Contract analysis

1. Executive Summary The purpose of this memorandum is to provide Northgate Telecommunications PLC ("NTP" or the "Company") with a comprehensive analysis of how the United Kingdom General Data Protection Regulation (the "UK GDPR"), as retained in domestic law by the European Union (Withdrawal) Act 2018 and supplemented by the Data Protection Act 2018 (the "DPA 2018"), has diverged — and is expected to further diverge

2. Background: The Post-Brexit Data Protection Landscape 2.1 Legislative Framework — UK GDPR The UK GDPR was created by operation of the European Union (Withdrawal) Act 2018 (the "Withdrawal Act"), which retained the EU GDPR as part of domestic law with effect from the end of the transition period on 31 December 2020. The Withdrawal Act, together with the Data Protection, Privacy and Electronic Communications (Amendm

3. International Data Transfer Mechanisms 3.1 Overview of Divergence International data transfer mechanisms represent the most significant area of post-Brexit divergence between the UK GDPR and the EU GDPR. Since the end of the transition period, the UK and the EU have operated entirely independent transfer mechanism regimes. This divergence is of particular urgency for NTP given the active DPC preliminary inquiry (r

4. Regulatory Supervision and Enforcement 4.1 UK: The ICO The Information Commissioner's Office is the sole supervisory authority for all personal data processing carried out under the UK GDPR. NTP PLC is registered with the ICO under Registration Number ZA482917. The ICO has a broad range of enforcement powers under the UK GDPR and the DPA 2018, including the following: (a) Information notices (Section 142 DPA 2018)

5. Adequacy Decisions 5.1 EU Adequacy Decision for the UK On 28 June 2021, the European Commission adopted an adequacy decision for the United Kingdom pursuant to Article 45 of the EU GDPR (Commission Implementing Decision (EU) 2021/1772). The adequacy decision recognises that the United Kingdom provides an essentially equivalent level of protection for personal data to that guaranteed within the EU, and it permits t

6. Substantive GDPR Provisions: Areas of Current and Emerging Divergence 6.1 Lawful Basis — Legitimate Interest

Article 6(1)(f) of both the UK GDPR and the EU GDPR provides that processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The statutory text of this provision remains substantively aligned across both regimes. However, materi

Article 37 of both the UK GDPR and the EU GDPR requires the mandatory appointment of a Data Protection Officer in specified circumstances, including where the core activities of the controller consist of processing operations which, by virtue of their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale. NTP falls squarely within this requirement given the nature and

Article 22 of both the UK GDPR and the EU GDPR provides data subjects with the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. This provision is currently aligned in statutory text across both regimes. NTP's processing activities include several instances of automated decision-making and profiling that enga