GDPR Primer for Companies, Teachers, Schools and Theatres

On Monday I received the following email from Northern Ballet Academy:

"Due to changes in the Data Protection law coming into force from May 2018 we now need your approval in advance to contact you with information regarding your classes and Academy opportunities. If this form is not completed and returned by 30th April we will no longer be able to contact you by email on the information listed on the form."

This is just one of many similar requests that I have received in the last few weeks from online and other service providers with whom I have dealt for many, many years.

The GDPR
The change in the law to which the Academy refers is Regulation (EU) 2016/279 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC which is better known as the General Data Protection Regulation ("GDPR"). It comes into force throughout the 28 member states of the European Union including the UK on 25 May 2018.  That Regulation repeals a 1995 Directive that required Parliament to pass the Data Protection Act 1998. Consequently, it will replace that Act from that date.

Changes in the Law
There has been a lot of hype about the GDPR over the last few years which has been used to sell a lot of new hardware, software and training courses. The new law will make a number of changes to our law. It will affect everyone who processes personal data for business purposes whether by computer or otherwise.  As that is likely to include most companies, theatres, ballet schools and even freelance teachers, it will affect many readers of this blog.  However, those changes are evolutionary and not revolutionary. They are perfectly manageable with a bit of common sense. They are far less difficult to my mind than say a pirouette if, like me, you are overweight, not well-coordinated and came to ballet very late in life.

What is Data Protection and why do we need it?
Data protection is the generic term for the laws that protect personal data (that is to say information that identifies living human beings) from misuse.  It is in our interests that businesses, doctors and nurses, local authorities, places of entertainment, schools and others process personal data as it enables us to enjoy goods and services that would not otherwise be provided but personal data can be misused as recent allegations over the manipulation of Facebook users' data show.  Those who wish to use personal data for legitimate purposes such as communicating with audiences, recording students' progress and so on are allowed to do so if, but only if, they abide by certain data protection principles.

What are the Data Protection Principles?
These are set out in art 5 (1) of the GDPR:

"Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; ..... (‘purpose limitation’);
(c)  adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; ...... (‘storage limitation’);
(f)  processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."

There is nothing new about those principles. They have subsisted as part of out law in one form or another since 1984.  The only difference is that those who decide the data to be processed and how they are to be processed ("data controllers") have to demonstrate their compliance with those principles.

What happens if I do not comply?
The GDPR will be enforced in the UK by an official known as "the Information Commissioner".  She already enforces the Data Protection Act 1998, the Freedom of Information Act 2000 and other legislation. She has an office in Wilmslow near Manchester and branches in Belfast, Cardiff and Edinburgh. She will have extensive powers to monitor compliance the Regulation and she can impose fines or other sanctions for non-compliance.  Very serious breaches of the Regulation are offences which may be prosecuted in the Crown or magistrates' courts.  Also, anyone who suffers loss or damage as a result of an infringement of the GDPR may sue the person responsible for injunctions, damages and other remedies in the civil courts.

How do I comply with the GDPR?
The first thing to note is that the Data Protection Act 1998 already covers most of these obligations and has done for the last 20 years.  The Act requires data controllers to notify the Information Commissioner of the personal data that they hold and how they intend to use them.  If you hold personal data for business purposes you will almost certainly need to notify those details to the Commissioner as you risk administrative sanctions or criminal prosecution if you do not do so.  You can find out whether you need to notify and how to do so on the Register (notify) under the Data Protection Act page of the Information Commissioner's website. Unlike the Act the GDPR does not require data controllers to notify their use of personal data to the Commissioner.   However, s.108 (1) of the Digital Economy Act 2017 does and the government has published regulations to that effect which will come into force on 25 May 2018 (see Jane Lambert Information Commissioner's Charges after GDPR 27 March 2018 NIPC Data Protection).

The next thing you should so is to find out as much information as you can about the GDPR. You will find a presentation on GDPR and some articles that I have written in Data Protection - GDPR Resources 24 May 2018 NIPC Law. There is a lot of other information in my Data Protection Blog and even more on the Information Commissioner's website.  I particularly recommend her leaflet Getting ready for the new UK data protection law Eight practical steps for micro business owners and sole traders which can be downloaded from her website.

What about Brexit?
Some readers will have noted that the GDPR is an EU regulation which will cease to apply to us once we leave the EU. While that is true we shall continue to enforce the GDPR during any transition or implementation period that will follow our departure from the EU.  Also, the Commission has made it clear in its negotiation documents that it will expect us to protect personal data under any free trade or other agreement that will govern our long term relationship with the EU after the expiry of that period.  A Data Protection Bill that contains many of the provisions of the GDPR is making its way through Parliament.

Further Information
Anyone wishing to discuss this article or data protection generally should call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.

What we can learn from Rihanna

Last week the singer Rihanna saw off an appeal by Top Shop against a decision of the High Court ordering the retailer to stop selling t-shirts reproducing her likeness in a way that suggested that she approved or endorsed Top Shop's products. If you want to understand the legal issues you can read my case notes in my law blog on the original decision in 2013 and the appeal.

"Very interesting" you may say "but what's it to do with ballet?" Well quite a lot actually because if more money is to come into dance and the other performing arts it will have to come from merchandising and endorsements. As I said in Ballet as a Brand? How to bring More Money into Dance for Companies and Dancers 13 March 2013 there is a limit to how much the long suffering British public will pay for the arts whether in the form of ticket prices or subsidies from the Arts Council.

Sports stars and performers in other art forms such as Rihanna have long known that there is a lot of money to be made from advertising, endorsement, merchandizing and sponsorship. As the Court of Appeal noted, Rihanna runs very large merchandizing and endorsement businesses. Over the years has had endorsement deaks with Nike, Gillette, Clinique and LG Mobile. She has also been very active in fashion in her own right and has made considerable efforts to associate herself in the public mind with that industry.

As I noted in my article last year:

"A few companies are already making a little extra money from advertising. The Royal Opera House shop offers a wide range of merchandise bearing the Royal Ballet name and crest such as books, calendars, greeting cards, t-shirts and videos. Other companies sell t-shirts. A website called Balletgifts, which appears to be based in New Cross. markets various items of clothing and other merchandise for the Birmingham Royal Ballet, the Bolshoi and the Mariinsky. Many companies hire out rooms in their studios or their orchestras. Most also have schemes by which businesses and individuals can become friends or patrons of a company or sponsor individual productions or dancers."

Also, a few dancers are also beginning to exploit their value as brands:

"A few superstars like Carlos Acosta and Darcey Bussell have websites through which they market branded merchandise. Acosta offersclothing and posters and advertises his book with links to Amazon and Waterstones. Bussell markets a range of children's dancewear, books and games and DVDs from her site."

However, much more can be done. You don't have to be the Royal Ballet or Carlos Acosta to make money from advertising, endorsements, merchandising and sponsorship. Every company - even quite small ones has its following - and it is not just ballerinas and premiers danseurs nobles who have fans. Look how I gush over Brill, Coracy, DePrince, Gillespie, Kundi and other favourite artistes as well as the principals of their companies.  And it's not just performers who have brands. So, too do studios, dance schools and even individual teachers.

I made some suggestions as to what companies, theatres, dancers and increasingly individual teachers can do to protect their goodwill in  Branding and Ballet - Ten Top Tips 13 June 2014. The Rihanna case is likely to be discussed at a seminar at St Pancras on the law relating to branding and fashion and luxury goods at which I shall be speaking on 10 Feb 2015. If you want to attend the seminar you can book on-line.