Renzo
Many thanks. It's especially good to know that someone else has gone
through this before.
Appointing the data processor as representative is the obvious solution,
of course.
All the best
Andrew
--
Andrew Cormack, Chief Regulatory Adviser
JANET(UK), Lumen House, Library Avenue, Harwell Science and Innovation
Campus, Didcot, OX11 0SG, UK
Phone: +44 (0) 1235 822302
Fax: +44 (0) 1235 822399
> -----Original Message-----
> From: This list is for those interested in Data Protection issues
> [mailto:[log in to unmask]] On Behalf Of Marchini,
> Renzo
> Sent: 01 September 2008 16:09
> To: [log in to unmask]
> Subject: Re: Non-EEA data controllers?
>
> I think you have got it right, yes. The DPA does indeed have this
> extra-territorial reach.
>
> However, it may be that you (the data processor) is an "agent" of
> the
> data controller and so is actually within section 5(3)(d)(i) -
> rendering
> the university "established" in the UK for the purpose of the DPA
> so
> that it does not then have to apply a rep for the purpose of 5(2).
> I
> think this is the better reading. (I have had discussion with the
> Irish
> IC on this point as many of my clients are off-shore funds
> appointing
> Dublin based service providers; the jurisdictional provisions
> coming of
> course from the directive so there is common ground.)
>
> R
>
>
>
>
>
> Renzo Marchini
> Counsel
> Dechert LLP
> +44 (0) 20 7184 7563 direct
> +44 (0) 20 7184 7001 fax
> [log in to unmask]
> www.dechert.com
>
> -----Original Message-----
> From: This list is for those interested in Data Protection issues
> [mailto:[log in to unmask]] On Behalf Of Andrew Cormack
> Sent: 01 September 2008 16:02
> To: [log in to unmask]
> Subject: [data-protection] Non-EEA data controllers?
>
> I hope the list can help with a situation that is the reverse of
> what we
> normally have to deal with: *import* of personal data, rather than
> export!
>
> I'm talking to a US university who want to provide their students
> with
> access to an on-line resource in the UK, and we're trying to work
> out
> which duties, if any, of the UK DPA apply to each of the parties.
> The
> access may involve the US university providing personal data, such
> as
> usernames or e-mail addresses, to the UK service so that it can set
> up
> accounts for the students. The duty to inform seems to work out
> particularly strangely...
>
> As far as I can see if the resource has the ability to decide what
> happens to the data, then it's a data controller subject to the Act
> (by
> s.5(1)(a)) and has to inform the users of what is being done with
> their
> data, even though it may have no way to contact them until they log
> in.
>
> But if the resource is working under a contract with the university
> and
> only acting on their instructions, then it appears that the
> resource is
> a data processor and the university is a data controller. That
> seems to
> fall within s5(1)(b), which seems to mean that the university
> (though in
> the US and having only US users) becomes subject to the UK law. So
> the
> university would be under a statutory duty to inform its (probably
> surprised) users that their personal data were being *better*
> protected
> than they would expect were the resource in the USA. And 5(2)
> further
> seems to require that the university appoint a representative who
> is in
> the UK.
>
> Have I got that correct?
>
> Thanks
> Andrew
>
> --
> Andrew Cormack, Chief Regulatory Adviser
> JANET(UK), Lumen House, Library Avenue, Harwell Science and
> Innovation
> Campus, Didcot, OX11 0SG, UK
> Phone: +44 (0) 1235 822302
> Fax: +44 (0) 1235 822399
>
>
> JANET(UK) is a trading name of The JNT Association, a company
> limited
> by guarantee which is registered in England under No. 2881024
> and whose Registered Office is at Lumen House, Library Avenue,
> Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11
> 0SG
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> All archives of messages are stored permanently and are
> available to the world wide web community at large at
> http://www.jiscmail.ac.uk/lists/data-protection.html
> If you wish to leave this list please send the command
> leave data-protection to [log in to unmask]
> All user commands can be found at
> http://www.jiscmail.ac.uk/help/commandref.htm
> Any queries about sending or receiving messages please send to the
> list
> owner
> [log in to unmask]
> Full help Desk - please email [log in to unmask] describing
> your
> needs
> To receive these emails in HTML format send the command:
> SET data-protection HTML to [log in to unmask]
> (all commands go to [log in to unmask] not the list please)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
>
>
> This e-mail is from Dechert LLP, a law firm, and may contain
> information that is confidential or privileged. If you are not the
> intended recipient, please delete the e-mail and any attachments,
> and notify the sender. Dechert LLP is a limited liability
> partnership registered in England & Wales (Registered No. OC306029)
> and is regulated by the Solicitors Regulation Authority. A list of
> names of the members of Dechert LLP (who are solicitors or
> registered foreign lawyers) is available for inspection at its
> registered office, 160 Queen Victoria Street, London EC4V 4QQ.
>
> Please consider the environment by not printing this email.
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> All archives of messages are stored permanently and are
> available to the world wide web community at large at
> http://www.jiscmail.ac.uk/lists/data-protection.html
> If you wish to leave this list please send the command
> leave data-protection to [log in to unmask]
> All user commands can be found at
> http://www.jiscmail.ac.uk/help/commandref.htm
> Any queries about sending or receiving messages please send to the
> list owner
> [log in to unmask]
> Full help Desk - please email [log in to unmask] describing
> your needs
> To receive these emails in HTML format send the command:
> SET data-protection HTML to [log in to unmask]
> (all commands go to [log in to unmask] not the list please)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|