PRIVACY POLICY – GDPR 2018 COMPLIANCE
HIGHLAND CROWN LTD

 

This document outlines the responsibilities of HIGHLAND CROWN LTD with regard to the EU General Data Protection Requirement 2018.

HIGHLAND CROWN LTD. collects and holds data relating to each employee in accordance with statutory requirements and to enable communication with employees concerning pay, holidays, sick pay and other issues relating solely to their employment with HIGHLAND CROWN LTD.

The “Lawful Basis” for collecting and holding employee data is a LEGAL OBLIGATION

The legal obligations are outlined in the following paragraphs, taken from the UK government GDPR information website:
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legal-obligation/

You can rely on this lawful basis if you need to process the personal data to comply with a common law or statutory obligation.

• This does not apply to contractual obligations.

• The processing must be necessary. If you can reasonably comply without processing the personal data, this basis does not apply.

• You should document your decision to rely on this lawful basis and ensure that you can justify your reasoning.

• You should be able to either identify the specific legal provision or an appropriate source of advice or guidance that clearly sets out your obligation.

The lawful basis for processing necessary for compliance with a legal obligation is almost identical to the old condition for processing in paragraph 3 of Schedule 2 of the 1998 Act.

You need to review your existing processing so that you can document where you rely on this basis and inform individuals. But in practice, if you are confident that your existing approach complied with the 1998 Act, you are unlikely to need to change your existing basis for processing.

What does the GDPR say? 

Article 6(1)(c) provides a lawful basis for processing where:

“processing is necessary for compliance with a legal obligation to which the controller is subject.”

When is the lawful basis for legal obligations likely to apply?

In short, when you are obliged to process the personal data to comply with the law.

Article 6(3) requires that the legal obligation must be laid down by UK or EU law. Recital 41 confirms that this does not have to be an explicit statutory obligation, as long as the application of the law is foreseeable to those individuals subject to it. So it includes clear common law obligations.

This does not mean that there must be a legal obligation specifically requiring the specific processing activity. The point is that your overall purpose must be to comply with a legal obligation which has a sufficiently clear basis in either common law or statute.

You should be able to identify the obligation in question, either by reference to the specific legal provision or else by pointing to an appropriate source of advice or guidance that sets it out clearly. For example, you can refer to a government website or to industry guidance that explains generally applicable legal obligations.

Example 

An employer needs to process personal data to comply with its legal obligation to disclose employee salary details to HMRC.

The employer can point to the HMRC website where the requirements are set out to demonstrate this obligation. In this situation it is not necessary to cite each specific piece of legislation.

Example

A financial institution relies on the legal obligation imposed by the Part 7 of Proceeds of Crime Act 2002 to process personal data in order submit a Suspicious Activity Report to the National Crime Agency when it knows or suspects that a person is engaged in, or attempting, money laundering.

Example

A court order may require you to process personal data for a particular purpose and this also qualifies as a legal obligation.

Regulatory requirements also qualify as a legal obligation for these purposes where there is a statutory basis underpinning the regulatory regime and which requires regulated organisations to comply.

Example

The Competition and Markets Authority (CMA) has powers under The Enterprise Act 2002 to make orders to remedy adverse effects on competition, some of which may require the processing of personal data.

A retail energy supplier passes customer data to the Gas and Electricity Markets Authority to comply with the CMA’s Energy Market Investigation (Database) Order 2016. The supplier may rely on legal obligation as the lawful basis for this processing.

A contractual obligation does not comprise a legal obligation in this context. You cannot contract out of the requirement for a lawful basis. However, you can look for a different lawful basis. If the contract is with the individual you can consider the lawful basis for contracts. For contracts with other parties, you may want to consider legitimate interests.

When is processing ‘necessary’ for compliance?

Although the processing need not be essential for you to comply with the legal obligation, it must be a reasonable and proportionate way of achieving compliance. You cannot rely on this lawful basis if you have discretion over whether to process the personal data, or if there is another reasonable way to comply.

It is likely to be clear from the law in question whether the processing is actually necessary for compliance.

What else should we consider?

If you are processing on the basis of legal obligation, the individual has no right to erasure, right to data portability, or right to object.

 

HIGHLAND CROWN LTD uses a third party for payroll processing, and transfers to this third party only such personal employee information necessary for the processing of the payroll. HIGHLAND CROWN LTD has employed due diligence to ensure that the third party payroll processor is in full compliance with the General Data Protection Requirement 2018.

HIGHLAND CROWN LTD does not sell or otherwise distribute employee data to third parties other than to the payroll processor detailed in the paragraph above.

Hard copies of employee records and employee data are kept in a locked cabinet in an office protected out of hours by an alarm system, and accessible only via three locked doors. Access is strictly limited on a need-to-access basis.

Tim Blackhurst
Managing Director HIGHLAND CROWN LTD
19th April 2108