance, questions and declaration form (Appendix .
Comments
-
I would wonder whether it's been sent out in error @smithers as it talks about the recipient as a "data processor" which I take to mean someone who handles the kind of personal data they've listed.
I think perhaps someone has pressed the "Send to All" button by mistake. I would contact your local council just to make sure this is the case, but from what I can tell I don't think it was intended for you.0 -
Looks like it isn't meant for you. I'd ignore it. Are you sure it is even definitely from the council?0
-
I believe it was sent by mistake as well as I have no idea what any of it means and it’s not addressed to me personally. The email came from a council email but it wasn’t directly addressed to me so I assume again it was sent to all and I had recently emailed my housing officer.0
-
Yeah guess it's an error0
Categories
- All Categories
- 13.7K Start here and say hello!
- 6.7K Coffee lounge
- 52 Games den
- 1.6K People power
- 34 Community noticeboard
- 21K Talk about life
- 4.8K Everyday life
- 2.2K Families and carers
- 798 Education and skills
- 1.7K Work
- 387 Money and bills
- 3.2K Housing and independent living
- 811 Transport and travel
- 635 Relationships
- 56 Sex and intimacy
- 1.3K Mental health and wellbeing
- 2.3K Talk about your impairment
- 836 Rare, invisible, and undiagnosed conditions
- 886 Neurological impairments and pain
- 1.8K Cerebral Palsy Network
- 1.1K Autism and neurodiversity
- 33.7K Talk about your benefits
- 5.4K Employment and Support Allowance (ESA)
- 17.9K PIP, DLA, and AA
- 5.7K Universal Credit (UC)
- 4.7K Benefits and income