Why GDPR represents a significant opportunity for post-Brexit UK

26 September 2017 Consultancy.uk

In May next year, the European Union's General Data Protection Regulation (‘GDPR’) will apply in the UK, profoundly altering the way in which companies collect, store, process and protect the personal information of customers, clients and employees. While the majority of insights and reports on GDPR’s impact warn for the burden it brings to operations, Steve Tang, a Senior Consultant Axis Corporate, warns that firms which treat the new regulation as a punitative burden are missing the point. Tang reflects on why the regulation represents a significant opportunity for post-Brexit UK.

What is GDPR?

A new EU regulation governing how organisations manage and structure their customer and employee data. Many of the stipulations are already covered in the UK’s Data Protection Act, but after May 2018, organisations will have to prove they have proper data-processing controls in place and that they comply with GDPR.

The GDPR is the most fundamental change in data protection legislation for the past 20 years and is the first attempt to create comprehensive and enforceable laws. The legislation will affect all domestic and international businesses operating in the EU – regardless of size. There are not just IT requirements – the impact will be felt across any organisation, from sales to marketing to HR.

What are the GDPR Principles?

Under the GDPR, there are data protection principles relating to the processing of personal data – and these are the main responsibilities for organisations:

  • Principal 1: ‘lawfulness, fairness and transparency’ – personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
  • Principal 2: ‘purpose limitation’ – personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is different to the original purposes.
  • Principal 3: ‘data minimisation’ – personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
  • Principal 4: ‘accuracy’ – personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that inaccurate personal data is erased or rectified without delay.
  • Principle 5: ‘storage limitation’ – personal data can only be kept in a form which allows the identification of data subjects for no longer than is necessary.
  • Principle 6: ‘integrity and confidentiality’ – personal data must be processed in a manner that ensures proper security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using proper technical or organisational measures.
  • Principle 7: ‘accountability’ – a controller shall be responsible for, and be able to prove compliance with the GDPR data protection principles.

In May 2018 the GDPR regulation will apply to firms in the UK

‘Accountability’ is the keyword. Under the accountability principle, data controllers will be needed to implement proper organisational and technical measures to ensure that data processing is performed in accordance with the GDPR. This would include any ongoing reviews and updates to those measures.

Which companies are affected by the GDPR?

All companies which handle personal data of EU citizens must comply with the GDPR. This will include both companies with presence in an EU country as well as companies with no presence in the EU, but process personal data of EU citizens.

The GDPR may see big fines

If organisations do not comply with the GDPR, the regulator (the Information Commissioner’s Office or ‘ICO’ in the UK) can issue fines ranging from 4% of total worldwide annual turnover or €20 million, whichever is greater. Fines up to €10 million or 2% of total worldwide annual turnover can be applied for not putting in place adequate security or not reporting any breaches.

Organisations must acknowledge that the GDPR means bigger fines for internal failings, but also the benefits of getting data protection right. If companies demonstrate that they respect and protect personal data, this could be perceived as a competitive advantage. Conversely, if organisations cannot demonstrate good data protection under GDPR, this could lead to reputational damage and big fines.

What are the challenges to becoming GDPR compliant?

Within organisations, data controllers are probably wondering what measures they need to implement to be compliant with the GDPR principles. The GDPR gives very little guidance on how to implement appropriate measures as well as how to demonstrate compliance to the legislation. The UK GDPR Supervisory Authority is the Information Commissioner’s Office (“ICO”). The ICO has not published any practical guidance and signposting guidance. By the time they have published any guidance, it may be too close to the 25 May 2018 launch date. Much of the current commentary has focused on the burden that the GDPR will have on businesses. However, there are a host of opportunities which the regulation will bring to all organisations.

GDPR represents a significant opportunity for post-Brexit UK

Brexit

The UK still needs to implement the GDPR regardless of whether the country is in or out of the EU. The GDPR applies not only to companies in the EU, but also to all companies that market their goods and services to EU citizens. If the UK is going to continue to trade with the EU post-Brexit, the flow of personal data will continue – and therefore will have to be protected. If UK firms become GDPR compliant, this will neatly align with the privacy aims of the legislation, making trade a lot easier.

Building positive consumer perceptions

How organisations handle personal data will be closely monitored by the consumers. Consumers have certain expectations on how their personal data is collected, used and protected by organisations. Over time, they have become aware of how their personal data is being used by organisations for targeted marketing opportunities. They are realising that privacy is more than just confidentiality and they want to know how organisations are using their personal data. If organisations put in place robust and transparent data handling practices, this will give consumers reassurance that their data is being protected and that they have the power to change their privacy controls. In other words, building trust with their consumers because they handle their personal data in the right way.

If organisations understand the need to build the right privacy controls and resolve any privacy issues, this will save any future pain from regulatory scrutiny and censure in the future. In effect, becoming GDPR compliant is an enabler for organisations to do things the right way – consumer analytics, predictive customer analysis and targeted marketing.

A springboard for innovation

The GDPR represents a fantastic opportunity for organisations to review what personal data they hold but also how they can use the data to innovate the products and services that they sell. If organisations start to think data-driven innovation, they can start to use concepts like privacy by design, profiling and data portability to design new products and services that will build trust with their consumers and ultimately drive sales.

If companies fail to embrace the GDPR, they will have inadequate protection from the rise in cyber attacks (which often lead to data breaches). Many organisations may see GDPR compliance as an onerous task, but this is outweighed by the benefits of putting their data to work through the data protection. Essentially, an organisation can extract the greatest value from consumer analytics, predictive customer analysis and targeted marketing, but only if they embrace the GDPR.

Related: GDPR provides retailers an opportunity to improve data governance.

×

UK manufacturing sees orders slow amid Brexit anxiety

11 April 2019 Consultancy.uk

Manufacturing in the UK saw negative growth for the end of 2018, reflecting a wider slowdown in the UK economy to 0.2% for the quarter, followed by three months at the start of 2019 which saw continued softening in orders. With uncertainty still hitting the sector ahead of Brexit’s deferred deadline, the industry faces a difficult 2019.

Despite a perpetually changing economic landscape, manufacturing remains a keystone industry in the UK. Optimism in the industry has been riding high in recent years, reflecting the perceived potential of automotive technologies, but last year saw a slight dip in business performance, ahead of what seems set to be a turbulent period for British manufacturing. Ordinarily, the sector might have expected to recover its footing relatively quickly, but with the looming spectre of Brexit making the economy’s future completely uncertain, this has not been the case.

The uncertainties of Brexit have continued to create headaches for companies on both sides of the channel. As contingency planning continues, new analysis from BDO and the Make UK explores how manufacturing – a segment likely to be hard hit by Brexit – has fared in the final quarter of 2018.

Output balance stable

Manufacturing remains a key industry in the UK, generating around 10% of total economic output and supporting around 2.7 million jobs. Yet while the industry has seen a number of years of strong optimism as well as demand, Brexit is set to throw a spanner in the works, with a range of manufacturing companies leaving the UK, or considering it. Indeed, UK manufacturing’s output currently sits at a 15-month low as the industry anticipates a cliff edge Brexit.

In terms of growth for various parts of the UK economy, a slowdown was noted in the final quarter of 2018 compared to Q4 2017. Manufacturing, in particular, saw growth declines coming in at almost -1%, with a similar trend in production. Construction saw a sharp contraction, falling 2 percentage points to below 0% growth in December 2018. Only services managed to have positive % growth in the final quarter. The final quarter as a whole saw growth of 0.2% in the UK economy – the lowest level in six years.

Output across most sectors in the industry remains positive, with the percentage balance of change in output at 22%. The result is the tension quarter of positive percentage balance of change, with stagnation on the final quarter of 2018. The firm is projecting a slight softening of output going into Q2 2019. The firm notes that there is some stockpiling taking place, with orders and outputs unaligned going into 2019.

Order balance remains positive but dips further

While there is a broadly positive picture for output, the firm does note considerable differences between subsectors. Basic metals for instance, saw a net 24% fall to -18% over the past three months. Metal production is also seeing relatively poor performance as demand from the automotive industry enters a period of acute uncertainty. However, most industries are to see improved output on balance, with rubber & plastic increasing from a net 11% to net 56%.

Export trade

Having been buoyed by the lowered value of the pound, UK export orders are up slightly on the previous quarter, but remain well below the most recent peak in Q3 2018. Domestic orders were relatively strong, with a year between the most recent peaks for the segment. However, Q2 2019 looks to see domestic orders fall sharply, to half Q1’s result, while export orders too are set to see declines.

The decline reflects a decrease in basic metals, possibly a reflection of changes affecting the auto industry. Meanwhile, export orders are down due to Brexit cross-border uncertainty – the effect of the sterling devaluation unable to continue to buoy the market. Basic metals and metal products are both in negative territory for the coming three months.

Investment and employment intentions

UK employment figures reached new milestones, with total unemployment down to 3.9% while participation rates hit record highs. Employment planning continues to be in net positive territory, with a net positive balance of 22% in Q1 2019. The coming months are projected to see a slight dip, again, largely resultant from uncertainties around Brexit. Basic metals is the sector most likely to see a negative trend, reflecting the expected decline in orders.

Investment intentions meanwhile continue to be in positive territory. However, again, the now acute uncertainty about Brexit – the UK government has boxed itself into a corner – mean that confidence around investment could wane rapidly.

Commenting on the wider economy, Peter Hemington, a Partner at BDO, said, “Manufacturing firms have been ramping up their preparations for a disorderly Brexit, in large part through the stockpiling of imported goods. This has had the effect of inflating activity levels… It’s too late to do anything about this now.  But a disorderly Brexit would be far worse than the current relatively mild slowdown, possibly disastrously so… We are concerned it looks more likely than ever that we will exit the EU without a deal.”