FCA and ICO Joint GDPR Update
February 13, 2018
The FCA and the Information Commissioner’s Office (ICO) have recently published an update on the EU General Data Protection Regulation (GDPR). This is available here.
The EU General Data Protection Regulation will apply in the UK from 25 May 2018. It is an essential step forward in enhancing the privacy and security of personal data. The GDPR will be regulated and enforced in the UK by the Information Commissioner’s Office. Financial services firms will need to consider how the GDPR will apply to them, and to ensure that they are ready to comply with the regulations from May 2018.
Complying with some of the FCA’s rules requires financial services firms to process personal data. Firms have asked the FCA about their ability to comply with both the GDPR and rules made by the FCA. The FCA believes the GDPR does not impose requirements which are incompatible with the rules in the FCA Handbook. Indeed, there are a number of requirements that are common to the GDPR and the financial regulatory regime detailed in the Handbook.
Compliance with GDPR is now a board-level responsibility, and firms must be able to produce evidence to demonstrate the steps that they have taken to comply. The requirement to treat customers fairly is also central to both data protection law and the current financial services regulatory framework. When the FCA makes rules, it takes into account how its requirements will affect the privacy interests of individuals such as firms’ customers and employees, and is open and transparent on why it has made rules in the way that it has.
However, the FCA recognises that there are still ongoing discussions to ensure specific details of the GDPR can be implemented consistently within the wider regulatory landscape.
The FCA and ICO are working closely together in preparation for the GDPR, and recently jointly hosted a GDPR Roundtable with firms and industry bodies to listen to industry concerns. One example of how the regulators are working together is innovation, where the ICO is providing tailored input to the FCA’s Innovation Hub.
Since 2014, the FCA and ICO have had a Memorandum of Understanding in place, laying out their formal relationship and demonstrating commitment to co-operation and co-ordination in their activities. Over the coming months, the regulators will review the memorandum of understanding to ensure it is still fit to address future collaboration.
While the ICO will regulate the GDPR, complying with the GDPR requirements is also something the FCA will consider under its rules; for example, the requirements in the Senior Management Arrangements, Systems and Controls (SYSC) module. As part of their obligations under SYSC, firms should establish, maintain and improve appropriate technology and cyber resilience systems and controls.
The FCA and ICO will continue to collaborate in the coming months to address concerns firms raise and support firms’ preparations for the introduction of the GDPR in May 2018.
How can Thistle help you?
Thistle will continue to keep this area under review and will issue further updates where necessary. Please contact Thistle if you need assistance in relation to this issue or visit our GDPR page for more information.