MEMORANDUM — PRIVILEGED AND CONFIDENTIAL
FROM: Rachel Bernstein, Billing Partner, Privacy & Data Security, Calderwood & Harkness LLP, One Moorgate Square, London EC2R 6AN
TO: Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC; Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC
DATE: 29 March 2023
RE: Post-Brexit Divergence Between UK GDPR and EU GDPR — Implications for Northgate Telecommunications PLC Dual-Regime Compliance Programme
ENGAGEMENT REFERENCE: SC/NTP/2023-0213/PDS
CLASSIFICATION: Attorney-Client Privileged / Legally Privileged
This memorandum is prepared by Calderwood & Harkness LLP for the sole use of the named addressees and is protected by legal professional privilege and, in respect of its US-nexus content, by the attorney-client privilege and work-product doctrine. This memorandum should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP. Unauthorised disclosure may result in a waiver of privilege. This memorandum accompanies the gap analysis report dated 31 March 2023 delivered under Phase 1 of the engagement.
Right-click to update Table of Contents
1. Executive Summary
The purpose of this memorandum is to provide Northgate Telecommunications PLC ("NTP" or the "Company") with a comprehensive analysis of how the United Kingdom General Data Protection Regulation (the "UK GDPR"), as retained in domestic law by the European Union (Withdrawal) Act 2018 and supplemented by the Data Protection Act 2018 (the "DPA 2018"), has diverged — and is expected to further diverge — from the General Data Protection Regulation of the European Union, Regulation (EU) 2016/679 (the "EU GDPR"). This memorandum is intended to inform the design and architecture of NTP's dual-regime compliance programme, which Calderwood & Harkness LLP ("C&H") has been engaged to build across a five-phase programme of work.
NTP is a public limited company (Company Number 04837291) incorporated in England and Wales, with its registered office at 140 Queensway Place, Reading, Berkshire RG1 4QT, and its principal office at Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. NTP operates telecommunications infrastructure and the NorthCloud SaaS platform across the United Kingdom and fourteen EU/EEA member states. NTP's EU operations are conducted through five wholly owned subsidiaries: Northgate Ireland Ltd (Ireland), Northgate GmbH (Germany), Northgate B.V. (Netherlands), Northgate France SAS (France), and Northgate Iberia S.L. (Spain). As a consequence of this corporate and operational footprint, NTP is subject to both the UK GDPR and the EU GDPR simultaneously.
The UK GDPR applies to the personal data processing carried out by NTP PLC in the United Kingdom, which our Phase 1 data mapping exercise has identified as encompassing eighty-nine (89) distinct processing activities recorded in the UK Records of Processing Activities ("ROPA"). The EU GDPR applies to the personal data processing carried out by each of NTP's five EU subsidiaries, which collectively encompass fifty-eight (58) processing activities across Ireland, Germany, the Netherlands, France, and Spain. The Company must comply with both regimes across the full range of its data processing operations.
This memorandum has been prepared in fulfilment of the Board Audit & Risk Committee resolution of 8 December 2022, which mandated the commissioning of a comprehensive GDPR compliance programme build. The resolution specifically directed the General Counsel to engage external advisors to assess dual-regime compliance risks, and this memorandum forms a foundational component of that assessment.
The key areas of divergence between the UK GDPR and the EU GDPR that are addressed in this memorandum include, but are not limited to, the following:
• International data transfer mechanisms, where the UK and EU now operate entirely independent regimes;
• Regulatory supervision, where the Information Commissioner's Office ("ICO") acts as the sole UK supervisory authority while the Data Protection Commission of Ireland (the "DPC") serves as lead supervisory authority for NTP's EU cross-border processing under the one-stop-shop mechanism;
• Adequacy decisions, where the EU's adequacy decision for the UK contains a sunset clause expiring on 27 June 2025 and where the UK may make independent adequacy determinations that diverge from those of the European Commission;
• Enforcement approach, where the ICO and DPC have adopted materially different postures and priorities; and
• Forthcoming UK legislative reform, principally through the Data Protection and Digital Information (No. 2) Bill (the "DPDI Bill"), which, if enacted, would create the most significant post-Brexit divergence from the EU GDPR.
We note at the outset that NTP's compliance posture under both regimes is a matter of heightened operational and reputational importance. The Company has experienced ICO enforcement action in the form of Enforcement Notice ENF/2021/0934, dated 15 September 2021, which imposed a fine of £320,000 for inadequate consent mechanisms for direct marketing cookies deployed on the NorthCloud customer portal. Remediation was completed in March 2022. Additionally, the DPC has opened a preliminary inquiry, reference IN-22-11-3, in November 2022, concerning cross-border data transfers from Northgate Ireland Ltd to United States-based processors. The existence of both a prior enforcement action and an active regulatory inquiry underscores the urgency of establishing a robust dual-regime compliance programme, and the analysis in this memorandum is intended to ensure that the programme's architecture appropriately addresses the divergence between the two regimes.
The balance of this memorandum is organised as follows: Section 2 sets out the legislative and regulatory background; Sections 3 through 6 analyse the principal areas of divergence in detail; Section 7 addresses anticipated UK legislative reform; Section 8 discusses the practical implications for NTP's compliance programme architecture; Section 9 provides a summary table of divergence areas; Section 10 consolidates our recommendations; and Section 11 concludes.
2. Background: The Post-Brexit Data Protection Landscape
2.1 Legislative Framework — UK GDPR
The UK GDPR was created by operation of the European Union (Withdrawal) Act 2018 (the "Withdrawal Act"), which retained the EU GDPR as part of domestic law with effect from the end of the transition period on 31 December 2020. The Withdrawal Act, together with the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419), made the necessary technical modifications to the retained text. These modifications principally involved replacing references to EU institutions, bodies, and legal instruments with their UK equivalents. For example, references to the European Commission were replaced with references to the Secretary of State; references to the European Data Protection Board ("EDPB") were replaced with references to the Information Commissioner; and references to "Union law" or "Member State law" were replaced with references to domestic legislation.
The UK GDPR does not operate in isolation. It is supplemented and modified by the DPA 2018, which contains UK-specific provisions that do not have direct equivalents in the EU framework. Of particular relevance to NTP are the following provisions of the DPA 2018:
(a) Schedules 2 and 3, which set out conditions for processing special categories of personal data and criminal conviction data, respectively, and which contain UK-specific exemptions;
(b) the immigration exemption in Schedule 2, paragraph 4 (the scope and lawfulness of which has been the subject of ongoing litigation and legislative amendment);
(c) the national security provisions in Part 4, which are applicable to telecommunications providers under certain circumstances;
(d) the provisions giving effect to the Age Appropriate Design Code (also known as the Children's Code), which imposes specific obligations on information society services likely to be accessed by children — relevant to NTP's NorthCloud consumer-facing services; and
(e) Section 119A, which provides the legal basis for the Secretary of State to approve international data transfer mechanisms, including the UK International Data Transfer Agreement.
The Information Commissioner's Office is the sole supervisory authority for data protection in the United Kingdom. Unlike the EU framework, which operates through a network of national data protection authorities coordinated through the one-stop-shop mechanism, the UK has a single, unified regulator with jurisdiction over all UK personal data processing. NTP's current ICO Registration Number is ZA482917.
2.2 Legislative Framework — EU GDPR
The EU GDPR, Regulation (EU) 2016/679, applies directly in all EU member states and, by virtue of the EEA Agreement, in Iceland, Liechtenstein, and Norway. As a directly applicable regulation, the EU GDPR does not require national transposition, although member states retain limited areas of discretion (so-called "opening clauses") to supplement certain provisions through national legislation. This has resulted in a degree of national variation across EU member states — for example, in the age of consent for information society services (Article 8), in the conditions for processing employment data, and in the requirements for Data Protection Impact Assessments.
Each EU member state maintains its own national data protection authority. The EU GDPR's one-stop-shop mechanism, established by Articles 56 and 60, designates a lead supervisory authority for controllers or processors engaged in cross-border processing. The lead authority is determined by the location of the controller's or processor's "main establishment" in the EU — that is, the place of its central administration or, if decisions on the purposes and means of processing are taken elsewhere, the establishment where such decisions are taken.
For NTP's EU operations, the lead supervisory authority is the Data Protection Commission of Ireland (the "DPC"). This designation arises by virtue of the location of NTP's main EU establishment at Northgate Ireland Ltd, which is incorporated in Ireland (Companies Registration Office Number 587214) and has its registered office at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92. Northgate Ireland Ltd serves as the central coordination point for NTP's EU data processing operations and is the entity through which NTP's EU-wide processing decisions are principally made.
The DPC's lead supervisory authority jurisdiction extends to the oversight of NTP's cross-border processing across all EU member states where NTP has an establishment, including:
(a) Northgate GmbH, registered in Berlin, Germany (Handelsregister Berlin-Charlottenburg, HRB 214503 B);
(b) Northgate B.V., registered in Amsterdam, the Netherlands (Kamer van Koophandel, KvK 72841936);
(c) Northgate France SAS, registered in Paris, France (Registre du Commerce et des Sociétés, SIREN 891 247 503); and
(d) Northgate Iberia S.L., registered in Madrid, Spain (Registro Mercantil de Madrid, CIF B-91847263).
The DPC exercises its lead authority role in coordination with the concerned supervisory authorities in each of these member states, namely the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the relevant Landesdatenschutzbeauftragte in Germany, the Autoriteit Persoonsgegevens in the Netherlands, the Commission nationale de l'informatique et des libertés (CNIL) in France, and the Agencia Española de Protección de Datos (AEPD) in Spain.
2.3 NTP's Dual-Regime Obligations
The practical scope of NTP's dual-regime obligations is substantial. Based on the data mapping exercise completed during Phase 1 of our engagement, NTP processes personal data relating to:
(a) approximately 6.3 million consumer subscribers across the UK and EU/EEA;
(b) approximately 42,000 enterprise clients;
(c) approximately 11,400 employees, of whom approximately 8,200 are located in the UK and EU/EEA;
(d) approximately 28,000 additional data subjects, including contractors, temporary workers, job applicants, and website visitors;
totalling approximately 6.38 million data subjects across both jurisdictions.
Our Phase 1 data mapping has identified a total of one hundred and forty-seven (147) distinct processing activities across the NTP group: eighty-nine (89) UK processing activities falling under the UK GDPR, and fifty-eight (58) EU processing activities falling under the EU GDPR. These processing activities span the full range of NTP's business operations, including subscriber management, billing and revenue assurance, network operations, marketing and customer engagement, human resources, procurement, corporate finance, regulatory compliance, and the NorthCloud SaaS platform.
NTP operates data centres at four locations that are directly relevant to its data protection obligations:
(a) London, United Kingdom (subject to UK GDPR);
(b) Frankfurt, Germany (subject to EU GDPR, under the supervisory oversight of the Hessische Beauftragte für Datenschutz und Informationsfreiheit as concerned authority, with the DPC as lead authority);
(c) Amsterdam, the Netherlands (subject to EU GDPR, under the supervisory oversight of the Autoriteit Persoonsgegevens as concerned authority, with the DPC as lead authority); and
(d) Dublin, Ireland (subject to EU GDPR, under the direct supervisory authority of the DPC).
The NorthCloud SaaS platform, which is sold on a business-to-business basis across fourteen EU/EEA member states, is subject to the EU GDPR in each of those member states. NTP acts as a processor on behalf of its NorthCloud enterprise clients for the personal data processed through the platform and as a controller for its own operational data (including platform usage analytics and account management data).
The practical implication of this dual-regime landscape is that NTP must maintain parallel compliance tracks in those areas where the UK GDPR and the EU GDPR have diverged or are expected to diverge, while avoiding unnecessary duplication of effort and resources in areas where the two regimes remain substantively aligned. The analysis that follows is intended to enable NTP to identify those areas of divergence and to design its compliance programme accordingly.
3. International Data Transfer Mechanisms
3.1 Overview of Divergence
International data transfer mechanisms represent the most significant area of post-Brexit divergence between the UK GDPR and the EU GDPR. Since the end of the transition period, the UK and the EU have operated entirely independent transfer mechanism regimes. This divergence is of particular urgency for NTP given the active DPC preliminary inquiry (reference IN-22-11-3), which was opened in November 2022 and concerns cross-border data transfers from Northgate Ireland Ltd to United States-based processors. The adequacy and documentation of NTP's international transfer mechanisms will be a central element of the DPC inquiry response, and deficiencies in transfer documentation represent a material regulatory risk.
Under both the UK GDPR and the EU GDPR, the transfer of personal data to a third country (i.e., a country outside the UK, in the case of the UK GDPR, or outside the EEA, in the case of the EU GDPR) is prohibited unless an appropriate safeguard is in place, an adequacy decision has been made, or a derogation applies. However, the specific mechanisms available and the documentation required to effect such transfers now differ between the two regimes.
3.2 EU Standard Contractual Clauses (EU SCCs)
The European Commission adopted new standard contractual clauses on 4 June 2021 by Commission Implementing Decision (EU) 2021/914, replacing the prior sets of standard contractual clauses adopted in 2001 (controller-to-controller) and 2010 (controller-to-processor). The new EU SCCs adopt a modular structure comprising four modules:
Module 1: Controller to Controller (C-to-C) — for transfers between two independent controllers;
Module 2: Controller to Processor (C-to-P) — for transfers from a data controller in the EEA to a data processor in a third country;
Module 3: Processor to Sub-Processor (P-to-Sub-P) — for transfers from a data processor in the EEA to a sub-processor in a third country; and
Module 4: Processor to Controller (P-to-C) — for transfers from a processor in the EEA back to a controller in a third country.
NTP's EU transfers currently rely upon the following EU SCC modules:
(a) Module 2 (Controller to Processor) is used for seven (7) transfers, including transfers from NTP's EU subsidiaries (acting as controllers) to third-country processors. The most significant of these transfers is the flow of subscriber analytics data from Northgate Ireland Ltd and Northgate GmbH to Caldwell Analytics Inc. ("Caldwell"), a Delaware C-Corporation with its principal place of business at 2700 Technology Drive, Suite 400, San Jose, California 95134. Caldwell processes subscriber behavioural analytics data, network performance data correlated with subscriber accounts, and marketing segmentation data on behalf of NTP's EU entities.
(b) Module 3 (Processor to Sub-Processor) is used for the sub-processor chain involving Pinnacle Cloud Services Ltd ("Pinnacle"), which acts as a processor for NTP and engages two sub-processors located in third countries: Pinnacle India Pvt Ltd (Tower B, Level 14, Cyber City, Gurugram 122002, Haryana, India; Corporate Identification Number U72200HR2016PTC065412) and Pinnacle APAC Pte Ltd (8 Marina View, #32-01 Asia Square Tower 1, Singapore 018960; Unique Entity Number 201824567K). The Pinnacle sub-processor chain supports cloud infrastructure management for NTP's NorthCloud platform.
It is critical to note that the EU SCCs adopted by Commission Implementing Decision (EU) 2021/914 are not directly applicable under UK law following the end of the transition period. They are instruments of EU law and have no legal force in the United Kingdom. Accordingly, NTP cannot rely upon EU SCCs alone to safeguard transfers of UK personal data to third countries.
3.3 UK International Data Transfer Agreement (UK IDTA)
In response to the post-Brexit need for an independent UK transfer mechanism, the ICO issued the UK International Data Transfer Agreement (the "UK IDTA") pursuant to Section 119A of the DPA 2018. The UK IDTA came into force on 21 March 2022 and is the UK's standalone transfer mechanism for transfers of personal data from the United Kingdom to third countries that have not been the subject of a UK adequacy decision.
The UK IDTA is a fundamentally different document from the EU SCCs. Rather than adopting the modular structure of the EU SCCs, the UK IDTA uses a mandatory four-part table structure that must be completed by the parties:
Table 1: Parties' details, including the data exporter and data importer, contact information, key contacts, and signatures;
Table 2: Transfer details, including the description of the transfer, the categories of data subjects, personal data, special categories of data, and the frequency and nature of the processing;
Table 3: Technical and organisational measures, including a description of the security measures the data importer will implement to protect the transferred personal data; and
Table 4: Commercial clauses, allowing the parties to incorporate the UK IDTA into a wider commercial agreement.
NTP currently uses the UK IDTA for three (3) transfers of UK personal data to third countries:
(a) to Caldwell Analytics Inc. in the United States (subscriber analytics data originating from UK operations);
(b) to Pinnacle India Pvt Ltd in India (cloud infrastructure management data originating from UK operations); and
(c) to Pinnacle APAC Pte Ltd in Singapore (cloud infrastructure management data originating from UK operations).
The UK IDTA can only be used for transfers of personal data that are subject to the UK GDPR. It cannot be used as a safeguard for transfers of personal data that are subject to the EU GDPR. This distinction is fundamental: a single UK IDTA cannot cover both UK-origin and EU-origin data in a single instrument.
3.4 UK Addendum to EU SCCs
In addition to the standalone UK IDTA, the ICO approved a UK Addendum to the EU SCCs (the "UK Addendum"). The UK Addendum is a supplementary document that can be appended to an existing set of EU SCCs to extend their coverage to transfers of UK personal data. It is designed for situations where parties have already entered into EU SCCs for their EU-origin data transfers and wish to use the same contractual framework, with appropriate UK-specific modifications, for their UK-origin data transfers as well.
NTP uses the UK Addendum for four (4) transfers where both the UK GDPR and the EU GDPR apply to the same data flow. This is the preferred approach for NTP's transfers that involve intermingled UK and EU personal data — for example, the NorthCloud platform data flows, where subscriber data from both UK and EU customers is processed through the same technical pipeline and routed to the same third-country processors (principally Caldwell Analytics). In such cases, the underlying EU SCCs govern the EU-origin data component, and the UK Addendum extends the same contractual protections to the UK-origin data component, adapted to reflect the requirements of the UK GDPR and the jurisdiction of the ICO.
The use of the UK Addendum rather than a standalone UK IDTA in these circumstances offers practical advantages: it avoids the need to maintain two entirely separate transfer agreements for the same data flow, and it ensures consistency of contractual terms across the UK and EU components of the transfer. However, the parties must ensure that the UK Addendum is properly completed (including by identifying the applicable EU SCC module, the start date, and whether either party can end the UK Addendum as set out in Section 19 of the Addendum).
3.5 Practical Implications for NTP
The divergence in international transfer mechanisms creates a significant documentation and compliance burden for NTP. The key practical implications are as follows:
Parallel documentation requirements. NTP must maintain parallel transfer mechanism documentation for all international data transfers: EU SCCs (under the appropriate module) for data originating under the EU GDPR, and either a UK IDTA or a UK Addendum for data originating under the UK GDPR. Where a single data flow contains both UK and EU personal data — which is common in NTP's unified NorthCloud infrastructure, where subscriber data from multiple jurisdictions flows through shared pipelines — both sets of clauses must be in place and properly executed.
Coordination with third-party recipients. NTP must ensure that its third-country data importers (principally Caldwell Analytics Inc. and the Pinnacle sub-processors) agree to and execute both the EU SCCs and the UK IDTA or UK Addendum, as applicable. This requires coordination with the importers' own legal advisors. Transfer documentation negotiations with Caldwell's external counsel, Hargrove Lister & Webb LLP (Natalie Prescott, Partner, Data Privacy & Cybersecurity; 555 Mission Street, Suite 3100, San Francisco, California 94105; London office at 30 Fenchurch Street, London EC3M 3BD), are currently in progress and must accommodate both the UK and EU regimes. We anticipate that the Caldwell SCCs and associated UK Addendum will be targeted for execution during Phase 4 of the engagement, commencing 10 July 2023, with a target execution date in July 2023.
Sub-processor chain management. The Pinnacle sub-processor chain adds a further layer of complexity. NTP must ensure that the Module 3 EU SCCs are in place between Pinnacle (as processor) and each of its sub-processors (Pinnacle India and Pinnacle APAC), and that equivalent UK IDTA or UK Addendum arrangements are in place for the UK-origin data component of those sub-processor transfers. NTP should exercise its contractual audit rights to verify that these mechanisms are properly documented at each level of the sub-processor chain.
Ongoing maintenance. Transfer mechanism documentation is not a one-time exercise. Changes in the data flows (e.g., addition of new sub-processors by Pinnacle, expansion of Caldwell's processing scope, onboarding of new third-country vendors) will require updates to the transfer documentation under both regimes. NTP should establish a process for ongoing review and maintenance of its transfer mechanism inventory.
3.6 Transfer Impact Assessments
Under both the UK GDPR and the EU GDPR, data exporters are required to conduct Transfer Impact Assessments ("TIAs") prior to effecting international data transfers. The purpose of a TIA is to evaluate whether the legal framework of the data importer's country provides an adequate level of protection for the transferred personal data, or whether supplementary measures are necessary to ensure that the transfer does not undermine the level of protection guaranteed by the applicable data protection regime.
The EU framework for TIAs is principally derived from the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, "Schrems II") and the EDPB's Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted on 10 November 2020 and subsequently revised on 18 June 2021). The EDPB Recommendations set out a six-step assessment framework that data exporters must follow.
The ICO has issued its own TIA guidance, which is broadly aligned with the EDPB framework but is not identical. The ICO's guidance reflects the UK GDPR's standard for international transfers (which refers to the transfer not undermining the level of protection afforded by UK data protection law) and takes into account the UK's own legal framework for government access to personal data. Accordingly, NTP's TIAs must address the requirements of both the EDPB Recommendations (for EU-origin transfers) and the ICO TIA guidance (for UK-origin transfers).
NTP has six (6) TIAs planned across the engagement. Each TIA must assess the legal framework of the relevant importer country — principally the United States (for Caldwell Analytics and other US-based vendors), India (for Pinnacle India), and Singapore (for Pinnacle APAC) — against the requirements of both regimes. Where both UK and EU personal data are involved in the same transfer, the TIA should address both the EU and UK standards in a single document, with clearly delineated sections addressing each regime's requirements.
The supplementary measures that NTP is anticipated to implement, based on our preliminary assessment of the relevant importer-country legal frameworks, include:
(a) encryption at rest using the AES-256 standard for all personal data stored in third-country environments;
(b) encryption in transit using TLS 1.3 for all personal data transmitted to and from third-country environments;
(c) pseudonymisation of direct identifiers (including subscriber names, email addresses, and telephone numbers) prior to transfer, where technically feasible given the processing purpose;
(d) contractual audit rights enabling NTP to conduct periodic audits of the data importer's compliance with the transfer mechanism and applicable supplementary measures; and
(e) data localisation requirements for certain categories of personal data (including special category data and data relating to minors) that may be restricted to UK/EU data centres.
The TIA programme will be further developed during Phase 3 of the engagement (commencing 22 May 2023), and the final TIA documentation will be prepared alongside the transfer mechanism execution in Phase 4.
4. Regulatory Supervision and Enforcement
4.1 UK: The ICO
The Information Commissioner's Office is the sole supervisory authority for all personal data processing carried out under the UK GDPR. NTP PLC is registered with the ICO under Registration Number ZA482917. The ICO has a broad range of enforcement powers under the UK GDPR and the DPA 2018, including the following:
(a) Information notices (Section 142 DPA 2018), requiring the provision of information to the Commissioner;
(b) Assessment notices (Section 146 DPA 2018), enabling the Commissioner to carry out data protection audits;
(c) Enforcement notices (Section 149 DPA 2018), requiring the controller or processor to take (or refrain from taking) specified steps to comply with the UK GDPR; and
(d) Penalty notices (Section 155 DPA 2018), imposing administrative fines of up to the higher of £17.5 million or 4% of the undertaking's total annual worldwide turnover in the preceding financial year.
For NTP, based on FY 2022 revenue of £2.47 billion, the maximum theoretical fine under the UK GDPR would be approximately £98.8 million (4% of £2.47 billion), significantly exceeding the £17.5 million statutory cap. This calculation underscores the materiality of UK GDPR compliance risk for NTP.
NTP has prior direct experience of ICO enforcement. On 15 September 2021, the ICO issued Enforcement Notice ENF/2021/0934 together with a monetary penalty notice imposing a fine of £320,000. The enforcement action related to NTP's deployment of inadequate consent mechanisms for direct marketing cookies on the NorthCloud customer portal. Specifically, the ICO found that NTP's cookie consent banner employed pre-ticked checkboxes and lacked a clear mechanism for users to refuse non-essential cookies, in contravention of Regulation 6 of the Privacy and Electronic Communications Regulations 2003 ("PECR") and Article 6(1)(a) of the UK GDPR. NTP completed the required remediation measures in March 2022, including the deployment of a redesigned consent management platform and the retroactive purging of data collected through non-compliant cookie mechanisms.
We note that the ICO's enforcement priorities have increasingly focused on adtech, cookies, and direct marketing — all areas of direct relevance to NTP's NorthCloud freemium tier marketing activities, which involve targeted advertising, user tracking, and conversion analytics. NTP should treat the prior enforcement action as a heightened risk factor that may increase the likelihood of further ICO scrutiny in these areas.
4.2 EU: The One-Stop-Shop Mechanism and the DPC
Under Articles 56 and 60 of the EU GDPR, the Data Protection Commission of Ireland serves as the lead supervisory authority for NTP's cross-border processing within the EU. As noted in Section 2.2 above, this designation arises by virtue of the establishment of Northgate Ireland Ltd as NTP's main EU establishment in Dublin.
The DPC's role as lead supervisory authority means that it has primary responsibility for investigating complaints and potential infringements involving NTP's cross-border EU processing, in coordination with the concerned supervisory authorities in Germany, the Netherlands, France, and Spain. The one-stop-shop mechanism is intended to provide a single point of regulatory contact for cross-border processing; however, the concerned authorities retain the right to raise reasoned objections to the lead authority's draft decision, and in cases of persistent disagreement, the matter may be referred to the EDPB for a binding decision under Article 65.
The DPC has opened a preliminary inquiry, reference IN-22-11-3, in November 2022, regarding cross-border data transfers from Northgate Ireland Ltd to US-based processors. This inquiry is understood to focus on the adequacy of the transfer mechanisms and supplementary measures in place for NTP's transfers of EU personal data to the United States in the post-Schrems II environment. The inquiry pre-dates the adoption of the EU-US Data Privacy Framework and relates to the transfer mechanisms in effect during the period under review.
The DPC's enforcement powers under the EU GDPR include the power to impose administrative fines of up to €20 million or 4% of annual worldwide turnover, whichever is higher. Based on NTP's FY 2022 revenue of £2.47 billion (approximately €2.87 billion at the average 2022 GBP/EUR exchange rate), the maximum theoretical fine under the EU GDPR would be approximately €115 million. The DPC has been among the most active EU data protection authorities in the enforcement of international transfer requirements, having issued a number of landmark decisions affecting major technology companies that set important precedents for the treatment of cross-border data transfers.
4.3 Divergence in Enforcement Approach
A notable area of divergence between the UK and EU data protection regimes relates not to the text of the legislation itself but to the enforcement approach and regulatory posture adopted by the respective supervisory authorities.
ICO approach. The ICO has signalled a more pragmatic, outcomes-focused enforcement posture. Under the leadership of the current Information Commissioner, the ICO's strategic plan (ICO25) has emphasised proportionality, engagement with regulated entities, and a focus on achieving practical improvements in data protection practices rather than imposing punitive fines. The ICO has introduced its Regulatory Action Policy, which sets out a graduated enforcement approach and prioritises engagement and guidance before formal enforcement action. The ICO has also introduced a voluntary "reprimand" as an alternative to monetary penalties in certain cases.
DPC approach. The DPC, by contrast, has pursued a more enforcement-oriented approach, particularly in the area of international data transfers. The DPC has issued several high-profile enforcement decisions imposing substantial administrative fines on technology companies for infringements relating to cross-border transfers, transparency obligations, and the lawful basis for processing. The DPC's approach reflects both its own regulatory priorities and the influence of the EDPB consistency mechanism, under which other EU data protection authorities have raised objections to DPC draft decisions and secured higher fines and broader corrective measures.
Implications for NTP. The divergence in enforcement approach means that NTP may face materially different regulatory expectations from its two primary supervisory authorities. An approach to compliance that satisfies the ICO's pragmatic standard may not satisfy the DPC's more rigorous expectations, and vice versa. NTP should design its compliance programme to the higher standard (generally the DPC/EU standard) and should avoid the temptation to adopt a less rigorous approach to UK compliance on the basis of the ICO's more conciliatory posture.
Recommendation: NTP should maintain regular, proactive engagement with both the ICO and the DPC. In respect of the DPC inquiry (IN-22-11-3), the preparation and submission of a comprehensive response is a critical near-term deliverable. C&H will prepare the DPC inquiry response for submission by NTP, with a target completion date of September 2023. The response will address the adequacy of NTP's international transfer mechanisms, the results of the TIAs, and the supplementary measures implemented or planned.
4.4 Cross-Supervisory Authority Coordination
A further consequence of Brexit is that the ICO is no longer a member of the EDPB and does not participate in the EU's one-stop-shop mechanism or the consistency mechanism established by Articles 63 to 67 of the EU GDPR. The ICO's departure from the EDPB means that:
(a) there is no formal mechanism for the ICO and EU data protection authorities to coordinate enforcement actions or share information in the manner contemplated by the EU GDPR's cooperation provisions;
(b) NTP cannot rely on a single regulatory decision or investigation covering both its UK and EU processing — an investigation by the ICO into NTP's UK processing is entirely separate from an investigation by the DPC into NTP's EU processing, and the two may proceed in parallel with different timelines, different scopes, and different outcomes;
(c) the ICO is not bound by EDPB guidelines, recommendations, or best practices, and may diverge from EDPB positions on the interpretation of provisions common to the UK GDPR and the EU GDPR; and
(d) NTP must resource and respond to parallel regulatory engagements, which may require separate legal teams, separate response timelines, and separate remediation commitments.
While the ICO has entered into certain bilateral memoranda of understanding with individual EU data protection authorities (including the DPC), these are non-binding arrangements that do not replicate the structured cooperation framework of the EU GDPR's consistency mechanism. NTP should not assume that regulatory outcomes in one jurisdiction will be treated as determinative or even influential in the other.
5. Adequacy Decisions
5.1 EU Adequacy Decision for the UK
On 28 June 2021, the European Commission adopted an adequacy decision for the United Kingdom pursuant to Article 45 of the EU GDPR (Commission Implementing Decision (EU) 2021/1772). The adequacy decision recognises that the United Kingdom provides an essentially equivalent level of protection for personal data to that guaranteed within the EU, and it permits the free flow of personal data from the EEA to the United Kingdom without the need for additional safeguards such as SCCs or binding corporate rules.
The adequacy decision is of fundamental importance to NTP's intra-group data flows. NTP's EU subsidiaries routinely transfer personal data to NTP PLC in the United Kingdom — for example, for group-level reporting, centralised human resources management, shared IT infrastructure, and the operation of the NorthCloud platform. Without the adequacy decision, each of these intra-group transfers would require the implementation of an appropriate safeguard under Chapter V of the EU GDPR.
However, the adequacy decision contains a critical limitation: a sunset clause. Under Article 4 of the decision, the adequacy finding expires on 27 June 2025 — four years after adoption — unless the European Commission conducts a review and decides to renew it. The renewal is not automatic; it is contingent on the Commission's assessment that the UK continues to provide an essentially equivalent level of data protection.
The risk of non-renewal or revocation of the adequacy decision is one of the most significant regulatory risks identified in our Phase 1 gap analysis. If the adequacy decision is not renewed (or is revoked prior to its expiry), all transfers of personal data from NTP's EU subsidiaries to NTP PLC in the United Kingdom would require alternative safeguards. Given the volume and complexity of NTP's intra-group data flows — spanning four data centres in London, Frankfurt, Amsterdam, and Dublin — the loss of adequacy would require the implementation of either:
(a) intra-group standard contractual clauses between each EU subsidiary and NTP PLC for each category of transfer; or
(b) binding corporate rules ("BCRs") approved by the DPC (as lead supervisory authority) and each concerned supervisory authority.
The implementation of BCRs is a protracted process that typically takes twelve to eighteen months and involves substantial legal, technical, and organisational effort. We strongly recommend that NTP begin contingency planning for the potential loss of adequacy well in advance of the June 2025 sunset date.
5.2 UK Adequacy Decisions for Third Countries
Post-Brexit, the United Kingdom has established its own adequacy assessment framework. Under Section 17A of the DPA 2018 (as inserted by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the Secretary of State has the power to make adequacy regulations recognising that a third country provides an adequate level of protection for personal data.
As a transitional measure, the UK "carried over" the EU's pre-existing adequacy decisions through the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. This means that all countries and territories that had received an EU adequacy decision prior to the end of the transition period (including Japan, Canada for PIPEDA-covered organisations, Switzerland, Israel, New Zealand, Argentina, and others) are treated as adequate under UK law.
NTP relies on adequacy decisions for two (2) transfers:
(a) Japan: NTP transfers IoT device endpoint telemetry data and analytics data to Moritaka Systems K.K. (Shibuya Cross Tower 15F, 2-15-1 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan) for IoT platform analytics processing. This transfer covers approximately 12,000 IoT device endpoints and is safeguarded by the UK's carried-over adequacy decision for Japan.
(b) Canada: NTP transfers certain employee and contractor data to PIPEDA-covered organisations in Canada, safeguarded by the UK's carried-over adequacy decision for Canada (which, like the EU's adequacy decision, is limited to recipients subject to PIPEDA).
5.3 Risk of Divergence and Impact on NTP
The UK has the power to make independent adequacy determinations that may diverge from those of the European Commission. The UK government has signalled its willingness to pursue adequacy determinations more rapidly and with a potentially broader scope than the EU, reflecting the UK's post-Brexit trade policy objectives and its desire to facilitate international data flows.
This creates the potential for asymmetric adequacy landscapes — situations where a particular country is recognised as adequate under UK law but not under EU law, or vice versa. If such a divergence were to arise, NTP could face a situation where a transfer of personal data is lawful under the UK GDPR (on the basis of a UK adequacy decision) but unlawful under the EU GDPR (for lack of an EU adequacy decision or other safeguard). In such cases, NTP would need to implement separate transfer mechanisms for the EU-origin component of the data flow, even if the UK-origin component is adequately safeguarded.
The most significant adequacy risk for NTP, however, remains the potential loss of the EU's adequacy decision for the UK itself. As noted above, the sunset clause expires on 27 June 2025, and the renewal assessment will take into account the state of UK data protection law at that time — including any amendments enacted through the DPDI Bill (discussed in Section 7 below). Significant weakening of UK data protection standards could jeopardise the renewal, with far-reaching consequences for NTP's intra-group data flows.
Recommendation: NTP should prepare contingency plans for the potential loss of EU adequacy for the UK, including the preparation of intra-group SCCs and the preliminary assessment of a BCR application. C&H will include these contingency measures in the Phase 4 and Phase 5 deliverables.
6. Substantive GDPR Provisions: Areas of Current and Emerging Divergence
6.1 Lawful Basis — Legitimate Interest
Article 6(1)(f) of both the UK GDPR and the EU GDPR provides that processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The statutory text of this provision remains substantively aligned across both regimes.
However, material divergence is anticipated. The DPDI Bill (discussed in detail in Section 7 below) proposes to create a list of "recognised legitimate interests" — specific processing activities that would be deemed to satisfy the legitimate interest condition without requiring the controller to conduct a balancing test weighing the controller's interests against the data subject's rights and freedoms. If enacted, this would effectively broaden the scope of legitimate interest processing available to controllers under the UK GDPR, reducing the compliance burden for processing activities falling within the recognised categories.
The significance of this anticipated divergence for NTP is substantial. Our Phase 1 data mapping has identified that NTP relies upon legitimate interest as the lawful basis for sixty-four (64) of its one hundred and forty-seven (147) processing activities, representing approximately 43.5% of NTP's total processing activities. These activities span a range of operational contexts, including network security and fraud prevention, customer relationship management, internal analytics, certain marketing activities, and B2B communications.
If the DPDI Bill's proposals are enacted, NTP may benefit from a simplified compliance pathway for its UK legitimate interest processing activities. However, the EU GDPR will continue to require a full balancing test for each legitimate interest reliance, and NTP must ensure that its EU processing activities (and any processing activities that involve both UK and EU personal data) continue to be supported by comprehensive Legitimate Interest Assessments ("LIAs").
Recommendation: NTP should continue to prepare and maintain full LIAs for all processing activities that rely on legitimate interest as the lawful basis, regardless of any future UK legislative relaxation. This will ensure ongoing compliance with the EU GDPR and will also provide a robust evidential basis in the event of regulatory challenge under either regime. Where the DPDI Bill's recognised legitimate interests provisions are ultimately enacted and come into force, NTP may choose to streamline its UK-specific documentation while retaining the full LIA for EU purposes.
6.2 Data Protection Impact Assessments
The obligation to conduct a Data Protection Impact Assessment ("DPIA") prior to processing that is likely to result in a high risk to the rights and freedoms of natural persons is set out in Article 35 of both the UK GDPR and the EU GDPR. The threshold for conducting a DPIA and the core methodology remain substantively aligned between the two regimes.
However, a practical divergence exists in the lists of processing operations that are deemed to require a DPIA. Under Article 35(4) of the EU GDPR, each national supervisory authority is required to publish a list of the kind of processing operations that require a DPIA. In the UK, the ICO has published its own criteria list. In the EU member states where NTP operates, each national DPA has published its own list:
(a) the DPC (Ireland) has published its list of processing operations requiring a DPIA;
(b) the Datenschutzkonferenz (DSK) in Germany has published a consolidated list;
(c) the Autoriteit Persoonsgegevens (Netherlands) has published its list;
(d) the CNIL (France) has published its list; and
(e) the AEPD (Spain) has published its list.
While there is significant overlap across these lists, there are also differences in the specific processing operations identified as requiring a DPIA. NTP's eleven (11) planned DPIAs must be assessed against both the ICO's criteria (for UK processing activities) and the relevant national DPA criteria for the jurisdiction(s) in which the processing occurs. Where a processing activity involves cross-border processing across multiple EU member states, NTP should assess the DPIA requirement against the lists of all relevant concerned authorities.
Our Phase 1 assessment has identified fourteen (14) processing activities involving special category data — including employee health data (occupational health assessments, sickness absence records, return-to-work assessments), trade union membership data (payroll deductions, consultation records), and biometric data (biometric access controls at data centres and secure facilities). These processing activities trigger DPIA requirements under both the UK and EU regimes and will be prioritised in the Phase 3 DPIA programme.
6.3 Data Subject Rights
The data subject rights set out in Chapter III of the UK GDPR and the EU GDPR — including the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20), and the right to object (Article 21) — remain currently aligned in substance across both regimes.
However, the DPDI Bill proposes modifications to the right of access (the data subject access request, or "DSAR") that would create divergence. Specifically, the Bill proposes to replace the current threshold for refusing a DSAR — which, under Article 12(5) of both the UK GDPR and the EU GDPR, permits refusal where requests are "manifestly unfounded or excessive" — with a lower threshold of "vexatious or excessive." The term "vexatious" is borrowed from freedom of information legislation and is generally understood to encompass a broader range of circumstances than "manifestly unfounded," potentially making it easier for controllers to refuse DSARs under UK law.
The Bill also proposes potential fee-charging provisions for DSARs, which would permit controllers to charge a reasonable fee for complying with requests, in contrast to the current position under both the UK GDPR and the EU GDPR (which provides for DSARs to be free of charge, with a fee chargeable only for manifestly unfounded or excessive requests).
NTP handles DSARs from across its base of approximately 6.38 million data subjects. If the DPDI Bill's proposals are enacted, NTP would be able to apply a lower threshold for refusing DSARs in respect of UK data subjects but would remain bound by the higher "manifestly unfounded or excessive" threshold for DSARs from EU data subjects. This would require bifurcated DSAR handling procedures, with different refusal criteria applied depending on the jurisdiction of the data subject and the applicable legal regime.
Recommendation: NTP should design its DSAR handling procedures to the higher (EU) standard, applying the "manifestly unfounded or excessive" threshold to all DSARs regardless of the data subject's jurisdiction. This will simplify operational procedures and ensure compliance with both regimes. If the DPDI Bill is enacted and NTP wishes to take advantage of the more relaxed UK standard, it may do so for UK-only DSARs at that point, while maintaining the EU standard for EU data subjects.
6.4 Data Protection Officers
Article 37 of both the UK GDPR and the EU GDPR requires the mandatory appointment of a Data Protection Officer in specified circumstances, including where the core activities of the controller consist of processing operations which, by virtue of their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale. NTP falls squarely within this requirement given the nature and scale of its telecommunications and SaaS processing activities.
NTP's DPO is Sanjay Mehta, who holds the CIPP/E certification and was appointed to the role in March 2019. Mr Mehta reports to the General Counsel, Fiona Gallagher, with a dotted-line reporting relationship to the Audit & Risk Committee. Mr Mehta serves as group DPO across both UK and EU operations.
The DPDI Bill proposes to replace the mandatory DPO requirement with a new obligation to designate a "senior responsible individual" — an officer of the organisation who would be responsible for the oversight of data protection compliance but would not be required to hold the specific qualifications or enjoy the specific protections (e.g., protection from dismissal for the performance of DPO tasks) that the DPO role currently entails under the UK GDPR and the EU GDPR.
If this proposal is enacted, NTP would no longer be legally required under UK law to maintain a DPO in the form currently prescribed. However, NTP would remain bound by the EU GDPR's DPO requirements for its EU operations, and the DPC (as lead supervisory authority) would continue to expect NTP to maintain a qualified DPO accessible to EU data subjects and regulators.
Recommendation: NTP should retain the DPO function for both UK and EU operations regardless of any UK legislative changes. Mr Mehta's current role satisfies the requirements of both regimes and provides a consistent point of accountability for data protection compliance across the group. If the DPDI Bill is enacted, NTP may choose to restructure the UK governance arrangements to reflect the "senior responsible individual" concept while retaining the substantive DPO function and Mr Mehta's current role and reporting lines.
6.5 Records of Processing Activities
The obligation to maintain Records of Processing Activities ("ROPA") under Article 30 of both the UK GDPR and the EU GDPR remains substantively aligned. Both regimes require controllers and processors to maintain written records (including in electronic form) of processing activities carried out under their responsibility. The required content of the ROPA — including the purposes of processing, descriptions of categories of data subjects and personal data, categories of recipients, details of international transfers, time limits for erasure, and technical and organisational security measures — is identical across both regimes.
NTP maintains separate UK and EU ROPAs to reflect the different controller entities and jurisdictions involved:
(a) the UK controller ROPA, maintained by NTP PLC, contains eighty-nine (89) processing activities; and
(b) the EU controller ROPA, maintained across the five EU subsidiaries (with Northgate Ireland Ltd as the principal EU controller), contains fifty-eight (58) processing activities.
No material divergence in ROPA requirements is anticipated in the near term, and the current parallel ROPA structure is appropriate.
6.6 Data Breach Notification
Both the UK GDPR and the EU GDPR require controllers to notify the competent supervisory authority of a personal data breach within seventy-two (72) hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33). Where a breach is likely to result in a high risk to natural persons, the controller must also notify the affected data subjects without undue delay (Article 34).
While the substantive obligations are aligned, the practical implementation of breach notification differs between the two regimes:
(a) UK: NTP must notify the ICO for breaches affecting UK personal data. The ICO operates an online breach notification portal and has proposed streamlined breach reporting mechanisms to reduce the administrative burden on controllers.
(b) EU: NTP must notify the DPC (as lead supervisory authority) for breaches affecting EU personal data that constitute cross-border processing. The DPC operates its own breach notification portal. Depending on the scope of the breach, the DPC may coordinate notification with concerned supervisory authorities in other member states. For breaches affecting personal data processed solely by a single EU subsidiary in a single member state (where no cross-border element exists), notification may be required directly to the national DPA of that member state.
NTP's Chief Information Security Officer, Thomas Okoye, and DPO Sanjay Mehta will be responsible for managing parallel breach notification processes. The NTP Incident Response Plan (to be developed during Phase 5 of the engagement) will incorporate dual-notification procedures, including clear escalation pathways, jurisdictional triage criteria, and pre-prepared notification templates for both the ICO and DPC portals.
6.7 Automated Decision-Making and Profiling
Article 22 of both the UK GDPR and the EU GDPR provides data subjects with the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. This provision is currently aligned in statutory text across both regimes.
NTP's processing activities include several instances of automated decision-making and profiling that engage Article 22:
(a) DPIA-001: AI-driven customer churn prediction model — this model processes subscriber behavioural data, usage patterns, billing history, and customer service interaction logs to generate churn risk scores. High-risk subscribers are automatically routed to retention offers, which may include contractual modifications with financial implications;
(b) DPIA-002: Network traffic analysis — this system processes network telemetry data correlated with subscriber accounts to identify anomalous usage patterns indicative of fraud, network abuse, or potential service degradation. Automated actions include bandwidth throttling, account suspension, and fraud alert generation; and
(c) DPIA-007: Marketing profiling activities — NTP's NorthCloud freemium tier employs marketing profiling to segment users based on usage patterns, demographic data, and engagement metrics, and to deliver targeted upsell communications and personalised pricing offers.