Recent changes in UK and EU data protection laws have imposed strict data protection and management requirements on SMBs, but there are ways for these businesses to ensure they remain in compliance.
The landscape of data protection law has undergone significant changes in recent years, particularly in the UK and the EU. These changes have had profound implications for Small and Medium-Sized Businesses (SMBs). The main data protection laws in the EU are the General Data Protection Regulation (GDPR) and the EU’s ePrivacy Directive. Their equivalents in the UK are the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR), both still fundamentally unchanged since Brexit and complemented by the Data Protection Act 2018 (DPA 2018). .
These laws aim to protect individuals’ personal data and establish clear rules for businesses and organizations about how to collect, store, and use this data. For SMBs, these regulations mean a heightened responsibility for data protection. They must ensure that they have robust systems and processes in place to protect personal data, and they should be able to demonstrate compliance with the relevant laws and regulations. Non-compliance with these regulations can lead to significant penalties, making it crucial for businesses to understand and adhere to these laws.
The GDPR mandates data protection measures for all businesses, including SMBs, processing EU residents’ personal data or processing personal data in the context of a EU establishment, with potential heavy fines for non-compliance.
The GDPR is a comprehensive data protection law that started to apply in the European Union on May 25, 2018. This regulation applies to all businesses, regardless of size, that process personal data of EU residents or in the context of a EU establishment, which includes SMBs. The GDPR sets out key principles such as lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality. It mandates SMBs to identify a lawful basis before processing individuals’ personal data and to provide clear information about how this data will be used. SMBs are also required to implement robust systems and processes to protect personal data and demonstrate compliance with the GDPR. Non-compliance can result in severe penalties, with fines reaching up to €20 million or 4% of the annual global turnover, whichever is higher. Thus, the GDPR significantly impacts how SMBs handle and protect personal data, emphasizing the need for sturdy data protection measures.
The ePrivacy Directive sets rules for SMBs on data use in online communications, including the application of cookies, marketing, and communication confidentiality.
The ePrivacy Directive, formally known as Directive 2002/58/EC, is a critical piece of legislation in the European Union that specifically addresses the protection of privacy in the electronic communications sector. It complements the broader GDPR by providing more specific rules regarding the processing of personal data in the digital context.
The ePrivacy Directive covers several important areas for SMBs. Firstly, it regulates the use of cookies and similar technologies, requiring businesses to obtain user consent before placing cookies on their devices, except for those strictly necessary for the provision of the service requested by the user. In addition, it sets rules on direct marketing, stipulating that unsolicited communications for marketing purposes are not allowed without prior consent, except under very specific circumstances.
The directive also emphasizes the confidentiality of communications, meaning SMBs must ensure they respect the confidentiality of their customers’ communications and take appropriate measures to safeguard the security of these communications. It’s important to note that the EU is currently working on the ePrivacy Regulation to replace the ePrivacy Directive, which will directly apply to all EU Member States and provide a more harmonized approach to privacy and electronic communications.
The UK GDPR, implemented post-Brexit, mandates SMBs to handle personal data lawfully and transparently, implement security measures, and report data breaches promptly.
The UK GDPR is a key piece of legislation that governs the handling of personal data in the UK. It was implemented following Brexit, incorporating the principles of the EU’s GDPR into UK law and mirroring most of the EU’s GDPR requirements, but applying specifically to the processing of personal data within the UK or personal data about data subjects in the UK. The UK GDPR is also designed to offer individuals greater control over their personal data, ensuring its protection and privacy.
This law has significant implications for SMBs who must ensure they handle personal data lawfully, transparently, and only for specified purposes. This includes defining the most adequate lawful basis before processing individuals’ personal data, providing clear information about how this data will be used, and offering individuals the right to access, correct, or delete their data, among others. Like under the GDPR, SMBs will also need to implement appropriate security measures to protect this data and report any data breaches within 72 hours, unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Non-compliance can lead to substantial fines, up to a maximum of £17.5 million or 4% of annual global turnover – whichever is greater.
The DPA 2018 imposes clear data handling rules on SMBs, including the requirement for carrying out lawful processing and implementing protective measures.
The Data Protection Act (DPA) 2018 serves as the key legislation in the UK, regulating the collection, storage, and processing of personal data. It not only incorporates and supplements the UK GDPR but also entails unique national provisions concerning topics like law enforcement data processing and intelligence services. For SMBs, it establishes clear rules on personal data handling. These rules mandate relying on a valid lawful basis prior to the processing of data subjects’ personal data. They also emphasize maintaining the accuracy and currency of personal data and restricts its usage to the purpose it was originally collected for. Moreover, the DPA 2018 stipulates measures to safeguard personal data against unauthorized access, use, or disclosure. It ensures individuals’ rights to access their personal data and to request its correction or deletion, among other rights such as data portability. While the DPA 2018 is a complex piece of legislation, it is crucial for SMBs to comprehend their responsibilities under it, as noncompliance could lead to substantial fines, just like in case of the UK GDPR.
The PECR sets rules for SMBs on electronic marketing communications, cookie usage, and public electronic communication service security, with penalties for non-compliance.
The PECR is a UK-specific regulation that complements the DPA 2018 and the UK-GDPR. It provides rules regarding the use of electronic communications for marketing purposes, the use of cookies on websites, and the security of public electronic communication services. For SMBs, understanding and adhering to PECR is crucial. If an SMB uses electronic communications channels for marketing, like email or text messages, they must ensure they have the recipient’s consent, unless the communication is part of an existing customer relationship where similar products or services are being marketed. Also, if the business’s website uses cookies, they need to inform visitors about these cookies, explain what they are used for, and gain the visitor’s consent to use them in case of not striclty necessary cookies. Any breach of these regulations can lead to substantial fines, so SMBs should ensure they fully understand and comply with PECR.
There are several measures that SMBs can take to ensure compliance with data protection regulations.
There are several steps that SMBs can take to ensure compliance. When it comes to processing activities that may entail a high risk for the rights and freedoms of the individuals, SMBs should first conduct a data protection impact assessment (DPIA). This involves identifying and assessing the potential risks associated with these data processing activities. Based on the findings of the DPIA, SMBs should implement appropriate measures to mitigate these risks. In addition, businesses should appoint a Data Protection Officer (DPO) if their core activities involve large scale, regular, and systematic monitoring of individuals or the processing of special categories of data. The DPO is responsible for overseeing data protection strategy and implementation to ensure compliance with GDPR or UK GDPR requirements. Businesses may choose to appoint an in-house DPO or to subcontract the work to an external DPO. In this previous article, we compared the two options, weighing the pros and cons of each of these options to help business owners decide which option may suit their business needs more appropriately. Businesses should also provide training to their staff to ensure that they are aware of their responsibilities under data protection law. This can help to prevent data breaches and ensure that any breaches that do occur are dealt with appropriately. Lastly, SMBs should ensure that they have implemented clear and robust policies for data protection. This includes policies for data storage, data sharing, data breaches, and individual rights. These policies should be communicated clearly to all employees and should be regularly reviewed and updated.
If you are a small or medium sized business, looking to ensure compliance with data protection regulations, Aphaia can help. Our team of experts can provide external DPO and tailored solutions to help you achieve compliance and improve your data protection practices. Contact Aphaia today to find out more.
