Tough new EU data protection rules risk hindering compliance investigations by cross-border asset managers, according to experts.

The General Data Protection Regulation, which came into force in May last year, aims to strengthen individual data protection rights and contains strict provisions regarding the handling of personal data.

However, experts say the rules are also making it difficult for companies to carry out investigations as they may need access to data such as email communications or human resources records.

The scope of data covered under GDPR is very wide and includes any data that could be used to identify an individual either directly or indirectly.

This could include identifiers such as names, identification numbers, location data or any other information that may denote the physical, mental, genetic, economic, cultural or social identity of an individual.

Two people working on investigations for asset managers say GDPR is proving to be an obstacle to their inquiries.

One reason for this is that under GDPR firms must communicate with data subjects, and in certain cases ask for consent, to be able to process their data.

Further complexity arises if a firm is transferring data outside the European Economic Area as transfer of personal data outside the EEA is subject to specific mechanisms within the legislation, including an adequacy decision from the European Commission.

However, there is no adequacy decision between the EU and the US, which is making it difficult for US firms to carry out investigations of European staff and transfer data from the EU to the US.

Firms have also been unable in some cases to hand over the information on individuals required by the US Securities and Exchange Commission as they have been unable to obtain consent to do so.

This is despite a co-operation agreement having been agreed in February between the European Securities and Markets Authority and the International Organization of Securities Commissions to smooth the transfer of personal data between EU states and third-country regulators.

This is because an internal investigation is often not regarded as a sufficient reason to require access to personal data, according to one person with knowledge of the situation.

In addition the wide range of data a firm may need to access in the early stages of an investigation can make it harder for that justification to be obtained.

Edward Machin, associate at Ropes & Gray, adds that there is "a considerable list of obligations" for firms to comply with when carrying out investigations under GDPR.

"They are going from nought to 60 very quickly," he says.

However, Mr Machin adds that there is also "a misunderstanding" as to the extent to which GDPR will stymie attempts to obtain the necessary data for an investigation.

He says: "GDPR has made clear that obtaining employee consent is very difficult [and] people think that consent must be obtained every time they want to transfer data.

"If they have a legal basis to transfer that data, they do not need to obtain consent."

Chris Wrigley, associate director at Osborne Clarke, adds that "the bar has been raised" under GDPR for firms to justify requiring access to personal employee data without needing consent from employees.

However, Mr Wrigley says "serious misconduct or illegality would [still] be expected to pass that test".

Warnings over GDPR effect on compliance investigations

or

Quick links:

Most Popular