Risk and Compliance monthly update - September 2019

Risk and Compliance monthly update - September 2019

This month we cover issues including Brexit, crime prevention, AML & counter-terrorists financing and GDPR as well as a Q&A on money laundering.

In this issue:

  • Brexit
  • Crime prevention
  • AML & counter-terrorist financing
  • GDPR and data protection
  • Information management & security 

Brexit 

Brexit the final countdown?

Has the House of Commons missed its opportunity to avert a no-deal Brexit? Malcolm Dowden, Legal Director at Womble Bond Dickinson (UK) LLP considers the options, concluding that it would take a seismic shift in the current political and administrative position to prevent, or even delay, Brexit. Meantime, lawyers, individuals, and businesses must work with the available facts, and prepare for no-deal as a foreseeable outcome. See News Analysis:

The Law Society has published an update on its bilateral discussions with EU bars on post-Brexit relations. It says the Law Society would de facto no longer be a full member of the Council of Bars and Law Societies of Europe in the event of a no-deal Brexit as the UK delegation would have severely limited participation. The Society also sets out the current state of play in relation to Belgium, France and Germany. See: .

The University College London European Institute has raised serious concerns over the no-deal Brexit arrangements for personal data flows between the EU and the UK, particularly regarding the economic sphere. The Institute highlights that 75% of the UK’s international data flows are with the EU, and much UK economic activity is dependent on these flows. Therefore, the Institute warns of significant disruption to EU–UK personal data flows in the event of a no-deal Brexit which would result in no adequacy decision. See: .

John Binns, partner in the business crime and corporate regulatory department of BCL Solicitors LLP and member of the Lexis®PSL Corporate Crime Consulting Editorial Board, considers the potential impact of Brexit on the UK’s anti-money laundering laws. See News Analysis:

No-deal Brexit guidance

Government departments have issued various new and updated guidance to help stakeholders prepare for leaving the EU without a deal in place, including:

—the Department for International Trade has published a series of high-level summaries of agreements being put in place to replicate or ‘rollover’ various trade arrangements that the UK currently participates in by virtue of EU membership. See:

—the Ministry of Justice has published revised guidance for lawyers and legal services providers. See:

—the Department for Business, Energy & Industrial Strategy (BEIS) has published new guidance on how cross-border business operations and European specific corporate entities would be affected if there’s a no-deal Brexit. See:

—BEIS has also published new guidance on geo-blocking of online content after Brexit. See:

—BEIS has also published new guidance on the subject of consumer rights and business. See:

Crime prevention

Corporate co-operation and DPAS

The Serious Fraud Office (SFO) has updated its operational handbook with a chapter on ‘Corporate Co-operation Guidance’. The guidance is intended to assist organisations in understanding what will be expected of them in order for their work to count as co-operation for the purposes of a deferred prosecution agreement (DPA). See: .

Pam Shearing, director and solicitor, and Rubi Palmieri, solicitor, both at Fulcrum Chambers Ltd, consider the implications of the updated corporate co-operation guidance. See News Analysis: .

On 4 July 2019, court approval was given to a DPA between the SFO and Serco Geografix Ltd (SGL).Quinton Newcomb, barrister and Ed Pearson, solicitor, at Fulcrum Chambers, analyse the judge’s decision and explain that the case highlights the significant level of co-operation that will be required in order to secure a court approved DPA. See News Analysis: .

The Office of Financial Sanctions Implementation (OFSI) has announced that it has ‘substantially increased the scope and ambition’ of its international engagement. The OFSI has also confirmed that it will be extending its initiative to include not just bilateral and multilateral meetings, but to provide technical assistance to other governments. See: .

On 30 August 2019, OFSI will update its links to the consolidated list, the system it uses to publish the details of individuals and entities subject to financial sanctions. This will require any bookmarks to the old links for each format to be updated to the new links. OFSI will also be publishing the consolidated list in .xml format, in addition to the current formats, and is introducing a new search tool to help navigate the list to identify targets of financial sanctions more easily. The updated links will be published on the OFSI section of the GOV.UK website. See: .

US President Donald Trump has signed an executive order imposing sweeping sanctions on the Venezuelan Government. The order imposes blocks or freezes on all property and interests in property of the Government of Venezuela that are in the US, come within the US, and/or come within the possession or control of any US person. It also blocks any transactions in respect of the same. This impacts the ability of US persons to transact with the Government of Venezuela, or persons in which the Government of Venezuela owns, directly or indirectly, a 50% or greater interest. See: .

The past few weeks saw a flurry of activity demonstrating that imposition and enforcement of US economic sanctions against not only Venezuela, but also Russia and Iran—and by extension China—continues to be a key driver for the Trump administration in confronting foreign policy challenges, say US lawyers at Kirkland & Ellis LLP. See News Analysis: .

Corporate and economic crime

From the acquittal of former Barclays boss John Varley to the conclusion of the Serious Fraud Office’s long-running benchmark-rigging prosecutions, the first half of 2019 has been packed with corporate crime verdicts. See News Analysis: .

Following publication by the UK government of their landmark Economic Crime Plan 2019–2022, Quinton Newcomb, barrister and director at Fulcrum Chambers and member of the Lexis®PSL Corporate Crime consulting editorial board, considers the government’s priorities for the next three years for fighting economic crime in the UK and other jurisdictions. See News Analysis: .

AML & counter-terrorist financing

European developments 

The European Union will attempt to revive a blacklist of foreign countries that pose money laundering risks. See News Analysis: .

Rachel Cook, senior associate at Peters and Peters, considers a communication adopted by European Commission, along with four associated reports designed to support EU and national authorities in addressing money laundering and terrorist financing risks. See News Analysis: .

FATF

The Financial Action Task Force (FATF) has published an updated overview of the anti-money laundering (AML) and counter-terrorist financing (CTF) ratings of the 205 jurisdictions that have committed to implementing the FATF Recommendations. It has also published follow-up reports on the AML and CTF regimes in Bangladesh, Cambodia, Fiji and Myanmar. See: .

Beneficial ownership

BEIS has published its report into the ‘costs, benefits and overall effectiveness’ of the People of Significant Control register. See: .

GDPR Data protection

Data subject access requests  

The ICO has announced it has â€‹updated its guidance around how long an organisation has to respond to a data subject request under the GDPR. The guidance previously stated that requests must be responded to within one calendar month, with the day after receipt counting as ‘day one’. This has now changed. See: .

An article in the July issue of Privacy and Data Protection highlights three cases in the UK which illustrate the current trends and issues with data subject access requests. See: .


GDPR in the workplace 

One year on from the frantic scramble to introduce policies, processes and procedures to ensure compliance with the General Data Protection Regulation (GDPR), employers are beginning to consider whether those policies and procedures are fit for purpose. See: .

An employer in Greece has been fined €150,000 for relying on consent as the basis on which it processed employee data. See News Analysis: .


 Transparency 

It is important to make sure that data decision makers within an organisation know that transparency is not a one-off compliance task, and that transparency needs to be regularly revisited. See: .


ICO updates 

UK Information Commissioner, Elizabeth Denham has written a blog on the subject of personal data and what aspects people are most concerned about. See: .

The Information Commissioner has also published a blog post on progress of a new code designed to protect children online, translating principles from the GDPR. See: .

The Information Commissioner has said she is ‘deeply concerned about the growing use of facial recognition technology (FRT) in public spaces’ in a statement addressing the use of live facial recognition technology in King's Cross, London. William Richmond-Coggan, partner at Freeths specialising in data protection, says increasing scrutiny on the use of FRT ‘is only right’, and warns ‘[w]ith all of the coverage and guidance out there, it is inexcusable for businesses to be using facial recognition in the wild’. See: .

The Information Commissioner’s Office (ICO) has published a blog on the safety steps organisations should prioritise and implement when using solely automated artificial intelligence (AI) systems to make decisions which will significantly impact data subjects. The blog post is part of the ICO’s ongoing call for input on developing its framework for auditing AI. See: .

A separate blog post considers how organisations developing AI can ensure compliance with data minimalisation requirements. It covers different techniques organisations can adopt to develop AI systems using as little personal data as possible. See: .



Information management & security
Privacy information management

The International Organization for Standardization has released the world’s first International Standard on the subject of privacy information management (ISO/IEC 27701). See: .


 Trackers

Lexis®PSL Risk & Compliance has a dedicated area on the Key Resources section of the home page that tracks interesting and important cases, legislation, consultations and other key developments in the world of risk & compliance. For more information, see:

Latest Q&As

New Q&A added this month:

Updated Q&A:



Related Articles:
Latest Articles:
About the author:
Allison is a former partner of Shoosmiths, with extensive experience of legal management and practice compliance.