dpc-inquiry-cover-letter.docx

1022-00007 · Northgate Telecommunications PLC · DPC Response & Closing

dpc-inquiry-cover-letter.docx DOCUMENT Finance & Banking

8 / 39 ← → ✕

NORTHGATE TELECOMMUNICATIONS PLC 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Registered Office: 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Principal Office: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom Company Number: 04837291 ICO Registration Number: ZA482917

The Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28 Ireland

Reference: Preliminary Inquiry IN-22-11-3 — Northgate Ireland Ltd (CRO Number: 587214)

4 September 2023

Re: Response to Preliminary Inquiry IN-22-11-3 — Cross-Border Data Transfers from Northgate Ireland Ltd to United States-Based Processors

Dear Commissioners,

This letter is submitted on behalf of Northgate Telecommunications PLC ("NTP" or the "Company") and its Irish subsidiary, Northgate Ireland Ltd (registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland; CRO Number: 587214) ("Northgate Ireland"). This letter, together with the enclosures identified herein, constitutes NTP's comprehensive response to the Data Protection Commission's (the "Commission" or the "DPC") preliminary inquiry bearing reference IN-22-11-3, which was opened in November 2022 concerning cross-border personal data transfers from Northgate Ireland Ltd to processors based in the United States of America.

I, Sanjay Mehta, serve as the Data Protection Officer of Northgate Telecommunications PLC. I am a certified International Association of Privacy Professionals (IAPP) Certified Information Privacy Professional/Europe (CIPP/E) holder, and I was appointed to the role of Data Protection Officer in March 2019 pursuant to Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). In accordance with NTP's governance framework, I report directly to the General Counsel and Company Secretary with a dotted reporting line to the Audit & Risk Committee of the NTP Board of Directors, ensuring appropriate independence and access to Board-level oversight as required by Articles 38 and 39 of the GDPR.

This response has been prepared with the assistance of NTP's external legal counsel, Calderwood & Harkness LLP (One Moorgate Square, London EC2R 6AN, United Kingdom), acting through its Privacy & Data Security practice group, under engagement reference SC/NTP/2023-0213/PDS. We respectfully note that certain portions of the enclosed documentation, and in particular the legal analysis contained within the narrative submission, may be subject to legal professional privilege; however, NTP has elected to provide this information voluntarily and in full to the Commission in a spirit of transparency and cooperation with the inquiry.

Background and Context

NTP is a United Kingdom-headquartered public limited company engaged in the operation of telecommunications infrastructure and the provision of software-as-a-service platforms, principally the NorthCloud suite of enterprise communications and collaboration tools, across the United Kingdom and fourteen EU/EEA member states. The Company is listed on the London Stock Exchange (LSE ticker: NTP) and has been in continuous operation since 2003.

In the course of its business operations, NTP processes the personal data of approximately 6.3 million consumer subscribers across its telecommunications services, 42,000 enterprise clients who utilise NorthCloud and related SaaS offerings, and approximately 11,400 employees across its UK and EU operational footprint. The nature and volume of this processing places NTP firmly within the category of large-scale data controllers and underscores the seriousness with which the Company approaches its data protection obligations.

Northgate Ireland Ltd, the Company's Irish subsidiary, serves as NTP's EU operational headquarters. Northgate Ireland currently employs 340 staff across technical, commercial, and administrative functions. Critically, Northgate Ireland hosts NorthCloud EU customer data in co-located data centre facilities situated in Dublin, specifically at the Ashford & Co. DB3 and DB4 facilities in the Citywest Business Campus and the Ostrander & Co. DUB2 facility in the Park West Business Park. These facilities serve as the primary data processing and storage locations for personal data originating from NTP's EU and EEA subscriber and enterprise client base.

The Commission is NTP's lead data protection authority for EU operations by virtue of NTP's main establishment within the European Union being situated in Dublin, Ireland, through Northgate Ireland Ltd. This designation is consistent with the one-stop-shop mechanism established under Article 56 of the GDPR and has been the basis on which NTP has engaged with the Commission on data protection matters since the GDPR's entry into application on 25 May 2018.

NTP acknowledges the Commission's preliminary inquiry opened in November 2022 concerning the adequacy and lawfulness of cross-border data transfers from Northgate Ireland Ltd to processors based in the United States. NTP understands that this inquiry was initiated in the context of the Commission's broader supervisory activities following the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II"), and in particular the ongoing scrutiny of transfer mechanisms relied upon by controllers and processors transferring personal data to the United States in the absence, at that time, of a valid adequacy decision.

Upon receipt of the Commission's inquiry correspondence dated 14 November 2022, NTP immediately undertook a review of its cross-border data transfer practices. In parallel, and by resolution of the NTP Board Audit & Risk Committee dated 8 December 2022, NTP authorised and directed a comprehensive GDPR compliance programme build designed to ensure that all aspects of the Company's data protection framework — including, but not limited to, its international transfer mechanisms — met the highest standards of compliance with the GDPR, the European Data Protection Board's ("EDPB") Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted on 18 June 2021), and the Commission's own published guidance.

Following that Board resolution, NTP engaged Calderwood & Harkness LLP on 13 February 2023 to assist in the design, implementation, and documentation of the compliance programme. The programme has now been completed as of 8 September 2023 and the outputs of that programme form the substance of the enclosed documentation accompanying this letter. We set out below a summary of the principal measures undertaken.

Summary of Remedial Measures Undertaken

The comprehensive GDPR compliance programme build undertaken by NTP encompassed five distinct phases, each of which was designed to address specific elements of the Company's data protection framework and to respond directly to the matters raised in the Commission's preliminary inquiry:

Phase 1 — Assessment & Gap Analysis. Between February and March 2023, NTP conducted a thorough assessment of its existing data protection practices, policies, and documentation across all UK and EU operations. This assessment was benchmarked against the requirements of the GDPR, the EDPB's published guidance and recommendations, and the Commission's own decisions and published materials. The gap analysis identified specific areas requiring remediation, including the formalisation of transfer mechanisms, the completion of transfer impact assessments, and the updating of certain legacy data processing agreements.

Phase 2 — Records of Processing Activities (ROPA). NTP compiled a comprehensive records of processing activities framework as required by Article 30 of the GDPR. A total of 147 processing activities have been catalogued across the NTP Group, comprising 89 processing activities within UK operations and 58 processing activities across EU subsidiary operations, including those of Northgate Ireland Ltd, Northgate GmbH (Germany), Northgate B.V. (The Netherlands), Northgate France SAS (France), and Northgate Iberia S.L. (Spain). The ROPA registers identify, for each processing activity, the purposes of processing, the categories of data subjects and personal data, the recipients and categories of recipients, the retention periods, and — where applicable — the details of international transfers, including the transfer mechanism relied upon and any supplementary measures implemented.

Phase 3 — Data Protection Impact Assessments (DPIAs). NTP completed 11 Data Protection Impact Assessments in accordance with Article 35 of the GDPR and the EDPB's Guidelines on Data Protection Impact Assessments (wp248rev.01). Of these 11 DPIAs, 5 were classified as high-risk following the assessment criteria established in the Company's DPIA methodology, and full mitigation plans have been developed and are being implemented for each. The DPIA most directly relevant to this inquiry — DPIA-011, concerning the transfer of network performance and subscriber analytics data to Caldwell Analytics Inc. in the United States — is enclosed with this submission.

Phase 4 — International Transfer Mechanisms. This phase was the central focus of NTP's remediation efforts in connection with the Commission's inquiry. NTP completed 6 Transfer Impact Assessments ("TIAs") in accordance with the EDPB's Recommendations 01/2020, covering all identified cross-border data transfers to recipients in the United States, India, Singapore, and Japan. Lawful international data transfer mechanisms have been implemented for all identified cross-border data flows, comprising the following:

(a) EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) for 7 transfers, utilising Module 2 (Controller to Processor) and Module 3 (Processor to Sub-processor) as appropriate to the relationship between the transferring entity and the data importer;

(b) UK International Data Transfer Agreements (as approved by the UK Information Commissioner's Office pursuant to Section 119A of the Data Protection Act 2018) for 3 transfers;

(c) UK Addenda to EU SCCs (as approved by the UK Information Commissioner's Office under Section 119A of the Data Protection Act 2018, laid before Parliament on 2 February 2022) for 4 transfers; and

(d) Reliance on adequacy decisions for 2 transfers, specifically the European Commission's adequacy decision in respect of Japan (Commission Implementing Decision (EU) 2019/419 of 23 January 2019) and the European Commission's adequacy decision in respect of Canada (Commission Decision 2002/2/EC of 20 December 2001, as updated), where the relevant data importers have been confirmed as falling within the scope of those decisions.

Of particular relevance to the Commission's inquiry, NTP executed EU Standard Contractual Clauses (Module 2 — Controller to Processor) with Caldwell Analytics Inc. on 17 July 2023. This execution followed extensive negotiation regarding the supplementary measures to be incorporated, the operational annexes defining the scope and parameters of the processing, and the technical and organisational measures commitments undertaken by Caldwell Analytics Inc. as data importer. Additionally, the Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd was amended and executed on 28 June 2023 to incorporate updated provisions governing the sub-processing chain involving Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd, including the execution of EU SCCs (Module 3 — Processor to Sub-processor) for onward transfers.

Phase 5 — Policies, Training & Governance. NTP developed, updated, or formalised a suite of data protection policies and procedures, including its Group Data Protection Policy, International Transfers Policy & Mechanism Selection Guidance, Data Breach Notification Procedure, and Data Subject Rights Procedure, copies of which are enclosed. In addition, NTP delivered Board-level GDPR training to all members of the Board of Directors and the Audit & Risk Committee on 22 August 2023 and has rolled out mandatory GDPR awareness training to all 340 Northgate Ireland employees, with a completion rate of 97% as of the date of this letter.

NTP further notes that the following supplementary measures have been implemented across all relevant cross-border data transfers in accordance with the EDPB's Recommendations 01/2020:

• AES-256 encryption for all personal data at rest within processors' and sub-processors' environments;

• TLS 1.3 encryption for all personal data in transit between NTP and its processors, and between processors and sub-processors;

• Pseudonymisation of direct identifiers (including subscriber names, addresses, and account numbers) prior to transfer, such that the data importer processes only pseudonymised data sets and does not hold the re-identification key;

• Contractual audit rights enabling NTP and, where applicable, the Commission, to conduct on-site or remote audits of processors' and sub-processors' data processing environments, including inspection of technical security controls;

• Data localisation measures for certain categories of sensitive data, including precise geolocation data and telecommunications content data, which are stored exclusively within the EU/EEA and are not subject to cross-border transfer.

Transfers Directly Relevant to the Inquiry

The Commission's preliminary inquiry specifically concerns cross-border personal data transfers from Northgate Ireland Ltd to processors based in the United States. NTP sets out below a summary of each transfer that is directly relevant to the inquiry, together with the measures that have been implemented to ensure the lawfulness and adequacy of protection for each transfer.

Caldwell Analytics Inc.

Caldwell Analytics Inc. is a C-Corporation incorporated under the laws of the State of Delaware, United States of America, with its principal office located at 2700 Technology Drive, Suite 400, San Jose, California 95134, USA. Caldwell Analytics provides AI-driven network analytics and predictive maintenance services to NTP under a Master Services Agreement dated 1 June 2021 (the "Caldwell MSA"). Pursuant to the Caldwell MSA, Caldwell Analytics processes pseudonymised subscriber analytics data on behalf of NTP, including subscriber metadata, aggregated location data derived from cell tower connections, and device identifiers (such as IMEI and anonymised SIM identifiers). These data are used by Caldwell Analytics to generate predictive models for network capacity planning, fault detection, and service quality optimisation.

EU Standard Contractual Clauses (Module 2 — Controller to Processor) were executed between NTP (as data exporter) and Caldwell Analytics Inc. (as data importer) on 17 July 2023. The executed SCCs incorporate detailed Annexes specifying the categories of data subjects, the categories of personal data transferred, the frequency and nature of the transfer, the retention period, and the technical and organisational measures undertaken by Caldwell Analytics. In addition, a UK International Data Transfer Agreement was executed on the same date to govern any transfers of UK personal data to Caldwell Analytics.

Transfer Impact Assessment TIA-001 was completed for the transfer of data from Northgate Ireland Ltd to Caldwell Analytics Inc. The TIA assessed the legal framework applicable to Caldwell Analytics in the United States, including an analysis of Section 702 of the Foreign intelligence Surveillance Act ("FISA"), Executive Order 12333, and the protections introduced by Executive Order 14086 (issued 7 October 2022), as well as the US Attorney General's designation of the European Union and EEA member states as qualifying states under Executive Order 14086. The TIA concluded that, taking into account the nature of the data transferred (pseudonymised, without NTP providing the re-identification key to Caldwell Analytics), the supplementary measures implemented, and the legal framework analysis, the transfer provides an essentially equivalent level of protection to that afforded within the EU/EEA.

DPIA-011 was completed for this processing activity and was classified as high-risk due to the large-scale processing of location-derived data and the cross-border nature of the transfer. A full mitigation plan has been developed and implemented, the details of which are set out in the enclosed DPIA-011 report.

Northgate GmbH to Caldwell Analytics Inc.

In addition to the transfers from Northgate Ireland, NTP has identified that Northgate GmbH (NTP's German subsidiary) also transfers German subscriber analytics data to Caldwell Analytics Inc. for the same predictive maintenance and network analytics purposes described above. This transfer is subject to Transfer Impact Assessment TIA-005, which has been completed and is enclosed. The same EU SCCs (Module 2) framework applies to this transfer, with Northgate GmbH as the data exporter. The Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) has been identified as the relevant competent supervisory authority for the purpose of Clause 13 of the SCCs in respect of this specific transfer.

Sunderland-Hayes Payroll Services Inc.

Sunderland-Hayes Payroll Services Inc. is a corporation incorporated under the laws of the State of Delaware, United States of America, with its principal office located at 1400 Broadway, Suite 2200, New York, New York 10018, USA. Sunderland-Hayes provides cross-border payroll administration services for approximately 45 NTP expatriate employees who are employed by various NTP Group entities but are based in, or regularly travel to, the United States. The personal data processed by Sunderland-Hayes includes employee names, addresses, national insurance or social security numbers, salary details, banking information, and tax withholding data.

Transfer Impact Assessment TIA-004 was completed for this transfer and is enclosed. EU SCCs (Module 2 — Controller to Processor) have been executed with Sunderland-Hayes. Given the sensitivity of the employee financial and tax data involved, additional supplementary measures have been implemented, including field-level encryption of banking details and national identification numbers, access controls limiting Sunderland-Hayes personnel with access to the data to a named list of authorised individuals, and a contractual prohibition on further onward transfers without NTP's prior written consent.

Pinnacle Cloud Services Ltd — Sub-Processor Chain

NTP also wishes to draw the Commission's attention to the measures taken to address the sub-processing chain associated with Pinnacle Cloud Services Ltd (a UK company; Company Number: 09142837), which provides cloud infrastructure hosting services for certain NorthCloud components. Pinnacle Cloud Services Ltd engages two sub-processors:

(a) Pinnacle India Pvt Ltd (Corporate Identification Number: U72200HR2016PTC065412), based in Gurugram, India, which provides second-line technical support and database management services; and

(b) Pinnacle APAC Pte Ltd (Unique Entity Number: 201824567K), based in Singapore, which provides disaster recovery and business continuity hosting services.

The Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd was amended and re-executed on 28 June 2023 to incorporate updated sub-processing provisions, enhanced audit rights, and flow-down obligations requiring Pinnacle Cloud Services Ltd to impose equivalent data protection obligations on its sub-processors. EU SCCs (Module 3 — Processor to Sub-processor) have been executed between Pinnacle Cloud Services Ltd and each of Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd. Transfer Impact Assessments TIA-002 (Pinnacle to Pinnacle India) and TIA-003 (Pinnacle to Pinnacle APAC) have been completed and are enclosed.

List of Enclosed Documents and Annexures

The following documents are enclosed with this submission for the Commission's review:

1. Enclosure 1: Comprehensive Narrative Response to Inquiry IN-22-11-3 (the Draft Submission document, comprising 87 pages with annexes)

2. Enclosure 2: Records of Processing Activities — Controller (Northgate Telecommunications PLC, UK Operations) — 89 processing activities

3. Enclosure 3: Records of Processing Activities — Controller (EU Subsidiaries) — 58 processing activities across Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.

4. Enclosure 4: DPIA-011: Caldwell Analytics Network Performance Data Transfer (US) — Full Data Protection Impact Assessment Report

5. Enclosure 5: DPIA Summary Register & Board Report (covering all 11 DPIAs completed under the compliance programme, with risk classifications and mitigation status)

6. Enclosure 6: Executed EU Standard Contractual Clauses (Module 2: Controller to Processor) — Northgate Telecommunications PLC (data exporter) to Caldwell Analytics Inc. (data importer) (executed 17 July 2023)

7. Enclosure 7: Executed UK International Data Transfer Agreement — Northgate Telecommunications PLC to Caldwell Analytics Inc. (executed 17 July 2023)

8. Enclosure 8: Transfer Impact Assessment TIA-001: NTP → Caldwell Analytics Inc. (US)

9. Enclosure 9: Transfer Impact Assessment TIA-005: Northgate GmbH → Caldwell Analytics Inc. (US)

10. Enclosure 10: Amended Data Processing Agreement — Northgate Telecommunications PLC / Pinnacle Cloud Services Ltd (executed 28 June 2023)

11. Enclosure 11: Transfer Impact Assessment TIA-002: Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd (India)

12. Enclosure 12: Transfer Impact Assessment TIA-003: Pinnacle Cloud Services Ltd → Pinnacle APAC Pte Ltd (Singapore)

13. Enclosure 13: Transfer Impact Assessment TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (US)

14. Enclosure 14: International Transfers Policy & Mechanism Selection Guidance (Version 1.0, approved 15 August 2023)

15. Enclosure 15: Group Data Protection Policy — Northgate Telecommunications PLC (Version 3.2, approved 1 August 2023)

16. Enclosure 16: Data Breach Notification Procedure (Version 2.0, approved 10 August 2023)

17. Enclosure 17: Data Subject Rights Procedure (Version 2.1, approved 10 August 2023)

All enclosed documents are provided in both hard copy and on encrypted USB storage media (BitLocker-encrypted, with the decryption key to be provided separately to the Commission by secure email to the address notified in the Commission's inquiry correspondence).

Commitment to Ongoing Compliance

NTP confirms its commitment to maintaining and continuously reviewing its GDPR compliance programme on an ongoing basis. The Company has instituted a programme of annual reviews for its Records of Processing Activities, Data Protection Impact Assessments, and Transfer Impact Assessments, to ensure that all documentation remains current, accurate, and reflective of the Company's actual processing activities and transfer practices. The first annual review cycle is scheduled to commence in Q1 2024.

The Data Protection Officer will continue to monitor legislative and regulatory developments across all jurisdictions in which NTP operates, including potential changes arising from the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), and will reassess the Company's transfer mechanisms accordingly. NTP notes that, as of the date of this letter, Caldwell Analytics Inc. and Sunderland-Hayes Payroll Services Inc. have each applied for, but have not yet been confirmed as participants in, the EU-US Data Privacy Framework. Upon confirmation of their participation, NTP will assess whether reliance on the adequacy decision may be appropriate as a primary or supplementary transfer mechanism, while maintaining the existing SCCs and supplementary measures as a safeguard.

NTP's Board Audit & Risk Committee receives regular reports on data protection compliance and risk, on a no less than quarterly basis, presented by the Data Protection Officer and the General Counsel. Board-level GDPR training was most recently delivered on 22 August 2023 by Calderwood & Harkness LLP, covering the key obligations of controllers, the implications of the Schrems II judgment, and the practical requirements of the EDPB's Recommendations 01/2020 on supplementary measures. This training will be refreshed annually.

NTP remains committed to cooperating fully and transparently with the Commission in relation to this inquiry and any further requests or directions that the Commission may issue.

Request for Acknowledgement

NTP respectfully requests that the Commission acknowledge receipt of this submission and the seventeen enclosed documents at its earliest convenience. NTP is prepared to provide any additional information, documentation, or clarification that the Commission may require in connection with its assessment of the matters raised in inquiry IN-22-11-3. Should the Commission wish to request access to NTP's processing environments, to interview NTP personnel, or to inspect any further records, NTP will facilitate such access promptly.

NTP further expresses its willingness to attend any meeting, hearing, or conference that the Commission may convene in connection with inquiry IN-22-11-3, and to present the enclosed materials in person should the Commission consider this to be of assistance. The Company can make available the Data Protection Officer, the Head of EU Operations, and external legal counsel at the Commission's convenience.

Contact Information

The Commission is invited to direct all correspondence and communications regarding this inquiry to the following contacts:

Primary Contact for the Inquiry:

Sanjay Mehta Data Protection Officer Northgate Telecommunications PLC Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN, United Kingdom Telephone: +44 (0)20 7946 2100

Email: sanjay.mehta@northgatetelecom.com

EU Establishment Contact:

Marcus Engström Head of EU Operations Northgate Ireland Ltd Unit 12, Grand Canal Dock Business Centre Barrow Street, Dublin 2, D02 KV92, Ireland Telephone: +353 (0)1 906 4400

Email: marcus.engstrom@northgateireland.ie

External Legal Counsel:

Kevin Ostrowski, Partner Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN, United Kingdom Telephone: +44 (0)20 7382 5000

Email: k.ostrowski@calderwoodharkness.com

Rachel Bernstein, Partner Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN, United Kingdom Telephone: +44 (0)20 7382 5000

Email: r.bernstein@calderwoodharkness.com

Yours faithfully,

NORTHGATE TELECOMMUNICATIONS PLC

By: ________

Sanjay Mehta Data Protection Officer Northgate Telecommunications PLC CIPP/E

Date: 4 September 2023

cc:

Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC

Marcus Engström, Head of EU Operations, Northgate Ireland Ltd

Kevin Ostrowski, Partner, Calderwood & Harkness LLP

Rachel Bernstein, Partner, Calderwood & Harkness LLP

This letter and the enclosed documents contain confidential information belonging to Northgate Telecommunications PLC and its subsidiaries. The contents are intended solely for the Data Protection Commission in connection with Preliminary Inquiry IN-22-11-3 and should not be disclosed to third parties without the prior written consent of Northgate Telecommunications PLC, except as required by law or regulatory obligation. Certain materials enclosed herewith may be subject to legal professional privilege.

NORTHGATE TELECOMMUNICATIONS PLC 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Registered Office: 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom Principal Office: Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN, United Kingdom Company Number: 04837291 ICO Registration Number: ZA482917
The Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28 Ireland
Reference: Preliminary Inquiry IN-22-11-3 — Northgate Ireland Ltd (CRO Number: 587214)
4 September 2023
Re: Response to Preliminary Inquiry IN-22-11-3 — Cross-Border Data Transfers from Northgate Ireland Ltd to United States-Based Processors
Dear Commissioners,
This letter is submitted on behalf of Northgate Telecommunications PLC ("NTP" or the "Company") and its Irish subsidiary, Northgate Ireland Ltd (registered at Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Ireland; CRO Number: 587214) ("Northgate Ireland"). This letter, together with the enclosures identified herein, constitutes NTP's comprehensive response to the Data Protection Commission's (the "Commission" or the "DPC") preliminary inquiry bearing reference IN-22-11-3, which was opened in November 2022 concerning cross-border personal data transfers from Northgate Ireland Ltd to processors based in the United States of America.
I, Sanjay Mehta, serve as the Data Protection Officer of Northgate Telecommunications PLC. I am a certified International Association of Privacy Professionals (IAPP) Certified Information Privacy Professional/Europe (CIPP/E) holder, and I was appointed to the role of Data Protection Officer in March 2019 pursuant to Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). In accordance with NTP's governance framework, I report directly to the General Counsel and Company Secretary with a dotted reporting line to the Audit & Risk Committee of the NTP Board of Directors, ensuring appropriate independence and access to Board-level oversight as required by Articles 38 and 39 of the GDPR.
This response has been prepared with the assistance of NTP's external legal counsel, Calderwood & Harkness LLP (One Moorgate Square, London EC2R 6AN, United Kingdom), acting through its Privacy & Data Security practice group, under engagement reference SC/NTP/2023-0213/PDS. We respectfully note that certain portions of the enclosed documentation, and in particular the legal analysis contained within the narrative submission, may be subject to legal professional privilege; however, NTP has elected to provide this information voluntarily and in full to the Commission in a spirit of transparency and cooperation with the inquiry.
Background and Context
NTP is a United Kingdom-headquartered public limited company engaged in the operation of telecommunications infrastructure and the provision of software-as-a-service platforms, principally the NorthCloud suite of enterprise communications and collaboration tools, across the United Kingdom and fourteen EU/EEA member states. The Company is listed on the London Stock Exchange (LSE ticker: NTP) and has been in continuous operation since 2003.
In the course of its business operations, NTP processes the personal data of approximately 6.3 million consumer subscribers across its telecommunications services, 42,000 enterprise clients who utilise NorthCloud and related SaaS offerings, and approximately 11,400 employees across its UK and EU operational footprint. The nature and volume of this processing places NTP firmly within the category of large-scale data controllers and underscores the seriousness with which the Company approaches its data protection obligations.
Northgate Ireland Ltd, the Company's Irish subsidiary, serves as NTP's EU operational headquarters. Northgate Ireland currently employs 340 staff across technical, commercial, and administrative functions. Critically, Northgate Ireland hosts NorthCloud EU customer data in co-located data centre facilities situated in Dublin, specifically at the Ashford & Co. DB3 and DB4 facilities in the Citywest Business Campus and the Ostrander & Co. DUB2 facility in the Park West Business Park. These facilities serve as the primary data processing and storage locations for personal data originating from NTP's EU and EEA subscriber and enterprise client base.
The Commission is NTP's lead data protection authority for EU operations by virtue of NTP's main establishment within the European Union being situated in Dublin, Ireland, through Northgate Ireland Ltd. This designation is consistent with the one-stop-shop mechanism established under Article 56 of the GDPR and has been the basis on which NTP has engaged with the Commission on data protection matters since the GDPR's entry into application on 25 May 2018.
NTP acknowledges the Commission's preliminary inquiry opened in November 2022 concerning the adequacy and lawfulness of cross-border data transfers from Northgate Ireland Ltd to processors based in the United States. NTP understands that this inquiry was initiated in the context of the Commission's broader supervisory activities following the Court of Justice of the European Union's judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II"), and in particular the ongoing scrutiny of transfer mechanisms relied upon by controllers and processors transferring personal data to the United States in the absence, at that time, of a valid adequacy decision.
Upon receipt of the Commission's inquiry correspondence dated 14 November 2022, NTP immediately undertook a review of its cross-border data transfer practices. In parallel, and by resolution of the NTP Board Audit & Risk Committee dated 8 December 2022, NTP authorised and directed a comprehensive GDPR compliance programme build designed to ensure that all aspects of the Company's data protection framework — including, but not limited to, its international transfer mechanisms — met the highest standards of compliance with the GDPR, the European Data Protection Board's ("EDPB") Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted on 18 June 2021), and the Commission's own published guidance.
Following that Board resolution, NTP engaged Calderwood & Harkness LLP on 13 February 2023 to assist in the design, implementation, and documentation of the compliance programme. The programme has now been completed as of 8 September 2023 and the outputs of that programme form the substance of the enclosed documentation accompanying this letter. We set out below a summary of the principal measures undertaken.
Summary of Remedial Measures Undertaken
The comprehensive GDPR compliance programme build undertaken by NTP encompassed five distinct phases, each of which was designed to address specific elements of the Company's data protection framework and to respond directly to the matters raised in the Commission's preliminary inquiry:
Phase 1 — Assessment & Gap Analysis. Between February and March 2023, NTP conducted a thorough assessment of its existing data protection practices, policies, and documentation across all UK and EU operations. This assessment was benchmarked against the requirements of the GDPR, the EDPB's published guidance and recommendations, and the Commission's own decisions and published materials. The gap analysis identified specific areas requiring remediation, including the formalisation of transfer mechanisms, the completion of transfer impact assessments, and the updating of certain legacy data processing agreements.
Phase 2 — Records of Processing Activities (ROPA). NTP compiled a comprehensive records of processing activities framework as required by Article 30 of the GDPR. A total of 147 processing activities have been catalogued across the NTP Group, comprising 89 processing activities within UK operations and 58 processing activities across EU subsidiary operations, including those of Northgate Ireland Ltd, Northgate GmbH (Germany), Northgate B.V. (The Netherlands), Northgate France SAS (France), and Northgate Iberia S.L. (Spain). The ROPA registers identify, for each processing activity, the purposes of processing, the categories of data subjects and personal data, the recipients and categories of recipients, the retention periods, and — where applicable — the details of international transfers, including the transfer mechanism relied upon and any supplementary measures implemented.
Phase 3 — Data Protection Impact Assessments (DPIAs). NTP completed 11 Data Protection Impact Assessments in accordance with Article 35 of the GDPR and the EDPB's Guidelines on Data Protection Impact Assessments (wp248rev.01). Of these 11 DPIAs, 5 were classified as high-risk following the assessment criteria established in the Company's DPIA methodology, and full mitigation plans have been developed and are being implemented for each. The DPIA most directly relevant to this inquiry — DPIA-011, concerning the transfer of network performance and subscriber analytics data to Caldwell Analytics Inc. in the United States — is enclosed with this submission.
Phase 4 — International Transfer Mechanisms. This phase was the central focus of NTP's remediation efforts in connection with the Commission's inquiry. NTP completed 6 Transfer Impact Assessments ("TIAs") in accordance with the EDPB's Recommendations 01/2020, covering all identified cross-border data transfers to recipients in the United States, India, Singapore, and Japan. Lawful international data transfer mechanisms have been implemented for all identified cross-border data flows, comprising the following:
(a) EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) for 7 transfers, utilising Module 2 (Controller to Processor) and Module 3 (Processor to Sub-processor) as appropriate to the relationship between the transferring entity and the data importer;
(b) UK International Data Transfer Agreements (as approved by the UK Information Commissioner's Office pursuant to Section 119A of the Data Protection Act 2018) for 3 transfers;
(c) UK Addenda to EU SCCs (as approved by the UK Information Commissioner's Office under Section 119A of the Data Protection Act 2018, laid before Parliament on 2 February 2022) for 4 transfers; and
(d) Reliance on adequacy decisions for 2 transfers, specifically the European Commission's adequacy decision in respect of Japan (Commission Implementing Decision (EU) 2019/419 of 23 January 2019) and the European Commission's adequacy decision in respect of Canada (Commission Decision 2002/2/EC of 20 December 2001, as updated), where the relevant data importers have been confirmed as falling within the scope of those decisions.
Of particular relevance to the Commission's inquiry, NTP executed EU Standard Contractual Clauses (Module 2 — Controller to Processor) with Caldwell Analytics Inc. on 17 July 2023. This execution followed extensive negotiation regarding the supplementary measures to be incorporated, the operational annexes defining the scope and parameters of the processing, and the technical and organisational measures commitments undertaken by Caldwell Analytics Inc. as data importer. Additionally, the Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd was amended and executed on 28 June 2023 to incorporate updated provisions governing the sub-processing chain involving Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd, including the execution of EU SCCs (Module 3 — Processor to Sub-processor) for onward transfers.
Phase 5 — Policies, Training & Governance. NTP developed, updated, or formalised a suite of data protection policies and procedures, including its Group Data Protection Policy, International Transfers Policy & Mechanism Selection Guidance, Data Breach Notification Procedure, and Data Subject Rights Procedure, copies of which are enclosed. In addition, NTP delivered Board-level GDPR training to all members of the Board of Directors and the Audit & Risk Committee on 22 August 2023 and has rolled out mandatory GDPR awareness training to all 340 Northgate Ireland employees, with a completion rate of 97% as of the date of this letter.
NTP further notes that the following supplementary measures have been implemented across all relevant cross-border data transfers in accordance with the EDPB's Recommendations 01/2020:
•  AES-256 encryption for all personal data at rest within processors' and sub-processors' environments;
•  TLS 1.3 encryption for all personal data in transit between NTP and its processors, and between processors and sub-processors;
•  Pseudonymisation of direct identifiers (including subscriber names, addresses, and account numbers) prior to transfer, such that the data importer processes only pseudonymised data sets and does not hold the re-identification key;
•  Contractual audit rights enabling NTP and, where applicable, the Commission, to conduct on-site or remote audits of processors' and sub-processors' data processing environments, including inspection of technical security controls;
•  Data localisation measures for certain categories of sensitive data, including precise geolocation data and telecommunications content data, which are stored exclusively within the EU/EEA and are not subject to cross-border transfer.
Transfers Directly Relevant to the Inquiry
The Commission's preliminary inquiry specifically concerns cross-border personal data transfers from Northgate Ireland Ltd to processors based in the United States. NTP sets out below a summary of each transfer that is directly relevant to the inquiry, together with the measures that have been implemented to ensure the lawfulness and adequacy of protection for each transfer.
Caldwell Analytics Inc.
Caldwell Analytics Inc. is a C-Corporation incorporated under the laws of the State of Delaware, United States of America, with its principal office located at 2700 Technology Drive, Suite 400, San Jose, California 95134, USA. Caldwell Analytics provides AI-driven network analytics and predictive maintenance services to NTP under a Master Services Agreement dated 1 June 2021 (the "Caldwell MSA"). Pursuant to the Caldwell MSA, Caldwell Analytics processes pseudonymised subscriber analytics data on behalf of NTP, including subscriber metadata, aggregated location data derived from cell tower connections, and device identifiers (such as IMEI and anonymised SIM identifiers). These data are used by Caldwell Analytics to generate predictive models for network capacity planning, fault detection, and service quality optimisation.
EU Standard Contractual Clauses (Module 2 — Controller to Processor) were executed between NTP (as data exporter) and Caldwell Analytics Inc. (as data importer) on 17 July 2023. The executed SCCs incorporate detailed Annexes specifying the categories of data subjects, the categories of personal data transferred, the frequency and nature of the transfer, the retention period, and the technical and organisational measures undertaken by Caldwell Analytics. In addition, a UK International Data Transfer Agreement was executed on the same date to govern any transfers of UK personal data to Caldwell Analytics.
Transfer Impact Assessment TIA-001 was completed for the transfer of data from Northgate Ireland Ltd to Caldwell Analytics Inc. The TIA assessed the legal framework applicable to Caldwell Analytics in the United States, including an analysis of Section 702 of the Foreign intelligence Surveillance Act ("FISA"), Executive Order 12333, and the protections introduced by Executive Order 14086 (issued 7 October 2022), as well as the US Attorney General's designation of the European Union and EEA member states as qualifying states under Executive Order 14086. The TIA concluded that, taking into account the nature of the data transferred (pseudonymised, without NTP providing the re-identification key to Caldwell Analytics), the supplementary measures implemented, and the legal framework analysis, the transfer provides an essentially equivalent level of protection to that afforded within the EU/EEA.
DPIA-011 was completed for this processing activity and was classified as high-risk due to the large-scale processing of location-derived data and the cross-border nature of the transfer. A full mitigation plan has been developed and implemented, the details of which are set out in the enclosed DPIA-011 report.
Northgate GmbH to Caldwell Analytics Inc.
In addition to the transfers from Northgate Ireland, NTP has identified that Northgate GmbH (NTP's German subsidiary) also transfers German subscriber analytics data to Caldwell Analytics Inc. for the same predictive maintenance and network analytics purposes described above. This transfer is subject to Transfer Impact Assessment TIA-005, which has been completed and is enclosed. The same EU SCCs (Module 2) framework applies to this transfer, with Northgate GmbH as the data exporter. The Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) has been identified as the relevant competent supervisory authority for the purpose of Clause 13 of the SCCs in respect of this specific transfer.
Sunderland-Hayes Payroll Services Inc.
Sunderland-Hayes Payroll Services Inc. is a corporation incorporated under the laws of the State of Delaware, United States of America, with its principal office located at 1400 Broadway, Suite 2200, New York, New York 10018, USA. Sunderland-Hayes provides cross-border payroll administration services for approximately 45 NTP expatriate employees who are employed by various NTP Group entities but are based in, or regularly travel to, the United States. The personal data processed by Sunderland-Hayes includes employee names, addresses, national insurance or social security numbers, salary details, banking information, and tax withholding data.
Transfer Impact Assessment TIA-004 was completed for this transfer and is enclosed. EU SCCs (Module 2 — Controller to Processor) have been executed with Sunderland-Hayes. Given the sensitivity of the employee financial and tax data involved, additional supplementary measures have been implemented, including field-level encryption of banking details and national identification numbers, access controls limiting Sunderland-Hayes personnel with access to the data to a named list of authorised individuals, and a contractual prohibition on further onward transfers without NTP's prior written consent.
Pinnacle Cloud Services Ltd — Sub-Processor Chain
NTP also wishes to draw the Commission's attention to the measures taken to address the sub-processing chain associated with Pinnacle Cloud Services Ltd (a UK company; Company Number: 09142837), which provides cloud infrastructure hosting services for certain NorthCloud components. Pinnacle Cloud Services Ltd engages two sub-processors:
(a) Pinnacle India Pvt Ltd (Corporate Identification Number: U72200HR2016PTC065412), based in Gurugram, India, which provides second-line technical support and database management services; and
(b) Pinnacle APAC Pte Ltd (Unique Entity Number: 201824567K), based in Singapore, which provides disaster recovery and business continuity hosting services.
The Data Processing Agreement between NTP and Pinnacle Cloud Services Ltd was amended and re-executed on 28 June 2023 to incorporate updated sub-processing provisions, enhanced audit rights, and flow-down obligations requiring Pinnacle Cloud Services Ltd to impose equivalent data protection obligations on its sub-processors. EU SCCs (Module 3 — Processor to Sub-processor) have been executed between Pinnacle Cloud Services Ltd and each of Pinnacle India Pvt Ltd and Pinnacle APAC Pte Ltd. Transfer Impact Assessments TIA-002 (Pinnacle to Pinnacle India) and TIA-003 (Pinnacle to Pinnacle APAC) have been completed and are enclosed.
List of Enclosed Documents and Annexures
The following documents are enclosed with this submission for the Commission's review:
1.  Enclosure 1: Comprehensive Narrative Response to Inquiry IN-22-11-3 (the Draft Submission document, comprising 87 pages with annexes)
2.  Enclosure 2: Records of Processing Activities — Controller (Northgate Telecommunications PLC, UK Operations) — 89 processing activities
3.  Enclosure 3: Records of Processing Activities — Controller (EU Subsidiaries) — 58 processing activities across Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.
4.  Enclosure 4: DPIA-011: Caldwell Analytics Network Performance Data Transfer (US) — Full Data Protection Impact Assessment Report
5.  Enclosure 5: DPIA Summary Register & Board Report (covering all 11 DPIAs completed under the compliance programme, with risk classifications and mitigation status)
6.  Enclosure 6: Executed EU Standard Contractual Clauses (Module 2: Controller to Processor) — Northgate Telecommunications PLC (data exporter) to Caldwell Analytics Inc. (data importer) (executed 17 July 2023)
7.  Enclosure 7: Executed UK International Data Transfer Agreement — Northgate Telecommunications PLC to Caldwell Analytics Inc. (executed 17 July 2023)
8.  Enclosure 8: Transfer Impact Assessment TIA-001: NTP → Caldwell Analytics Inc. (US)
9.  Enclosure 9: Transfer Impact Assessment TIA-005: Northgate GmbH → Caldwell Analytics Inc. (US)
10.  Enclosure 10: Amended Data Processing Agreement — Northgate Telecommunications PLC / Pinnacle Cloud Services Ltd (executed 28 June 2023)
11.  Enclosure 11: Transfer Impact Assessment TIA-002: Pinnacle Cloud Services Ltd → Pinnacle India Pvt Ltd (India)
12.  Enclosure 12: Transfer Impact Assessment TIA-003: Pinnacle Cloud Services Ltd → Pinnacle APAC Pte Ltd (Singapore)
13.  Enclosure 13: Transfer Impact Assessment TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (US)
14.  Enclosure 14: International Transfers Policy & Mechanism Selection Guidance (Version 1.0, approved 15 August 2023)
15.  Enclosure 15: Group Data Protection Policy — Northgate Telecommunications PLC (Version 3.2, approved 1 August 2023)
16.  Enclosure 16: Data Breach Notification Procedure (Version 2.0, approved 10 August 2023)
17.  Enclosure 17: Data Subject Rights Procedure (Version 2.1, approved 10 August 2023)
All enclosed documents are provided in both hard copy and on encrypted USB storage media (BitLocker-encrypted, with the decryption key to be provided separately to the Commission by secure email to the address notified in the Commission's inquiry correspondence).
Commitment to Ongoing Compliance
NTP confirms its commitment to maintaining and continuously reviewing its GDPR compliance programme on an ongoing basis. The Company has instituted a programme of annual reviews for its Records of Processing Activities, Data Protection Impact Assessments, and Transfer Impact Assessments, to ensure that all documentation remains current, accurate, and reflective of the Company's actual processing activities and transfer practices. The first annual review cycle is scheduled to commence in Q1 2024.
The Data Protection Officer will continue to monitor legislative and regulatory developments across all jurisdictions in which NTP operates, including potential changes arising from the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), and will reassess the Company's transfer mechanisms accordingly. NTP notes that, as of the date of this letter, Caldwell Analytics Inc. and Sunderland-Hayes Payroll Services Inc. have each applied for, but have not yet been confirmed as participants in, the EU-US Data Privacy Framework. Upon confirmation of their participation, NTP will assess whether reliance on the adequacy decision may be appropriate as a primary or supplementary transfer mechanism, while maintaining the existing SCCs and supplementary measures as a safeguard.
NTP's Board Audit & Risk Committee receives regular reports on data protection compliance and risk, on a no less than quarterly basis, presented by the Data Protection Officer and the General Counsel. Board-level GDPR training was most recently delivered on 22 August 2023 by Calderwood & Harkness LLP, covering the key obligations of controllers, the implications of the Schrems II judgment, and the practical requirements of the EDPB's Recommendations 01/2020 on supplementary measures. This training will be refreshed annually.
NTP remains committed to cooperating fully and transparently with the Commission in relation to this inquiry and any further requests or directions that the Commission may issue.
Request for Acknowledgement
NTP respectfully requests that the Commission acknowledge receipt of this submission and the seventeen enclosed documents at its earliest convenience. NTP is prepared to provide any additional information, documentation, or clarification that the Commission may require in connection with its assessment of the matters raised in inquiry IN-22-11-3. Should the Commission wish to request access to NTP's processing environments, to interview NTP personnel, or to inspect any further records, NTP will facilitate such access promptly.
NTP further expresses its willingness to attend any meeting, hearing, or conference that the Commission may convene in connection with inquiry IN-22-11-3, and to present the enclosed materials in person should the Commission consider this to be of assistance. The Company can make available the Data Protection Officer, the Head of EU Operations, and external legal counsel at the Commission's convenience.
Contact Information
The Commission is invited to direct all correspondence and communications regarding this inquiry to the following contacts:
Primary Contact for the Inquiry:
Sanjay Mehta Data Protection Officer Northgate Telecommunications PLC Northgate Tower, 88 Canary Wharf Boulevard London E14 5HN, United Kingdom Telephone: +44 (0)20 7946 2100
Email: sanjay.mehta@northgatetelecom.com
EU Establishment Contact:
Marcus Engström Head of EU Operations Northgate Ireland Ltd Unit 12, Grand Canal Dock Business Centre Barrow Street, Dublin 2, D02 KV92, Ireland Telephone: +353 (0)1 906 4400
Email: marcus.engstrom@northgateireland.ie
External Legal Counsel:
Kevin Ostrowski, Partner Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN, United Kingdom Telephone: +44 (0)20 7382 5000
Email: k.ostrowski@calderwoodharkness.com
Rachel Bernstein, Partner Calderwood & Harkness LLP One Moorgate Square London EC2R 6AN, United Kingdom Telephone: +44 (0)20 7382 5000
Email: r.bernstein@calderwoodharkness.com
Yours faithfully,
NORTHGATE TELECOMMUNICATIONS PLC
By: ________
Sanjay Mehta Data Protection Officer Northgate Telecommunications PLC CIPP/E
Date: 4 September 2023
cc:
Fiona Gallagher, General Counsel & Company Secretary, Northgate Telecommunications PLC
Marcus Engström, Head of EU Operations, Northgate Ireland Ltd
Kevin Ostrowski, Partner, Calderwood & Harkness LLP
Rachel Bernstein, Partner, Calderwood & Harkness LLP
This letter and the enclosed documents contain confidential information belonging to Northgate Telecommunications PLC and its subsidiaries. The contents are intended solely for the Data Protection Commission in connection with Preliminary Inquiry IN-22-11-3 and should not be disclosed to third parties without the prior written consent of Northgate Telecommunications PLC, except as required by law or regulatory obligation. Certain materials enclosed herewith may be subject to legal professional privilege.

NORTHGATE TELECOMMUNICATIONS PLC

Record

Parties

Dates

Amounts