GDPR & data protection

General Data Protection Regulation (GDPR)

New data protection legislation is due to come into force during 2018, which aims to protect the privacy of all EU citizens and prevent data breaches. It will apply to any public or private organisation processing personal data. Established key principles of data privacy remain relevant in the new Data Protection Legislation but there are also a number of changes that will affect commercial arrangements, both new and existing, with suppliers.

The Data Protection Legislation comprises: i) the General Data Protection Regulation

(GDPR) which comes into force on 25 May 2018; and ii) the Data Protection Act (DPA) 2018 which is anticipated to come into force (subject to Parliamentary approval) on 6 May 2018 for law enforcement processing, and 25 May for GDPR.

Standard definitions

The Controller: Graham Gardner T/A United Cars
ICO: Information Commissioners Office

Law: means any law, subordinate legislation within the meaning of Section 21(1) of the Interpretation Act 1978, bye-law, enforceable right within the meaning of Section 2 of the European Communities Act 1972, regulation, order, regulatory policy, mandatory guidance or code of practice, judgment of a relevant court of law, or directives or requirements with which the Provider is bound to comply;

GDPR clause definitions

Data Protection Legislation: (i) the GDPR, the LED and any applicable national implementing Laws as amended from time to time (ii) the DPA 2018 to the extent that it relates to processing of personal data and privacy; (iiii) all applicable Law about the processing of personal data and privacy;

Data Protection Impact Assessment: an assessment by the Controller of the impact of the envisaged processing on the protection of Personal Data;

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Data Protection Officer: take the meaning given in the GDPR;

Data Loss Event: any event that results, or may result, in unauthorised access to Personal Data held by the Provider under this Agreement, and/or actual or potential loss and/or destruction of Personal Data in breach of this Agreement, including any Personal Data Breach;

Data Subject Access Request: a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation to access their Personal Data;

DPA 2018: Data Protection Act 2018;

GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679);

LED: Law Enforcement Directive (Directive (EU) 2016/680).

Protective Measures: appropriate technical and organisational measures which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the such measures adopted by it;

Sub-processor: any third Party appointed to process Personal Data on behalf of the Controller related to this Agreement

1. Data protection

Clause 1.1

The Parties acknowledge that for the purposes of the Data Protection Legislation, the Controller is graham Gardner T/A United Cars, The only processing that the controller is authorised to do is listed in Schedule 20 Annex 1

Clause 1.2

The public shall notify the Controller immediately if it considers that any of the Controllers instructions infringe on the Data Protection Legislation.

Clause 1.3

The controller shall provide all reasonable assistance in the preparation of any Data Protection Impact Assessment prior to commencing any processing. Such assistance may, at the discretion of the Controller, include:

(a) a systematic description of the envisaged processing operations and the purpose of the processing;

(b) an assessment of the necessity and proportionality of the processing operations in relation to the Services;

(c) an assessment of the risks to the rights and freedoms of Data Subjects; and

(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of Personal Data.

Clause 1.4

The controller shall, in relation to any Personal Data processed in connection with its obligations under this Agreement:

(a) process that Personal Data only in accordance with Schedule 20 Annex 1, unless the controller is required to do otherwise by Law. If it is so required the controller shall promptly notify the ICO before processing the personal Data unless prohibited by Law;

(b) ensure that it has in place Protective Measures, which have been reviewed and approved by the Controller as appropriate to protect against a Data Loss Event having taken account of the:

(i) nature of the data to be protected;

(ii) harm that might result from a Data Loss Event;

(iii) state of technological development; and

(iv) cost of implementing any measures;

(c) ensure that:

(i) the controller does not process Personal Data except in accordance with this Agreement (and in particular Schedule 20 Annex 1);

(ii) it takes all reasonable steps to ensure the reliability and integrity of the Controller who has access to the Personal Data and ensure that they:

(A) are aware of and comply with the Controllers duties under this clause;

(B) are subject to appropriate confidentiality undertakings with the Controller or any Sub-processor.

(C) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third Party unless directed in writing to do so by the Company or as otherwise permitted by this Agreement; and

(d) not transfer Personal Data outside of the EU unless the prior written consent of the Company has been obtained and the following conditions are fulfilled:

(i) the controller has provided appropriate safeguards in relation to the transfer (whether in accordance with GDPR Article 46 or LED Article 37) as determined by the Controller.

(ii) the Data Subject has enforceable rights and effective legal remedies;

(iii) the Controller complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred (or, if it is not so bound, uses its best endeavours to assist the Controller in meeting its obligations); and

(iv) the Controller complies with any reasonable instructions notified to it in advance by the Controller with respect to the processing of the Personal Data;

(e) at the written direction of the Controller, delete or return Personal Data (and any copies of it) to any third party unless the controller is required by Law to retain the Personal Data.

Clause 1.5

Subject to clause 1.6, the Provider shall notify the Controller immediately if it:

(a) receives a Data Subject Access Request (or purported Data Subject Access Request);

(b) receives a request to rectify, block or erase any Personal Data;

(c) receives any other request, complaint or communication relating to either Party’s obligations under the Data Protection Legislation;

(d) receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement;

(e) receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law; or

(f) becomes aware of a Data Loss Event.

Clause 1.6

The Controllers obligation to notify under clause 1.5 shall include the provision of further information to the ICO in phases, as details become available.

Clause 1.7

Considering the nature of the processing, the Controller shall provide the ICO with full assistance in relation to either Party’s obligations under Data Protection Legislation and any complaint, communication or request made under clause 1.5 (and insofar as possible within the timescales reasonably required by the ICO) including by promptly providing:

(a) the Controller with full details and copies of the complaint, communication or request;

(b) such assistance as is reasonably requested by the Controller to enable to comply with a Data Subject Access Request within the relevant timescales set out in the Data Protection Legislation.

(c) the Controller, at its request, with any Personal Data it holds in relation to a Data Subject;

(d) assistance as requested by the Controller following any Data Loss Event.

(e) assistance as requested by the Controller with respect to any request from the Information Commissioners Office or any consultation with the Information Commissioner’s Office.

Clause 1.8

The controller shall maintain complete and accurate records and information to demonstrate its compliance with this clause. This requirement does not apply where the Provider employs fewer than 250 staff, unless:

(a) the Controller determines that the processing is not occasional.

(b) the Controller determines the processing includes special categories of data as referred to in Article 9(1) of the GDPR or Personal Data relating to criminal convictions and offences referred to in Article 10 of the GDPR; and

(c) the Controller determines that the processing is likely to result in a risk to the rights and freedoms of Data Subjects.

Clause 1.9

The Controller shall allow for audits of its Data Processing activity by the Controller or the Controllers designated auditor.

Clause 1.10

The Controller shall designate a data protection officer if required by the Data Protection Legislation.

Clause 1.11

Before allowing any Sub-processor to process any Personal Data related to this Agreement, the Controller must:

(a) notify in writing of the intended Sub-processor and processing.

(b) obtain the written consent of the Controller.

(c) enter into a written agreement with the Sub-processor which give effect to the terms set out in this Schedule 20 such that they apply to the Sub-processor; and

(d) provide the Controller with such information regarding the Sub-processor as the Controller may reasonably require.

Clause 1.12

The Controller shall remain fully liable for all acts or omissions of any Sub- processor.

Clause 1.13

The controller may, at any time on not less than 30 Working Days’ notice, revise This clause by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when incorporated by attachment to this Agreement).

Clause 1.14

We agree to take account of any guidance issued by the Information Commissioner’s Office. The Controller may on not less than 30 Working Days’ Notice to the controller amend this agreement to ensure that it complies with any Guidance issued by the Information Commissioner’s Office.

Annex 1

Schedule of Processing, Personal Data and Data

1. We shall comply with any further written instructions with respect to processing

2. Any such further instructions shall be incorporated into this Schedule.