PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED ATTORNEY WORK PRODUCT
REGULATORY RISK ASSESSMENT MEMORANDUM
Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN
FROM: Sara Hendricks, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC
CC: Kevin Ostrowski, Responsible Partner, Privacy & Data Security, Calderwood & Harkness LLP Rachel Bernstein, Billing Partner, Privacy & Data Security, Calderwood & Harkness LLP
DATE: 27 March 2023
RE: Regulatory Risk Assessment — Northgate Telecommunications PLC (Company Number: 04837291)
ENGAGEMENT REFERENCE: SC/NTP/2023-0213/PDS
This memorandum is a Phase 1 deliverable prepared in advance of and concurrent with the Gap Analysis Report to be delivered on 31 March 2023. This memorandum is protected by attorney-client privilege and the work product doctrine. It has been prepared solely for the use of the named recipients and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
1. Executive Summary
This memorandum has been prepared by Calderwood & Harkness LLP ("C&H") at the instruction of Northgate Telecommunications PLC ("NTP" or the "Company") to assess the Company's current regulatory risk exposure under the UK General Data Protection Regulation ("UK GDPR"), the European Union General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), and the Data Protection Act 2018 ("DPA 2018"). This assessment is undertaken in the specific context of (i) prior enforcement action taken by the Information Commissioner's Office ("ICO") and (ii) an active preliminary inquiry initiated by the Irish Data Protection Commission ("DPC"). The memorandum forms part of the Phase 1 deliverables under C&H's engagement with NTP, alongside the comprehensive Gap Analysis Report to be delivered on 31 March 2023.
NTP operates fixed-line and mobile telecommunications services in the United Kingdom and a cloud-based unified communications platform marketed under the brand name "NorthCloud," which is sold on a business-to-business basis across fourteen EU/EEA member states. The Company maintains data centres in London, Frankfurt, Amsterdam, and Dublin, through which it processes significant volumes of personal data. At the date of this memorandum, NTP processes the personal data of approximately 6.3 million consumer subscribers, approximately 42,000 enterprise clients, approximately 11,400 employees, and approximately 28,000 additional data subjects encompassing contractors, temporary workers, job applicants, and website visitors.
Two principal regulatory matters require assessment in this memorandum:
(1) ICO Enforcement Notice (ENF/2021/0934). On 15 September 2021, the ICO issued an Enforcement Notice to NTP imposing a monetary penalty of £320,000 in connection with inadequate consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal. Remediation was completed in March 2022 and the penalty has been paid in full. Despite the closure of this matter, residual reputational risk and recidivism risk remain, as the enforcement history is publicly accessible and may be treated as an aggravating factor in any future regulatory action.
(2) DPC (Ireland) Preliminary Inquiry (IN-22-11-3). In November 2022, the DPC opened a preliminary inquiry into cross-border data transfers from Northgate Ireland Ltd, NTP's Irish subsidiary and EU operational headquarters, to US-based data processors. This inquiry remains active at the date of this memorandum. The inquiry raises fundamental questions about the adequacy of NTP's international data transfer mechanisms in the period following the Court of Justice of the European Union's landmark judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II").
Based on our assessment, we have assigned NTP an overall regulatory risk rating of HIGH. This rating reflects the combination of the Company's enforcement history, the active DPC inquiry, incomplete international transfer mechanisms in the post-Schrems II landscape, the significant scale of data processing across multiple jurisdictions, and the potential financial exposure under GDPR Article 83 administrative fines provisions. Our key recommendation is that NTP prioritise the remediation of its international data transfer mechanisms as a matter of urgency, both to address the DPC inquiry and to reduce the Company's overall regulatory exposure across both the UK and EU data protection regimes.
2. Background and Context
2.1 Corporate Structure and Data Processing Scale
Northgate Telecommunications PLC is a public limited company incorporated in England and Wales under Company Number 04837291. Its registered office is located at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office is located at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP's shares are admitted to the premium listing segment of the Official List of the Financial Conduct Authority and to trading on the London Stock Exchange's Main Market.
For the financial year ended 31 December 2022, NTP reported consolidated group revenue of £2.47 billion. The Company employs approximately 11,400 individuals globally, of whom approximately 8,200 are located in the United Kingdom and the European Union.
NTP's EU operations are conducted through a number of wholly-owned subsidiaries, the principal entities of which are as follows:
NTP's registration with the Information Commissioner's Office bears registration number ZA482917. This registration is current and up to date as at the date of this memorandum.
By reason of NTP's establishment in Ireland through Northgate Ireland Ltd, the DPC serves as NTP's lead supervisory authority for the purposes of EU GDPR enforcement under the one-stop-shop mechanism established by Article 56 of the EU GDPR. This designation is significant because it means that the DPC has primary jurisdiction over any cross-border processing activity carried out by NTP's EU establishments, with other EU/EEA data protection authorities participating through the consistency mechanism set out in Articles 60 to 67 of the EU GDPR.
2.2 Genesis of Current Engagement
The current engagement between NTP and Calderwood & Harkness LLP arose from a resolution of the NTP Board Audit & Risk Committee dated 8 December 2022. That resolution mandated a comprehensive GDPR compliance programme build, to be supported by external counsel engagement, with the objective of achieving a materially enhanced compliance posture by the end of Q3 2023. The resolution was adopted in the wake of the DPC's notification to Northgate Ireland Ltd of the commencement of preliminary inquiry IN-22-11-3 in November 2022, and in recognition of the broader compliance gaps identified by the Company's Data Protection Officer, Sanjay Mehta.
Calderwood & Harkness LLP was formally engaged on 13 February 2023 pursuant to an engagement letter bearing reference SC/NTP/2023-0213/PDS. The scope of work is structured as a five-phase engagement:
Phase 1 — Assessment & Gap Analysis. Comprehensive regulatory risk assessment (this memorandum) and gap analysis report, to be delivered by 31 March 2023.
Phase 2 — ROPA & Data Mapping. Build-out of a complete Record of Processing Activities ("ROPA") across all UK and EU operations, encompassing all 147 processing activities identified in preliminary scoping, together with associated data mapping. Target completion: May 2023.
Phase 3 — Data Protection Impact Assessments (DPIAs). Completion of DPIAs for all eleven identified high-risk processing activities, with accompanying Board-level summary register. Target completion: June 2023.
Phase 4 — Transfer Mechanisms. Remediation of all international data transfer mechanisms, including execution of updated EU Standard Contractual Clauses, UK International Data Transfer Agreements, Transfer Impact Assessments, and implementation of supplementary measures. Target completion: August 2023.
Phase 5 — Policies & Governance. Development and implementation of a comprehensive data protection governance framework, including group policies, data subject rights procedures, breach notification procedures, training programme, and ongoing monitoring mechanisms. Target completion: September 2023.
This memorandum forms part of the Phase 1 deliverables. It should be read in conjunction with the Gap Analysis Report to be delivered on 31 March 2023, which provides detailed findings across all compliance areas.
2.3 Key Data Processing Relationships Relevant to Regulatory Risk
In the course of our preliminary assessment, we have identified a number of third-party data processing relationships that give rise to material regulatory risk. These relationships are set out below and are considered in further detail in subsequent sections of this memorandum.
Caldwell Analytics Inc. Caldwell Analytics Inc. is a Delaware corporation with its principal office at 2700 Technology Drive, Suite 400, San Jose, California 95134. Caldwell provides AI-driven network analytics and predictive maintenance services to NTP. In the course of providing these services, Caldwell processes subscriber metadata, location data, and device identifiers on behalf of NTP. Caldwell's processing is governed by a Master Services Agreement dated 1 June 2021 (the "Caldwell MSA"). As a US-based processor, any transfer of personal data from NTP to Caldwell requires a valid international data transfer mechanism under Chapter V of the EU GDPR (or the equivalent UK GDPR provisions). The adequacy of the transfer mechanism in place with Caldwell is the primary subject of the DPC's inquiry IN-22-11-3, and accordingly represents the most significant single regulatory risk item identified in this assessment.
Pinnacle Cloud Services Ltd. Pinnacle Cloud Services Ltd (Company Number 09142837) is a UK company with its principal office at Apex House, 24 Victoria Embankment, London EC4Y 0DZ. Pinnacle provides cloud infrastructure and hosting services for the NorthCloud platform and NTP's internal enterprise systems. Pinnacle's data processing agreement with NTP permits the use of sub-processors, including Pinnacle India Pvt Ltd (CIN U72200HR2016PTC065412, Gurugram, India) and Pinnacle APAC Pte Ltd (UEN 201824567K, Singapore). The engagement of these sub-processors gives rise to international data transfer obligations that must be addressed through appropriate transfer mechanisms, including EU SCCs (Module 3, processor-to-processor) and/or the UK Addendum to the EU SCCs, as applicable.
Sunderland-Hayes Payroll Services Inc. Sunderland-Hayes Payroll Services Inc. is a Delaware corporation with offices at 1400 Broadway, Suite 2200, New York, New York 10018. Sunderland-Hayes provides cross-border payroll processing services for approximately 45 NTP expatriate employees. The transfer of employee personal data from NTP's UK and EU operations to Sunderland-Hayes in the United States requires appropriate SCCs, which have not been formally documented at the date of this memorandum.
Moritaka Systems K.K. Moritaka Systems K.K. is a Japanese corporation based in Tokyo. NTP has entered into an IoT analytics partnership with Moritaka involving approximately 12,000 device endpoints. Japan benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2019/419 of 23 January 2019), which reduces but does not eliminate transfer risk. However, the data processing arrangements with Moritaka should be formalised and documented as part of the broader remediation programme.
3. Analysis of ICO Enforcement Notice (ENF/2021/0934)
3.1 Summary of Enforcement Action
On 15 September 2021, the Information Commissioner's Office issued Enforcement Notice reference ENF/2021/0934 to Northgate Telecommunications PLC. The enforcement action arose from an ICO investigation into NTP's consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal.
The investigation identified that NTP had failed to obtain valid consent from users of the NorthCloud portal before placing non-essential cookies on their devices, in contravention of Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). Specifically, the ICO found that the NorthCloud portal's cookie banner had been configured to deploy analytics and advertising cookies by default, with only a pre-ticked checkbox that users could uncheck to opt out. This mechanism failed to satisfy the requirements for valid consent under both PECR Regulation 6 and the related UK GDPR provisions on consent (Article 6(1)(a) and Article 7), which require a clear affirmative act by the data subject.
The ICO's findings included the following:
(a) The cookie banner displayed on the NorthCloud portal did not provide users with a genuine choice to accept or reject non-essential cookies prior to their deployment;
(b) The pre-ticked checkbox mechanism did not constitute valid consent within the meaning of Article 4(11) of the UK GDPR, read in conjunction with PECR Regulation 6;
(c) The privacy information provided to users about the nature and purpose of cookies deployed on the portal was insufficient to enable informed consent;
(d) NTP had failed to maintain adequate records demonstrating the basis on which cookies were placed on users' devices, as required to satisfy its accountability obligations under Article 5(2) of the UK GDPR.
A monetary penalty of £320,000 was imposed. This penalty has been paid in full. NTP undertook remediation measures that were completed in March 2022, comprising: (i) a comprehensive redesign of the NorthCloud portal cookie banner to implement a granular consent mechanism with clearly labelled "Accept All" and "Reject All" options, together with a "Manage Preferences" link enabling category-level consent choices; (ii) implementation of a consent management platform ("CMP") with server-side enforcement to ensure that non-essential cookies are not deployed until valid consent is recorded; and (iii) establishment of an audit trail for consent records, accessible via the CMP dashboard.
3.2 Residual Risk from Prior Enforcement
Whilst the ICO enforcement action has been concluded and remediation completed, the prior enforcement history creates residual risk for NTP in several respects.
Recidivism risk. The ICO's published Regulatory Action Policy identifies "any previous enforcement action" taken against a data controller as a relevant factor in determining the appropriate level of any future regulatory sanction. Where a data controller has been the subject of prior enforcement action, the ICO may treat a subsequent contravention as demonstrating a pattern of non-compliance, potentially resulting in aggravated penalties. This is of particular concern given that NTP's 2021 enforcement action was related to consent mechanisms and transparency obligations — themes that are closely connected to a number of the compliance gaps identified in our preliminary assessment, including the NorthCloud privacy notice, the marketing profiling activities to be assessed in DPIA-007, and the broader data subject rights framework.
Public record and reputational impact. NTP's enforcement history is publicly available on the ICO's enforcement register and has been the subject of trade press coverage. Any future enforcement proceedings or adverse regulatory findings would be assessed against the backdrop of this prior enforcement, and media coverage would likely reference the prior action, compounding reputational damage. In a business-to-business context, enterprise clients conducting due diligence on NTP's data protection practices may also identify the prior enforcement from the ICO's public register.
Internal controls weaknesses. The deficiencies identified in the 2021 ICO investigation — in particular, the absence of adequate consent records and the failure to implement privacy-by-design principles in the NorthCloud portal — may be cited by regulators if similar internal controls weaknesses emerge in relation to other processing activities. This underscores the importance of ensuring that the GDPR compliance programme addresses consent mechanisms and transparency obligations comprehensively across all NTP products and services.
Relevance to current engagement. The ICO enforcement action demonstrates a pattern concern around consent and transparency that should inform the prioritisation of work across the current engagement. In particular, the revision of the NorthCloud privacy notice and the completion of DPIA-007 (marketing profiling activities, including freemium tier user analytics) should incorporate lessons learned from the 2021 enforcement, and should be designed to demonstrate that NTP has implemented robust, organisation-wide improvements to its consent and transparency practices.
3.3 Current ICO Relationship and Ongoing Compliance
NTP's ICO registration (ZA482917) is current and up to date. There are no outstanding ICO investigations or inquiries at the date of this memorandum. The ICO has not initiated any follow-up audit or monitoring activity in relation to the 2021 enforcement action.
We recommend that NTP maintain a proactive engagement posture with the ICO. In particular, NTP should ensure that any future personal data breaches reportable under Article 33 of the UK GDPR are notified promptly and with comprehensive supporting information, as the ICO would assess any such notification in the context of the prior enforcement history. Similarly, any pre-consultation with the ICO in respect of high-risk processing activities (for example, DPIA-008 in relation to facial recognition technology, discussed further below) should be approached with an awareness that the ICO may apply heightened scrutiny to NTP given its enforcement record.
Thomas Okoye, NTP's Chief Information Security Officer, should be briefed on the potential for the prior enforcement to affect the ICO's assessment of any future incident, and should ensure that the Company's breach detection and notification procedures are fully aligned with regulatory expectations. This issue is addressed further in the Gap Analysis Report.
4. Analysis of DPC Preliminary Inquiry (IN-22-11-3)
4.1 Summary of DPC Inquiry
In November 2022, the Data Protection Commission (Ireland) opened a preliminary inquiry under reference IN-22-11-3 into the cross-border data transfer practices of Northgate Ireland Ltd. Northgate Ireland Ltd (CRO 587214) is NTP's Irish subsidiary, registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, and serves as NTP's EU operational headquarters.
The inquiry is focused on the adequacy of the transfer mechanisms relied upon by Northgate Ireland Ltd for the transfer of personal data to processors established in the United States. The DPC's inquiry was initiated in the context of the post-Schrems II regulatory environment, in which the Court of Justice of the European Union invalidated the EU-US Privacy Shield framework and imposed heightened requirements on organisations relying on Standard Contractual Clauses as a transfer mechanism for data flows to the United States.
The DPC's role as lead supervisory authority for NTP's EU operations, established by reason of NTP's main establishment in Ireland under Article 56 of the EU GDPR, means that the scope of the inquiry is potentially broad. While the inquiry was initiated with specific reference to transfers from Northgate Ireland Ltd, the one-stop-shop mechanism means that the DPC may extend its consideration to encompass transfers from all of NTP's EU subsidiaries (including Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.) to the extent that those transfers form part of cross-border processing activities.
The inquiry remains active at the date of this memorandum. No formal findings have been issued, and the matter has not progressed beyond the preliminary inquiry stage. However, the DPC has requested that Northgate Ireland Ltd provide information concerning the transfer mechanisms in place for data flows to US-based processors, including Caldwell Analytics Inc. Marcus Engström, Head of EU Operations (Dublin), has been coordinating NTP's initial response to the DPC's information requests, with support from Sanjay Mehta (DPO).
The status of this inquiry is the most significant single regulatory risk item identified in this assessment.
4.2 Current Transfer Mechanism Deficiencies
Our preliminary assessment has identified material deficiencies in NTP's international data transfer mechanisms. These deficiencies are set out below.
NTP–Caldwell Analytics transfer. The Caldwell MSA, dated 1 June 2021, pre-dates the practical implementation of the new EU Standard Contractual Clauses adopted by the European Commission in its Implementing Decision (EU) 2021/914 of 4 June 2021. The data processing addendum appended to the Caldwell MSA references the now-superseded 2010 EU Model Clauses (Commission Decision 2010/87/EU), which were required to be replaced by the new SCCs by 27 December 2022 for contracts entered into after 27 June 2021, and by 27 December 2022 for all contracts. At the date of this memorandum, the Caldwell MSA has not been updated to incorporate the new EU SCCs. Moreover, no Transfer Impact Assessment ("TIA") has been conducted for the NTP-to-Caldwell data flow, as required by the Schrems II judgment to assess whether the legal framework of the recipient country (in this case, the United States) provides essentially equivalent protection for personal data. No supplementary measures have been formally documented.
Pinnacle Cloud Services sub-processor transfers. The data processing agreement between NTP and Pinnacle Cloud Services Ltd requires updating to address the onward transfer of personal data by Pinnacle to its sub-processors in India (Pinnacle India Pvt Ltd) and Singapore (Pinnacle APAC Pte Ltd). Appropriate SCCs (Module 3, processor to sub-processor) and/or the UK Addendum to the EU SCCs, as applicable, are required to provide a lawful basis for these transfers. At present, no such clauses are incorporated into the sub-processing arrangements.
Sunderland-Hayes payroll transfer. The cross-border payroll processing arrangement with Sunderland-Hayes Payroll Services Inc. involves the transfer of employee personal data from NTP's UK and EU operations to the United States. This transfer lacks documented Standard Contractual Clauses and no TIA has been conducted.
Moritaka Systems transfer. While Japan benefits from an EU adequacy decision, the data processing arrangements with Moritaka Systems K.K. have not been formalised through a compliant data processing agreement addressing the requirements of Article 28 of the EU GDPR. This gap should be addressed as part of the broader remediation programme.
These deficiencies collectively create material exposure to DPC enforcement action. The absence of updated SCCs and TIAs for the Caldwell transfer is of particular concern given that it is the primary focus of the DPC's inquiry.
4.3 Nature of Data Transferred to Caldwell Analytics
The data transferred from NTP to Caldwell Analytics Inc. comprises pseudonymised subscriber analytics data, including the following categories of personal data:
(a) Subscriber metadata: information relating to the characteristics of subscriber accounts, including account tenure, service tier, usage patterns, and billing information (excluding payment card data);
(b) Location data: cell tower connection data, approximate geolocation data derived from network access patterns, and Wi-Fi connection logs;
(c) Device identifiers: IMEI numbers, IMSI numbers, MAC addresses, and device model/firmware identifiers.
This data originates from NTP's network operations and relates to the Company's base of approximately 6.3 million consumer subscribers across the United Kingdom and, where NorthCloud users access services through mobile networks, EU/EEA member states.
The processing purpose is AI-driven network analytics and predictive maintenance. Caldwell's proprietary machine learning models analyse the data to identify network performance anomalies, predict equipment failures, and optimise network resource allocation.
The volume and sensitivity of this data are significant for regulatory risk purposes. Location data is classified as potentially sensitive under data protection law, as it can reveal detailed information about an individual's movements, habits, and associations. While the data is pseudonymised prior to transfer (direct identifiers such as subscriber name and contact details are replaced with unique pseudonymous identifiers), the European Data Protection Board ("EDPB") has confirmed that pseudonymised data remains personal data, as re-identification is possible by the data controller (in this case, NTP) through the use of the pseudonymisation key. Device identifiers such as IMEI and IMSI numbers are also capable of constituting personal data, as they can be linked to individual subscribers.
The scale of processing — encompassing data relating to approximately 6.3 million subscribers — means that any enforcement action arising from transfer mechanism deficiencies would be assessed as affecting a large number of data subjects, a factor that is relevant to the severity assessment under Article 83(2) of the EU GDPR.
4.4 DPC Enforcement Powers and Precedent
The DPC's enforcement powers under Chapter VIII of the EU GDPR (Articles 58 and 83) are extensive and include the following corrective measures:
(a) Warnings and reprimands: the DPC may issue warnings or reprimands to NTP where processing operations are likely to, or have, infringed the GDPR (Article 58(2)(a)–(b));
(b) Orders to bring processing into compliance: the DPC may order NTP to bring its processing operations into conformity with the GDPR, including by specifying the manner and timeframe within which compliance must be achieved (Article 58(2)(d));
(c) Orders to suspend data flows: the DPC may order the suspension of data flows to a third country recipient where it determines that the transfer does not comply with the requirements of Chapter V of the GDPR (Article 58(2)(j));
(d) Administrative fines: the DPC may impose administrative fines in accordance with Article 83 of the GDPR (discussed in Section 5 below).
The DPC has demonstrated its willingness to exercise these powers in cross-border transfer cases. Notably, in its decision of September 2021 relating to Meridian Services Inc. Ireland Designated Activity Company, the DPC imposed a fine of €225 million (subsequently upheld on appeal) for transparency violations. More directly relevant, the DPC's enforcement actions concerning international data transfers — including its landmark decision of May 2023 imposing a €1.2 billion fine and transfer suspension order in the Adriatic Enterprises Ireland case — demonstrate the DPC's capacity and willingness to impose severe sanctions for inadequate transfer mechanisms. While NTP's data processing activities are of a different nature and scale than those at issue in the Meta case, the precedent underscores the seriousness with which the DPC approaches transfer mechanism compliance.
The potential outcomes of the DPC inquiry IN-22-11-3 include:
(a) Order to suspend transfers to US-based processors: such an order would directly impact NTP's data flows to Caldwell Analytics and would require NTP either to (i) cease the Caldwell analytics processing entirely, (ii) identify an alternative processor established within the EU/EEA, or (iii) bring the transfer mechanism into compliance and obtain DPC approval to resume transfers. A transfer suspension order would have immediate operational impact on NTP's network analytics capabilities, as the Caldwell platform is currently integrated into NTP's network management infrastructure;
(b) Administrative fine under Article 83: the DPC may impose an administrative fine calculated in accordance with the framework discussed in Section 5 below;
(c) Requirement to implement specific supplementary measures: the DPC may require NTP to implement specified technical, organisational, or contractual supplementary measures and to report back to the DPC within a defined timeframe.
Timeline risk. The DPC may escalate the inquiry from a preliminary inquiry to a formal investigation if NTP does not demonstrate timely and substantive remediation. The longer the deficiencies persist, the greater the risk that the DPC will characterise NTP's conduct as reflecting a wilful or negligent failure to comply, rather than a good-faith remediation effort.
4.5 Recommended Response Strategy
We recommend that NTP adopt the following response strategy in relation to the DPC inquiry:
Prioritisation of Phase 4 workstream. The international data transfer mechanisms workstream (Phase 4 of the engagement plan) should be brought forward and prioritised as a matter of urgency. While the original engagement timeline envisaged this workstream commencing in July 2023, we recommend that preparatory work begin immediately alongside Phase 2 (ROPA & Data Mapping), with the objective of executing updated transfer agreements and completing TIAs by early August 2023 at the latest.
Updated EU SCCs with Caldwell Analytics. NTP should execute updated EU Standard Contractual Clauses with Caldwell Analytics Inc., utilising Module 2 (Controller to Processor) of the SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914. These SCCs must be supplemented by the completion of a comprehensive Transfer Impact Assessment and the documentation and implementation of appropriate supplementary measures. We understand that Caldwell's external counsel is Hargrove Lister & Webb LLP, with Natalie Prescott (Partner, Data Privacy & Cybersecurity) at the firm's London office at 30 Fenchurch Street, London EC3M 3BD, acting as lead. We recommend early engagement with Ms Prescott's team to initiate SCC negotiations and to coordinate on the TIA, as the assessment will require input from Caldwell regarding the US legal framework and the practical likelihood of US government access requests.
Transfer Impact Assessment. A comprehensive TIA must be conducted for the NTP-to-Caldwell data flow. This assessment must analyse the US legal framework, with specific reference to:
(i) Section 702 of the Foreign intelligence Surveillance Act ("FISA"), which authorises the US government to compel US electronic communications service providers to provide access to the communications of non-US persons located outside the United States;
(ii) Executive Order 12333, which authorises certain US intelligence agencies to collect foreign intelligence information, including through the interception of communications;
(iii) The Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"), which requires US service providers to comply with US legal process for the production of data, regardless of where that data is stored.
The TIA should assess whether Caldwell is likely to fall within the scope of these authorities and, if so, whether the supplementary measures implemented by NTP and Caldwell are sufficient to ensure essentially equivalent protection for the transferred data. In conducting this assessment, regard should be had to the EDPB Recommendations 01/2020 on measures that supplement transfer tools and to Executive Order 14086 of 7 October 2022 on Enhancing Safeguards for United States signals intelligence Activities, which introduced additional protections for EU personal data but has not yet been the subject of an adequacy decision.
Supplementary measures. The following supplementary measures should be implemented for the Caldwell transfer:
(i) AES-256 encryption at rest for all personal data stored on Caldwell's systems;
(ii) TLS 1.3 encryption in transit for all data flows between NTP and Caldwell;
(iii) Pseudonymisation of direct identifiers prior to transfer, with the pseudonymisation key retained exclusively by NTP within the EU/UK and not shared with Caldwell;
(iv) Contractual audit rights enabling NTP (or a mandated third-party auditor) to conduct on-site or remote audits of Caldwell's data processing activities and security measures;
(v) Contractual notification obligations requiring Caldwell to notify NTP promptly of any government access request received in respect of NTP data, to the extent permitted by applicable law.
Parallel remediation. Concurrent with the Caldwell remediation, NTP should:
(i) Amend the Pinnacle Cloud Services data processing agreement to incorporate sub-processor SCCs (Module 3) and/or the UK Addendum for the Pinnacle India and Pinnacle APAC transfers;
(ii) Execute SCCs with Sunderland-Hayes Payroll Services Inc. for the cross-border payroll transfer;
(iii) Formalise the data processing arrangements with Moritaka Systems K.K. through a compliant Article 28 data processing agreement.
DPC inquiry response. A comprehensive response to the DPC inquiry should be prepared demonstrating the remediation steps taken, including copies of the executed SCCs, the completed TIA, and documentation of the supplementary measures implemented. This response should be submitted to the DPC by early September 2023 at the latest. We recommend that the response be framed as evidence of NTP's proactive and comprehensive remediation programme, undertaken in good faith and with the engagement of external counsel and technical advisors.
Internal coordination. Sanjay Mehta (DPO) should serve as the designated signatory for all DPC correspondence, with support from Marcus Engström (Head of EU Operations, Dublin), who is most closely positioned to coordinate with the DPC on matters relating to Northgate Ireland Ltd. Fiona Gallagher (General Counsel) should maintain oversight of the inquiry response at the group level, and Thomas Okoye (CISO) should be involved in the implementation and documentation of supplementary technical measures.
5. GDPR Article 83 Administrative Fines Framework — Potential Exposure
5.1 Fining Framework Overview
Article 83 of the EU GDPR (and the corresponding provisions of the UK GDPR, read with sections 155 to 157 of the DPA 2018) establishes a two-tier administrative fines framework. The relevant tiers are set out below.
Higher tier (Article 83(5)). The higher tier provides for administrative fines of up to €20 million, or up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. This tier applies to infringements of, inter alia:
(a) The basic principles for processing, including the lawfulness, fairness, and transparency principle, purpose limitation, data minimisation, and accuracy (Articles 5 and 6);
(b) The conditions for consent and the processing of special categories of personal data (Articles 7 and 9);
(c) Data subjects' rights, including the right of access, rectification, erasure, restriction of processing, data portability, and the right to object (Articles 12 to 22);
(d) The conditions for international transfers of personal data (Articles 44 to 49).
The international transfer provisions at Articles 44 to 49 fall within the higher tier. Accordingly, any infringement arising from NTP's transfer mechanism deficiencies — including the matters under investigation by the DPC — would attract fines calculated under this tier.
For NTP, the higher tier maximum fine, calculated as 4% of the Company's FY 2022 consolidated group revenue of £2.47 billion, amounts to approximately £98.8 million.
Lower tier (Article 83(4)). The lower tier provides for administrative fines of up to €10 million, or up to 2% of total worldwide annual turnover, whichever is higher. This tier applies to infringements of, inter alia:
(a) Controller and processor obligations, including data protection by design and by default (Article 25);
(b) Requirements for data processing agreements (Article 28);
(c) Records of processing activities (Article 30);
(d) Personal data breach notification obligations (Articles 33 and 34);
(e) Data protection impact assessment requirements (Articles 35 and 36).
For NTP, the lower tier maximum fine, calculated as 2% of £2.47 billion, amounts to approximately £49.4 million.
5.2 Factors Affecting Fine Calculation (Article 83(2))
Article 83(2) of the EU GDPR sets out a non-exhaustive list of factors that supervisory authorities must take into account when determining the amount of any administrative fine. Our assessment of these factors as they apply to NTP is set out below.
(a) Nature, gravity, and duration of the infringement. NTP's international data transfer mechanism deficiencies have persisted since at least the date of the Schrems II judgment on 16 July 2020. As of the date of the opening of this engagement, the deficiencies had been in existence for approximately two and a half years. This prolonged duration is likely to be viewed as an aggravating factor by the DPC. The gravity of the infringement is heightened by the volume of data transferred (subscriber data relating to approximately 6.3 million individuals) and the nature of the data (including location data and device identifiers).
(b) Intentional or negligent character. NTP's failure to update its transfer mechanisms following the Schrems II judgment and the adoption of the new EU SCCs is unlikely to be characterised as intentional. However, given the extensive industry-wide awareness of Schrems II obligations, the publication of EDPB guidance on supplementary measures (adopted in June 2021), and the transition deadline for legacy SCCs (27 December 2022), the DPC may well characterise NTP's conduct as negligent. Negligent infringements, while generally attracting lower fines than intentional ones, remain subject to significant penalties under the GDPR framework.
(c) Actions taken to mitigate. NTP's decision to engage external counsel, commission a comprehensive GDPR compliance programme, and undertake proactive remediation of its transfer mechanisms should be presented to the DPC as evidence of the Company's commitment to compliance. This will serve as a mitigating factor in any fine calculation. The timing of remediation relative to the DPC's inquiry will be important — remediation completed before any formal decision by the DPC will carry more weight as a mitigating factor than remediation undertaken only in response to an enforcement order.
(d) Degree of responsibility. As the data controller, NTP bears primary responsibility for ensuring that adequate transfer mechanisms are in place before personal data is transferred to processors in third countries. While Caldwell Analytics (as processor) has certain obligations under the GDPR, the controller's accountability obligations under Articles 5(2) and 24 mean that NTP cannot deflect responsibility to its processors.
(e) Previous infringements. The ICO Enforcement Notice ENF/2021/0934 (£320,000 fine) represents a prior data protection infringement by NTP. While this enforcement action was taken by a different supervisory authority (the ICO rather than the DPC) and concerned a different subject matter (consent mechanisms for marketing cookies under PECR, rather than international data transfers under GDPR Chapter V), the DPC may nonetheless treat it as relevant context in its assessment of NTP's overall compliance culture. Article 83(2)(e) refers broadly to "any relevant previous infringements" by the controller, without limiting this consideration to infringements found by the same supervisory authority.
(f) Degree of cooperation. NTP's cooperative engagement with the DPC inquiry will be a mitigating factor. We strongly recommend that NTP continue to respond promptly and substantively to all DPC information requests, and that it adopt a posture of transparency and proactive disclosure throughout the inquiry process.
(g) Categories of personal data affected. The personal data affected by the transfer mechanism deficiencies includes subscriber metadata, location data, and device identifiers. While these categories do not constitute special category data within the meaning of Article 9 of the EU GDPR, location data in particular is regarded as sensitive by nature, as it is capable of revealing intimate details about an individual's movements, associations, and daily life. The EDPB has consistently emphasised the sensitivity of location data in its guidance and enforcement practice.
(h) Number of data subjects affected. The transfers to Caldwell Analytics relate to data derived from NTP's subscriber base of approximately 6.3 million individuals. The large number of data subjects affected is an aggravating factor under Article 83(2)(a).
5.3 Realistic Exposure Assessment
Based on the foregoing analysis, we assess NTP's potential financial exposure as follows:
Our assessment of the realistic exposure range of £1 million to £10 million takes into account the following considerations: (i) the DPC has typically imposed fines at a fraction of the theoretical maximum, except in cases involving the most serious and prolonged infringements by the largest data controllers; (ii) NTP's proactive remediation programme, if completed in a timely manner, should be treated as a significant mitigating factor; (iii) the negligent (rather than intentional) character of the infringement limits the likely fine level; (iv) however, the prolonged duration of the deficiencies (approximately 2.5 years), the prior ICO enforcement action, and the scale and sensitivity of the data involved are aggravating factors that may push the fine towards the higher end of the range.
Non-financial risks. In addition to the direct financial exposure from administrative fines, NTP faces significant non-financial regulatory risks:
(a) Transfer suspension orders. An order by the DPC to suspend data transfers to Caldwell Analytics would have immediate operational impact on NTP's network analytics and predictive maintenance capabilities. NTP's technical teams have confirmed that the Caldwell platform is currently deeply integrated into NTP's network management infrastructure, and that a sudden cessation of the Caldwell data flow would impair NTP's ability to conduct real-time network performance monitoring and predictive maintenance for a period of approximately three to six months, pending the implementation of an alternative solution;
(b) Reputational damage. DPC enforcement decisions are published in full and attract significant media and industry attention. A public finding of GDPR non-compliance, particularly in relation to international data transfers in the post-Schrems II environment, would be likely to receive extensive coverage in trade and mainstream press, with potential adverse impacts on NTP's brand, investor confidence, and enterprise client relationships;
(c) Mandatory public disclosure. DPC enforcement decisions are publicly available, and NTP may be required to disclose the outcome of the DPC inquiry in its annual report and financial statements, depending on materiality;
(d) Impact on enterprise client confidence. NTP's enterprise clients — approximately 42,000 organisations — rely on NTP as a data processor in the context of the NorthCloud platform. A regulatory finding of transfer mechanism non-compliance may cause enterprise clients to re-evaluate their data processing arrangements with NTP, request enhanced contractual protections, or in some cases terminate their agreements.
Audit implications. Whitmore Kendall LLP (Eleanor Trask, Engagement Partner, Audit & Assurance) should be apprised of the regulatory risks identified in this memorandum. GDPR compliance-related contingent liabilities and regulatory risk disclosures may affect NTP's annual report risk disclosures, notes to the financial statements, and internal controls attestations. We recommend that Fiona Gallagher liaise with Ms Trask to ensure that the audit team has sufficient visibility into the compliance programme and the DPC inquiry to make appropriate disclosure determinations.
6. UK GDPR-Specific Regulatory Risk Considerations
6.1 ICO Fining Powers Under UK GDPR
Following the United Kingdom's withdrawal from the European Union, the UK GDPR operates as a standalone data protection regime, with the Information Commissioner's Office serving as the independent supervisory authority. The ICO retains its own fining powers, independent of the DPC and other EU supervisory authorities.
Under the UK GDPR, read with sections 155 to 157 of the DPA 2018, the ICO may impose monetary penalties of up to £17.5 million or 4% of total worldwide annual turnover (whichever is higher) for the most serious infringements, including violations of the data processing principles, data subject rights, and international transfer conditions. For NTP, the applicable maximum under the UK regime would be 4% of £2.47 billion, or approximately £98.8 million, mirroring the EU framework.
While the ICO has historically imposed fines at lower levels than certain EU counterparts — a tendency that has been attributed to the ICO's practice of applying significant discounts for cooperation, early payment, and remediation — there are indications that the ICO's enforcement appetite is increasing. The ICO's 2022–2025 regulatory strategy, ICO25, signals a shift towards more proactive and outcome-focused enforcement, with a particular emphasis on holding organisations to account for systemic compliance failures.
NTP's UK operations encompass 89 processing activities identified in the preliminary data mapping exercise. These activities fall solely under ICO jurisdiction and include NTP's consumer telecommunications services, employee data processing, marketing activities, and the UK elements of the NorthCloud platform. Any compliance deficiencies in these areas expose NTP to ICO enforcement action independent of, and in addition to, any action taken by the DPC in respect of EU operations.
The ICO's prior enforcement action against NTP (ENF/2021/0934) creates a heightened risk factor in this context, as discussed in Section 3.2 above.
6.2 Dual-Regime Regulatory Risk
NTP occupies the position of being subject to both the UK GDPR (enforced by the ICO) and the EU GDPR (enforced by the DPC as lead supervisory authority, with other EU DPAs participating through the one-stop-shop mechanism). This dual-regime exposure creates a number of specific challenges.
Parallel investigations. Actions or omissions by NTP that affect both UK and EU data subjects may trigger parallel investigations by the ICO and the DPC (or other EU supervisory authorities). While the ICO and DPC have maintained cooperative working arrangements post-Brexit, they operate as independent regulators with separate enforcement mandates. There is no formal mechanism to prevent parallel proceedings, and NTP could in theory face fines from both regulators in respect of the same or related conduct, subject to principles of proportionality and non-duplication.
International transfer remediation. The international transfer deficiencies identified in this memorandum affect both UK and EU data flows. Remediation must address both regimes, which have adopted different but overlapping transfer tools:
(a) For EU transfers: the EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021;
(b) For UK transfers: the UK International Data Transfer Agreement ("UK IDTA"), published by the ICO and laid before Parliament on 2 February 2022, or the UK Addendum to the EU SCCs (the "UK Addendum"), which allows organisations to supplement the EU SCCs with UK-specific provisions.
NTP must ensure that its transfer agreements with Caldwell Analytics, Pinnacle Cloud Services, Sunderland-Hayes, and other relevant processors incorporate both EU SCCs and UK IDTA/Addendum provisions, as appropriate, to cover data flows originating from both UK and EU establishments.
Regulatory divergence. Post-Brexit divergence between the UK and EU data protection frameworks is an emerging risk factor. The UK Government's Data Protection and Digital Information Bill (introduced in the House of Commons in March 2023) proposes a number of amendments to the UK data protection framework that would create divergence from the EU GDPR, including changes to the legitimate interests balancing test, the data subject access rights framework, and the international transfer regime. If enacted, these changes could affect NTP's compliance posture and require separate compliance strategies for UK and EU operations. This issue is addressed in a separate advisory memorandum on UK GDPR vs. EU GDPR divergence, which will be circulated under separate cover.
7. Sector-Specific Regulatory Considerations
7.1 Telecommunications Sector Scrutiny
Telecommunications operators are subject to heightened regulatory scrutiny under data protection law by reason of the volume and sensitivity of the communications data they process. NTP's position as a provider of fixed-line and mobile telecommunications services, as well as a cloud-based unified communications platform, places it squarely within this heightened-scrutiny category.
The ePrivacy Directive (Directive 2002/58/EC), as transposed into UK law by the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), imposes specific obligations on telecommunications providers in relation to the confidentiality of communications, traffic data retention, location data processing, and the use of cookies and similar technologies. The 2021 ICO enforcement action against NTP (ENF/2021/0934) was grounded in PECR Regulation 6, and the ongoing relevance of PECR to NTP's operations underscores the importance of ensuring comprehensive compliance with both GDPR and PECR.
In addition, NTP's obligations under the Investigatory Powers Act 2016 ("IPA") and the Regulation of Investigatory Powers Act 2000 ("RIPA") create a tension with GDPR data minimisation principles. Under the IPA, telecommunications operators may be required to retain communications data for specified periods and to provide access to that data to authorised public authorities upon service of a valid data retention notice or interception warrant. These obligations may conflict with GDPR Article 5(1)(e) (storage limitation) and Article 5(1)(c) (data minimisation), and must be carefully managed through appropriate legal basis analysis and data retention policies. This issue is to be addressed in DPIA-010 as part of the Phase 3 workstream.
Both the ICO and the DPC have identified the telecommunications sector as a priority area for enforcement activity. The ICO's enforcement register includes a number of actions against telecoms providers, and the DPC has signalled its intention to increase scrutiny of large-scale data processing by technology and communications companies. NTP should be aware that, as a publicly listed telecoms operator with a significant consumer subscriber base, it is likely to attract a higher degree of regulatory attention than organisations in less data-intensive sectors.
7.2 NorthCloud SaaS Platform — Specific Risks
The NorthCloud unified communications platform presents a number of specific regulatory risks that warrant careful attention in the compliance programme.
Multi-jurisdictional exposure. NorthCloud operates across 14 EU/EEA member states, with enterprise clients and end-users located in each of these jurisdictions. While the one-stop-shop mechanism means that the DPC serves as lead supervisory authority, other EU DPAs retain the authority to handle complaints received from data subjects in their jurisdiction, and may raise objections to draft decisions of the DPC under the consistency mechanism. This creates the potential for NTP to be required to engage with multiple supervisory authorities simultaneously in relation to NorthCloud-related complaints or investigations.
Freemium tier marketing profiling. The NorthCloud platform offers a freemium tier that includes marketing profiling activities designed to encourage conversion to paid subscription plans. These profiling activities — which involve the analysis of user behaviour within the platform to generate targeted upgrade prompts and promotional offers — raise specific regulatory risks under Article 6 (lawful basis for processing), Article 13/14 (transparency), and Article 21 (right to object to profiling). These risks are to be assessed in detail in DPIA-007, which forms part of the Phase 3 workstream.
AI-driven customer churn prediction. NorthCloud's enterprise client management features include an AI-driven customer churn prediction model that analyses enterprise client usage patterns to identify clients at risk of non-renewal. To the extent that this model produces outputs that result in decisions with legal or similarly significant effects on individuals (for example, if churn predictions trigger changes to service levels or pricing for individual users within an enterprise client's account), the model may engage the requirements of Article 22 of the EU GDPR, which provides data subjects with the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. This risk is to be assessed in DPIA-001.
8. Risk Matrix and Prioritisation
8.1 Risk Summary Table
The following risk matrix summarises the principal regulatory risks identified in this assessment, together with our assessment of their likelihood, potential impact, and recommended priority for remediation.
8.2 Prioritised Remediation Recommendations
Based on the risk assessment set out above, we recommend the following prioritised remediation programme:
1. CRITICAL — International Data Transfer Mechanisms
This is the highest-priority remediation item and should be treated as urgent. The recommended actions are as follows:
(a) Execute updated EU Standard Contractual Clauses (Module 2, Controller to Processor) with Caldwell Analytics Inc., incorporating the full text of the SCCs adopted pursuant to Commission Implementing Decision (EU) 2021/914;
(b) Execute the UK International Data Transfer Agreement (or UK Addendum to the EU SCCs) with Caldwell Analytics to cover UK-originating data flows;
(c) Conduct a comprehensive Transfer Impact Assessment for the NTP-to-Caldwell data flow, analysing the US legal framework (FISA Section 702, EO 12333, CLOUD Act) and assessing the effectiveness of supplementary measures;
(d) Implement supplementary measures, including AES-256 encryption at rest, TLS 1.3 in transit, pseudonymisation of direct identifiers, and contractual audit and notification rights;
(e) Amend the Pinnacle Cloud Services data processing agreement to incorporate sub-processor SCCs (Module 3) and UK Addendum for transfers to Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd;
(f) Execute SCCs and UK IDTA with Sunderland-Hayes Payroll Services Inc.;
(g) Formalise data processing arrangements with Moritaka Systems K.K.;
(h) Prepare a comprehensive DPC inquiry response demonstrating completed remediation.
Target completion: All SCCs, UK IDTAs, and TIAs to be finalised by mid-August 2023, enabling DPC response submission by early September 2023 at the latest.
2. HIGH — DPIAs for High-Risk Processing
Complete Data Protection Impact Assessments for all eleven identified high-risk processing activities. In particular:
(a) DPIA-008 (facial recognition technology deployed for physical access control at Northgate Tower) should be treated as a priority, as it may require prior consultation with the ICO and/or DPC under Article 36, given the inherent high-risk nature of biometric data processing;
(b) DPIA-011 (Caldwell Analytics international data transfer) is directly relevant to the DPC inquiry and should be completed concurrently with the transfer mechanism remediation;
(c) DPIA-007 (NorthCloud freemium tier marketing profiling) should be prioritised given the link to NTP's prior ICO enforcement for consent mechanism deficiencies;
(d) DPIA-001 (AI-driven customer churn prediction) should address Article 22 automated decision-making requirements.