The General Data Protection Regulation (GDPR) comes into force on 25 May 2018. In previous briefing notes, we have looked at what pension scheme trustees will need to do to comply with GDPR. In our latest update, we look at some recent GDPR developments and at some particular issues that may be causing problems in practice.
Data Protection Bill
The GDPR will apply automatically in all EU member states (including the UK) from 25 May 2018. Alongside the GDPR, the UK Government introduced a Data Protection Bill to Parliament in September 2017, which (amongst other things) sets out proposed UK derogations (exceptions) from the GDPR. Whilst it is hoped that the Bill will receive Royal Assent by 25 May, this is not necessary for the GDPR itself to come into force.
The Bill, as originally laid before Parliament, included an apparent exemption for occupational pension schemes from the requirement to obtain consent when dealing with sensitive personal data (data relating to race, political opinions, religious beliefs, health, trade union membership, sex life, sexual orientation etc). In a pension scheme
context, sensitive personal data could arise in connection with applications for ill-health pensions or ‘expression of wish’ forms which could indicate someone’s political beliefs or sexual orientation.
It had been hoped that this derogation would exempt occupational pension schemes from the need to obtain explicit consent for processing sensitive personal data in a wide range of circumstances (although the original drafting was not clear). However, it now appears from a Government amendment introduced at the Commons Committee stage that the intention was only ever to replicate an exemption in existing legislation where health data is being collected on a data subject who is a family member of a member of the scheme. In practice, pension schemes do not routinely collect data on the health of family members so this exemption is of very limited effect. It therefore now seems likely that pension schemes will need to obtain explicit consent when processing sensitive personal data.