Contract analysis

1. Executive Summary The purpose of this report is to provide the Audit & Risk Committee of Northgate Telecommunications PLC ("NTP" or the "Company") with a consolidated summary of all Data Protection Impact Assessments ("DPIAs") completed during Phase 3 of the Company's comprehensive GDPR compliance programme build. This report is intended to serve both as a board-level summary of the DPIA outcomes and as a standing

2. Legal and Regulatory Framework 2.1 DPIA Obligation under GDPR and UK GDPR The obligation to conduct a Data Protection Impact Assessment arises under Article 35 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, in respect of the Company's UK operations, under Article 35 of the UK GDPR (the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection,

Article 35(1) provides that where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is "likely to result in a high risk to the rights and freedoms of natural persons", the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data

Article 35(3) identifies three categories of processing that are mandatorily subject to a DPIA: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large sca

1. Evaluation or scoring (including profiling and predicting);

2. Automated decision-making with legal or similarly significant effect;

4. Sensitive data or data of a highly personal nature;

5. Data processed on a large scale;

6. Matching or combining datasets;

7. Data concerning vulnerable data subjects;

8. Innovative use or applying new technological or organisational solutions; and

9. Processing that in itself prevents data subjects from exercising a right or using a service or a contract. The ICO's published guidance on DPIAs (last updated March 2023) applies these criteria in the UK context and provides a screening checklist that NTP has adopted, in conjunction with the EDPB Guidelines, as the basis for identifying processing activities requiring a DPIA.

Article 36 GDPR / UK GDPR requires that where a DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller cannot sufficiently mitigate the residual risk, the controller must consult the relevant supervisory authority prior to the processing. As set out in Section 4.2 below, no prior consultation was required in respect of

3. DPIA Summary Register 3.1 Register Overview Table The following table provides a summary view of all 11 DPIAs completed during Phase 3. Detailed summaries of each DPIA are provided in Sections 3.2 through 3.12 below. The risk rating distribution across the 11 DPIAs is as follows: 5 high-risk (45.5%), 4 medium-risk (36.4%), and 2 low-risk (18.2%). Detailed analysis of the risk distribution and cross-cutting themes

1. Algorithmic bias leading to discriminatory treatment: The churn prediction model may produce systematically different outcomes for different demographic groups if training data reflects historical biases. For example, if certain customer segments have historically received poorer service, the model may predict higher churn for those segments and inadvertently reinforce differential treatment through targeted reten

2. Lack of transparency to data subjects regarding profiling logic: At the time of this DPIA, NTP's privacy notice did not contain sufficiently detailed information about the existence of the churn prediction model, the logic involved, or the significance and envisaged consequences of the profiling for data subjects, as required by Articles 13(2)(f) and 14(2)(g) GDPR.

3. Potential for re-identification of pseudonymised datasets: The model processes pseudonymised data internally, but the combination of multiple data sources creates a re-identification risk if access controls are not rigorously maintained.

4. Risk of automated decisions producing legal or similarly significant effects without human intervention: If retention interventions triggered by the model (such as service modifications, contractual changes, or pricing adjustments) are implemented without human review, there is a risk that automated decisions may produce effects on data subjects that are legal or similarly significant within the meaning of Article

1. Human-in-the-loop review: No automated retention action that modifies the terms of a subscriber's contract, applies differential pricing, or results in any other outcome with legal or similarly significant effects is to be implemented without prior human review and approval by a member of the retention team.

2. Data minimisation: Only features that are necessary and relevant to the churn prediction objective are retained in the model input. A feature relevance review is to be conducted quarterly to identify and remove redundant or disproportionate data inputs.

3. Model explainability requirements: The data science team is implementing SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) outputs for each individual prediction, enabling human reviewers and, where requested by data subjects, providing meaningful explanations of the factors contributing to individual churn scores.

4. Bias auditing on a quarterly cycle: A structured bias audit is to be conducted quarterly, analysing model outputs across protected characteristics (where such data is available for audit purposes) to identify and remediate any discriminatory patterns. The first bias audit is scheduled for Q4 2023.

5. Enhanced transparency in privacy notice: NTP's privacy notice is to be updated to include clear, accessible information about the churn prediction model, including the categories of data used, the logic involved, the significance and envisaged consequences of the profiling, and the data subject's rights in relation to profiling.

6. Data subject right to object to profiling: NTP will implement a clear and accessible mechanism for data subjects to exercise their right to object to profiling under Article 21 GDPR, with objections processed in accordance with the statutory timeframe. Mitigation Status: Measures are being implemented by Laura Dearden's engineering team in coordination with the data science function. Target completion for all meas

1. Potential for surveillance-like monitoring of communications patterns: While the system processes metadata rather than content, the analysis of communications patterns (who communicates with whom, when, and for how long) can reveal sensitive information about data subjects' private lives, social connections, and behaviours.

2. Risk of location tracking: The use of cell tower data and IP addresses for anomaly detection creates a capability for location tracking of individual subscribers, even if this is not the stated purpose of the processing.

3. Data minimisation concerns regarding retention of granular metadata: At the time of the DPIA, granular individual-level metadata was retained for network optimisation purposes beyond the period necessary for real-time security monitoring, raising data minimisation concerns. Mitigation Measures:

1. Aggregation of data within 24 hours for non-security purposes: Individual-level granular metadata used for network optimisation (as opposed to security purposes) is aggregated within 24 hours of collection, ensuring that ongoing analytics operate on aggregated, non-individual-level data.

2. Access controls limiting analyst access to individual-level data: Access to individual-level metadata is restricted through role-based access controls to authorised security analysts within the CISO's team, with all access logged and subject to periodic audit.

3. Retention period capped at 12 months for security data: Individual-level metadata retained for security purposes is subject to a maximum retention period of 12 months, after which it is securely deleted.

4. Pseudonymisation at ingestion: Subscriber identifiers are pseudonymised at the point of ingestion into the anomaly detection system, with the re-identification key held separately under strict access controls. Mitigation Status: All mitigation measures have been implemented. Technical controls were already substantially in place prior to the DPIA; the DPIA resulted in the formalisation of the 24-hour aggregation r

1. Coercive consent due to employment relationship power imbalance: The primary risk identified in this DPIA is that employees may feel pressured to participate in the NorthPulse platform, or may fear adverse consequences from non-participation, notwithstanding the Company's stated commitment to voluntary participation. In the employment context, the power imbalance between employer and employee is well recognised by

2. Risk of individual identification from team-level aggregate reports in small teams: Where team sizes are small (e.g., fewer than 10 members), aggregated team wellbeing scores may inadvertently enable the identification of individual respondents' data, particularly where certain team members are known not to have participated.

3. Potential for use in performance management decisions despite stated wellbeing purpose: There is a risk of function creep, whereby wellbeing data, or insights derived from wellbeing data, could be used by line managers or the People & HR function in performance management, disciplinary, or termination decisions, contrary to the stated purpose of the processing.

4. Data security of sensitive health information: The processing of health-related data creates a heightened security risk, as any breach of this data could cause significant distress and harm to affected employees. Mitigation Measures:

1. Voluntary participation with no adverse consequences for non-participation: A documented policy commitment has been obtained from Philippa Crane (Head of People & HR) confirming that participation in NorthPulse is entirely voluntary and that no adverse employment consequences will follow from a decision not to participate. This commitment is communicated to employees at the point of consent collection and is refle

2. Anonymisation of aggregate reports with minimum group size of 10: Team-level aggregate wellbeing reports will only be generated and made available to line managers where the team consists of a minimum of 10 participating employees, thereby minimising the risk of re-identification.

3. Strict purpose limitation: A binding internal policy has been adopted providing that NorthPulse data cannot be used for performance management, disciplinary, or termination decisions under any circumstances. This policy is enforceable through the Company's internal disciplinary procedures and has been communicated to all line managers.

4. Enhanced access controls: Access to individual-level NorthPulse data is restricted through role-based access controls to authorised members of the People & HR function and the occupational health team on a strict need-to-know basis. All access is logged and subject to periodic audit.

5. Data minimisation: Only data that is necessary for the stated wellbeing objectives is collected through the NorthPulse platform. The categories of data collected have been reviewed and reduced to exclude information not directly relevant to employee wellbeing assessment.

6. Regular consent renewal: Consent for participation in NorthPulse is renewed annually. Employees are provided with a clear and accessible mechanism to withdraw consent at any time, with immediate effect. Consultation: This DPIA was conducted in consultation with Philippa Crane (Head of People & HR) and representatives of NTP's employee representative forums, who were briefed on the DPIA process and invited to provi

1. Tracking of individuals via persistent device identifiers: If MAC addresses are not randomised or hashed, persistent device identifiers could be used to track the movement of individuals over time and across multiple locations within the pilot area.

2. Lack of data subject awareness: Members of the public passing through the pilot area are unlikely to be aware that their device data is being captured, and it is inherently difficult to provide meaningful individual privacy notices to passers-by.

3. Difficulty in providing meaningful privacy notice: The challenge of informing transient members of the public about the processing in a way that is accessible and meaningful is a recognised difficulty with IoT deployments in public spaces.

4. Data retention concerns: Retention of granular location-derived data beyond the period necessary for real-time analytics creates a risk of enabling retrospective tracking of individual movements. Mitigation Measures:

1. MAC address randomisation/hashing at point of collection: All MAC addresses captured from Wi-Fi probe requests are immediately hashed using a salted cryptographic hash function at the point of collection, preventing the retention of persistent device identifiers.

2. Retention limited to 7 days for granular data: Granular device-level data is retained for a maximum of 7 days, after which it is aggregated to a level that does not permit the identification of individual devices.

3. Signage deployed at pilot locations informing of processing: Prominent signage has been deployed at the perimeter of the pilot area and at key locations within it, informing members of the public that IoT sensors are in operation, that device data may be captured, and directing individuals to NTP's privacy notice for further information.

4. Data minimisation: No attempt is made to identify individual data subjects from the device data collected. The purpose of the processing is limited to aggregate analytics.

5. Opt-out mechanism via publicly available web form: A web form has been published on NTP's website allowing individuals to register the MAC address of their device for exclusion from data capture, providing a practical (if imperfect) opt-out mechanism. Mitigation Status: All mitigation measures have been implemented. Residual Risk: Low. The residual risk is assessed as low following the implementation of mitigation

1. Irrevocability of biometric data if compromised: Unlike passwords or access cards, fingerprint data is inherently irrevocable — if biometric templates are compromised, the data subject cannot change their fingerprints. This creates a heightened security imperative.

2. Cross-border considerations for German and Dutch operations: Germany (Northgate GmbH, Friedrichstraße 91, Berlin) and the Netherlands (Northgate B.V., Amsterdam) have stricter national requirements regarding biometric data processing in the workplace, including Works Council consultation obligations under the German Works Constitution Act (Betriebsverfassungsgesetz) and the Dutch Works Councils Act (Wet op de Onde

3. Proportionality of biometric vs. alternative access methods: The proportionality of using biometric access control (as opposed to less intrusive alternatives such as access cards, PIN codes, or multi-factor authentication without biometrics) was assessed as part of this DPIA. Mitigation Measures:

1. Biometric templates stored locally on access cards: Fingerprint templates are stored locally on the individual's access card (using secure element technology) and are not held in any centralised database. Authentication is performed through on-card matching, reducing the risk of large-scale compromise.

2. Template deletion upon termination of access rights: Biometric templates are securely deleted from access cards upon the termination of an individual's access rights (whether due to role change, contract end, or employment termination). A documented process ensures deletion within 5 business days of access rights revocation.

3. Alternative non-biometric access available upon request: Individuals who do not wish to use biometric access may request an alternative non-biometric access method (access card with PIN), ensuring that biometric access is not compulsory.

4. Encryption of template data: All biometric template data is encrypted using AES-256 encryption, both on the access card secure element and during any communication with the access control reader.

5. Jurisdiction-specific consent processes: For the German operations (Northgate GmbH), the Works Council (Betriebsrat) was consulted in accordance with Section 87(1)(6) of the Works Constitution Act. For the Dutch operations (Northgate B.V.), the relevant employee representation body was consulted. Explicit consent is obtained from employees at both locations as the Article 9 condition, supplementing the substantial

1. Automated refusal of service without human review: The credit scoring system has the capability to automatically decline contract applications that fall below a defined credit threshold, potentially without any human review, which would engage Article 22 GDPR (right not to be subject to solely automated decision-making producing legal effects).