Chapter 17 Key Takeaways: Data Privacy, GDPR, and Cross-Border Data Compliance

Core Concepts at a Glance

1. The GDPR Framework

The General Data Protection Regulation (EU) 2016/679 established a comprehensive framework for personal data protection applicable from 25 May 2018. Its central requirements:

• Personal data is any information relating to an identified or identifiable natural person.
• Processing covers every operation performed on personal data, from collection through deletion.
• Controllers determine purposes and means of processing and bear primary legal responsibility.
• Processors act on controller instructions and face direct obligations under Articles 28 and 32.
• The accountability principle (Article 5(2)) requires controllers to demonstrate, not merely achieve, compliance.

2. The Six Lawful Bases for Processing (Article 6)

Every processing activity must rest on exactly one lawful basis. Choosing the wrong basis is a compliance failure even if another basis was theoretically available.

The Legitimate Interests Three-Part Test: 1. A legitimate interest must exist. 2. Processing must be necessary for that interest (cannot achieve it less intrusively). 3. The interest must not be overridden by the data subject's rights and freedoms (balancing test).

3. Data Subject Rights and Response Deadlines

Controllers must respond to data subject rights requests without undue delay and within mandatory timelines. Failure to respond within deadlines is itself an infringement.

Extension Process: If a controller extends the deadline from 30 to 90 days, it must notify the data subject within the original 30-day period, explaining why the extension is necessary.

Exemptions: The DPA 2018 Schedule 2 provides UK-specific exemptions from certain data subject rights, including for crime and taxation purposes (para. 14), which applies to AML SAR data subject to the tipping-off prohibition.

4. GDPR vs. UK GDPR — Key Comparison

Critical point: Where a UK financial institution processes EU residents' personal data (e.g., EU customers or employees), it must comply with EU GDPR as a matter of Article 3(2) extra-territorial scope, regardless of UK GDPR compliance.

5. Cross-Border Transfer Mechanisms — Decision Tree

Step 1: Is there an EU/UK adequacy decision for the destination country? - Yes: Transfer can proceed. No additional safeguard needed at transfer level. - No: Proceed to Step 2.

Step 2: Can appropriate safeguards be put in place?

Step 3: If no adequate safeguards are available, can a derogation (Article 49) apply? - Only for exceptional, non-systematic transfers. - Explicit consent; contract performance necessity; important public interest; legal claims; vital interests; public register access.

6. Data Breach Notification Timeline Requirements

A personal data breach requires immediate parallel action across multiple notification channels.

HOUR 0: Discovery of breach

├── IMMEDIATELY: Internal escalation to DPO/CCO/CISO
├── WITHIN 24 HOURS: FCA initial notification (operational resilience)
├── WITHIN 72 HOURS: ICO/supervisory authority notification (GDPR Art. 33)
│   └── Must include: nature of breach, categories/numbers affected,
│       DPO contact, likely consequences, measures taken/proposed
│       └── If notifying after 72 hours, must explain delay
├── WITHOUT UNDUE DELAY (where HIGH RISK): Data subject notification (Art. 34)
│   └── Required when breach "likely to result in high risk" to individuals
│       └── Exemption: if controller implemented encryption/pseudonymisation
│           such that data is unintelligible to unauthorised persons
└── ONGOING: Internal breach register (Art. 33(5)) — ALL breaches,
    regardless of whether notification to authority is required

The Key Risk Assessment:

US State Law Note: All 50 US states have breach notification laws with differing timelines (7 days in Ohio for certain breaches; 30 days in California; 45 days in Florida; up to 90 days in others). Financial institutions subject to GLBA face additional FTC Safeguards Rule notification requirements (notify FTC within 30 days of discovering a breach affecting 500+ customers).

7. RoPA, DPIA, and Privacy by Design — Practitioner Checklist

Records of Processing Activities (RoPA) — Article 30

The RoPA is the foundational GDPR compliance document. Every controller must maintain it.

RoPA must capture for each processing activity: - [ ] Activity name and description - [ ] Purpose(s) of processing - [ ] Categories of data subjects - [ ] Categories of personal data processed - [ ] Lawful basis (and Article 9(2) condition if special category data) - [ ] Categories of recipients (including processors and sub-processors) - [ ] Transfers to third countries and transfer mechanism used - [ ] Envisaged retention periods - [ ] General description of technical and organisational security measures

RoPA maintenance: - [ ] Annual review of all entries; more frequent review after system changes - [ ] Owner assigned for each processing activity - [ ] New processing activities added before commencement - [ ] Available for supervisory authority inspection on request

DPIA Trigger Checklist — Article 35

A DPIA must be conducted before commencing processing if any of the following apply:

• [ ] Systematic and extensive evaluation of personal aspects using automated processing (including profiling) with decisions producing significant effects on data subjects
• [ ] Large-scale processing of special category data (Art. 9) or criminal conviction data (Art. 10)
• [ ] Systematic monitoring of a publicly accessible area on a large scale
• [ ] ICO mandatory DPIA list items:
• [ ] Biometric data used to uniquely identify individuals
• [ ] Genetic data processed for healthcare-related purposes
• [ ] Processing children's personal data for profiling or targeting
• [ ] Automated decision-making with significant legal/similar effects
• [ ] Processing of data that could result in physical harm
• [ ] New technologies assessed as high-risk

If a DPIA reveals high residual risk that cannot be mitigated: Prior consultation with the ICO required (Article 36) before processing commences.

Breach Notification Checklist

• [ ] Have you identified the nature and scope of the breach?
• [ ] Has the DPO been notified?
• [ ] Has the ICO been notified within 72 hours? (Or delay explained?)
• [ ] Has the FCA been notified within 24 hours (if material operational incident)?
• [ ] Have affected data subjects been notified (if high risk)?
• [ ] Has the breach been logged in the internal breach register?
• [ ] Have remedial measures been implemented?
• [ ] Has root cause analysis been initiated?

8. The AML-Privacy Tension — Resolution Framework

When a customer subject to an AML Suspicious Activity Report exercises GDPR data subject rights, the resolution framework is:

Key legal provisions: - DPA 2018 Schedule 2, paragraph 14: crime and taxation exemption from data subject rights - POCA 2002 section 333A: tipping-off prohibition - MLR 2017 regulation 40: five-year AML retention obligation - GDPR Article 17(3)(b): legal obligation exception to erasure

9. Privacy-Enhancing Technologies — Quick Reference

10. Key Regulatory References

Practitioner Summary: What Every Financial Services Compliance Officer Must Know

1. Every processing activity needs a lawful basis — documented in the RoPA before processing commences.

2. Legal obligation is the workhorse basis for AML — but it only covers what the law actually requires, not what is convenient to retain.

3. Legitimate interests requires a genuine balancing test — not a rubber stamp. The ICO scrutinises over-reliance on this basis.

4. Data subject rights have mandatory deadlines — 30 days for access/portability/erasure/restriction; extendable to 90 days with notification. Missing deadlines is independently enforceable.

5. The AML-GDPR tension is resolved by specific legal exemptions — DPA 2018 Schedule 2 para. 14, not by general principle. Know the provision precisely.

6. Schrems II changed cross-border transfers permanently — Privacy Shield is gone; SCCs require Transfer Impact Assessments; the EU-US DPF is the current adequacy mechanism but faces legal risk.

7. 72-hour breach notification to the ICO runs concurrently with FCA 24-hour notification — response procedures must be coordinated across both obligations simultaneously.

8. Privacy by Design is a legal requirement — Article 25 means data protection must be built into systems from the start, not bolted on afterward.

9. The RoPA is the foundation of all GDPR compliance — without an accurate data map, all other compliance measures rest on incomplete foundations.

10. PETs are shifting from theory to practice — differential privacy, federated learning, and synthetic data are available tools for enabling data use while managing privacy risk.