The EU Data Protection Directive has underpinned the UK’s data protection legislation for over 20 years. It provides a regulatory structure for organisations who control or process personal information, and establishes clear principles and obligations that give consumers protection in relation to how their data is stored, used and controlled.
The existing framework is due to be replaced in 2017. Unlike a Directive, which is implemented through local laws enacted by individual Member States, the new rules take the form of a Regulation, which is required to be applied uniformly across the whole EU area.
This is likely to lead to a major shake-up in the way data protection is handled in the UK as we switch to the new system. There are a number of significant changes, some of which will affect the way UK mortgage lenders and administrators handle customer data. These include:
- Additional responsibilities for firms processing personal data, including maintaining accurate documentation of the processing that they carry out.
- The right for customers to opt out of any form of automated evaluation or profiling of them, such as credit scoring. This right can be asserted at any time, for example after they have taken out a mortgage, meaning lenders may find it hard to avoid.
- A ‘right to be forgotten’, which will allow customers to demand that their data is permanently erased, unless it is being used for a legitimate purpose. Lenders would be responsible for making sure this is carried out completely, including notifying any third parties who may have received the customer’s details, for example during the application process.
- Enhanced rights for consumers to receive copies of their personal data in an editable and portable format, as opposed to printouts and screenshots which are often used today to fulfil subject access requests.
Agreement has already been reached with all Member States, and the final rules are expected to be published in the coming months. 2017 is not far away, and it is never too soon to assess the impact of forthcoming changes in regulation.
