HR Articles

On 25 July 2022, the Information Commissioner’s Office (ICO) published guidance and revised application forms and tables to simplify the UK Binding Corporate Rules (UK BCRs) approval process for controllers and processors.

There have been many developments in data protection over the last few years, ranging from the implementation of the GDPR, the result of the decision in the case of Schrems II and new agreements and processes for international data transfers.

Under the General Data Protection Regulation (GDPR), in both the EU and UK versions, employees have the right to request access to their personal data from their employer called a Data Subject Access Request (DSAR).   

A controller is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing of personal data.

On 10 May 2022, Prince Charles confirmed, as set out in the Queen’s Speech, that there would be a new data protection regime in the UK, with some measures extending and applying to England and Wales only. 

For organisations that transfer personal data from the UK to other jurisdictions, new data sharing agreements are now in force. 

The ICO’s International Data Transfer Agreement (IDTA) is another step along the way to greater clarity, after the upheavals of Brexit and the landmark European privacy ruling, Schrems II.  

Sometimes, data protection can seem like unhelpful red tape. At other times, it is critical to cultivating a trustworthy reputation. Either way, organisations face data protection challenges in various spheres – including employment and commercial practice.

Technology has placed a major role in ensuring the survival of businesses across the country over the past 18 months. Companies with strong IT capabilities will have been better placed to weather the changes brought on by the pandemic to the way we work, and our reliance on technology is only set to increase.  

Employers with longstanding employees are likely to have changed record/filing systems over the employee’s length of service. Outside of the tribunal context, the increasing use of data subject access requests is leading to unwanted exposure of employers’ record keeping habits.  

Employers are increasingly reliant on technology to assist with all kinds of functions – from strengthening security to streamlining recruitment processes. But there are other legal risks that may be relevant but less obvious.