CALDERWOOD & HARKNESS LLP Barristers & Solicitors
One Moorgate Square London EC2R 6AN United Kingdom
T: +44 (0)20 7496 8000 F: +44 (0)20 7496 8001 www.calderwoodharkness.com
8 September 2023
PRIVILEGED & CONFIDENTIAL
Fiona Gallagher General Counsel & Company Secretary Northgate Telecommunications PLC Northgate Tower 88 Canary Wharf Boulevard London E14 5HN United Kingdom
Re: Completion of GDPR Compliance Program Build — Engagement Reference SC/NTP/2023-0213/PDS
Dear Fiona,
1. Purpose and Context
We write to formally confirm the completion and close of Calderwood & Harkness LLP's ("C&H" or the "Firm") engagement with Northgate Telecommunications PLC ("NTP") under engagement reference SC/NTP/2023-0213/PDS (the "Engagement").
The Engagement was opened on 13 February 2023 pursuant to the engagement letter of the same date (the "Engagement Letter"), under which C&H was instructed to design and implement a comprehensive compliance program addressing the requirements of Regulation (EU) 2016/679 (the "EU GDPR") and the EU GDPR as retained in domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (the "UK GDPR"), together with the Data Protection Act 2018, covering NTP's UK and EU operations (the "Program").
The Engagement has been completed as of 8 September 2023, representing a total duration of 207 calendar days from inception to close. All deliverables contemplated by the Engagement Letter and the subsequent phase-level scoping memoranda have been delivered in full, and all invoices issued under the Engagement have been rendered.
By way of context, the Engagement was undertaken in response to the NTP Board Audit & Risk Committee resolution dated 8 December 2022 (minute reference ARC/2022/12/04), which mandated a comprehensive GDPR program build with external counsel engagement, to be completed by Q3 2023. The Board resolution was informed by a number of factors, including NTP's recent regulatory history. In particular, we note the following:
(a) the ICO Enforcement Notice (reference ENF/2021/0934, dated 15 September 2021), which imposed a monetary penalty of £320,000 in connection with inadequate technical and organisational measures surrounding customer data processing within NTP's legacy billing platform. That enforcement action was remediated in March 2022, and the ICO confirmed closure of the associated compliance monitoring in May 2022; and
(b) the active Data Protection Commission (Ireland) ("DPC") preliminary inquiry (reference IN-22-11-3, opened November 2022) regarding cross-border personal data transfers from Northgate Ireland Ltd (CRO Number 587214) to US-based processors, with particular focus on the adequacy of the transfer mechanisms then in place and the supplementary measures adopted following the Court of Justice of the European Union's judgment in Data Protection Commissioner v Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18) ("Schrems II").
The combination of these regulatory matters, together with NTP's expanding data processing operations through the NorthCloud platform and the growing complexity of NTP's international data flows, underscored the need for a systematic and comprehensive approach to GDPR and UK GDPR compliance across the NTP Group.
This letter serves three principal purposes: first, to provide a formal record of the scope and phasing of the work completed; second, to set out a comprehensive schedule of all deliverables handed over to NTP; and third, to identify outstanding items, open matters, and ongoing compliance obligations that NTP should address on a continuing basis following the close of this Engagement. We recommend that this letter be retained alongside the deliverables as part of NTP's accountability documentation under Article 5(2) and Article 24 of the EU GDPR and the corresponding provisions of the UK GDPR.
2. Scope of Engagement and Phasing Summary
The Engagement was structured across five sequential phases, each with defined objectives, timelines, and deliverables. We provide below a summary of the work completed in each phase.
Phase 1 — Assessment & Gap Analysis
Phase 1 commenced with a formal kickoff meeting held at Northgate Tower on 20 February 2023, attended by the C&H engagement team, NTP's Data Protection Officer (Sanjay Mehta), NTP's Chief Information Security Officer (Thomas Okoye), and representatives from each of NTP's principal business units. The purpose of Phase 1 was to conduct a comprehensive assessment of NTP's current state of GDPR and UK GDPR compliance across all UK and EU operations, encompassing NTP PLC and its five EU subsidiaries: Northgate Ireland Ltd, Northgate GmbH (Germany), Northgate B.V. (Netherlands), Northgate France SAS (France), and Northgate Iberia S.L. (Spain).
Data mapping questionnaires were distributed on 1 March 2023 in coordination with Ashdown Consulting Group Ltd ("Ashdown"), which had been separately engaged by NTP as a privacy engineering and data mapping consultancy to configure and populate NTP's Sundial Solutions platform. The gap analysis was conducted against a detailed compliance framework developed by C&H, benchmarking NTP's existing policies, procedures, and technical measures against the requirements of both the EU GDPR and the UK GDPR, as well as relevant ICO and European Data Protection Board ("EDPB") guidance. The Gap Analysis Report was delivered on 31 March 2023.
Phase 2 — Records of Processing Activities (ROPA) & Data Mapping
Phase 2 commenced on 3 April 2023 and involved the construction of a comprehensive Records of Processing Activities ("ROPA") framework in accordance with Article 30 of the EU GDPR and UK GDPR. Working closely with NTP's business unit data stewards and Ashdown's data mapping team, C&H catalogued a total of 147 distinct processing activities across the NTP Group: 89 processing activities attributable to NTP's UK operations and 58 processing activities across NTP's EU subsidiaries (comprising 18 in Ireland, 16 in Germany, 11 in the Netherlands, 8 in France, and 5 in Spain).
The ROPA captures processing activities relating to approximately 6.3 million consumer subscribers, 42,000 enterprise clients, 11,400 employees across the NTP Group, and approximately 28,000 additional data subjects comprising contractor and temporary workers, job applicants, and website visitors. The ROPA v1.0 was delivered on 19 May 2023, together with an accompanying ROPA Methodology & Guidance Note and a Legitimate Interest Assessment ("LIA") template designed for the 64 processing activities identified as relying on legitimate interests as the lawful basis for processing.
Phase 3 — Data Protection Impact Assessments (DPIAs)
Phase 3 commenced on 22 May 2023 and involved the preparation of Data Protection Impact Assessments in accordance with Article 35 of the EU GDPR and UK GDPR for processing operations identified during Phase 1 and Phase 2 as being likely to result in a high risk to the rights and freedoms of natural persons. In total, C&H completed 11 DPIAs (DPIA-001 through DPIA-011), of which 5 were classified as high-risk and required the development of specific mitigation plans: DPIA-001, DPIA-003, DPIA-007, DPIA-008, and DPIA-011.
Of particular note, DPIA-008, which assessed NTP's CCTV and facial recognition pilot programme at the London headquarters, resulted in a recommendation to discontinue the pilot on the basis that the identified risks to data subjects could not be adequately mitigated and that the processing was unlikely to withstand scrutiny against the ICO's guidance on the use of biometric technologies in the workplace. The NTP Board accepted this recommendation on 14 June 2023. All DPIAs were completed by 7 July 2023.
Phase 4 — International Data Transfer Mechanisms
Phase 4 commenced on 10 July 2023 and addressed the establishment of lawful mechanisms for NTP's international personal data transfers in compliance with Chapter V of the EU GDPR and UK GDPR, having regard to the requirements of the Schrems II judgment and subsequent EDPB and ICO guidance. The following transfer mechanisms were implemented:
(a) EU Standard Contractual Clauses ("EU SCCs"), adopted pursuant to Commission Implementing Decision (EU) 2021/914, under both Module 2 (Controller to Processor) and Module 3 (Processor to Processor), for a total of 7 transfers;
(b) UK International Data Transfer Agreements ("UK IDTA"), adopted pursuant to section 119A of the Data Protection Act 2018, for 3 transfers;
(c) the UK Addendum to EU SCCs (the "UK Addendum"), issued by the ICO under section 119A of the Data Protection Act 2018, for 4 transfers that are subject to dual UK and EU regulatory regimes; and
(d) reliance on adequacy decisions for 2 transfers — specifically, the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419) and the adequacy decision for Canada (Commission Decision 2002/2/EC, as applicable to recipients subject to PIPEDA).
Key milestones within Phase 4 included the execution of EU SCCs (Module 2) and the UK IDTA with Caldwell Analytics Inc. ("Caldwell") on 17 July 2023, following negotiations with Caldwell's external counsel, Hargrove Lister & Webb LLP. In addition, the amended Data Processing Agreement ("DPA") with Pinnacle Cloud Services Ltd ("Pinnacle") was executed on 28 June 2023 (the amendment having been negotiated during the latter stages of Phase 3 to align with Phase 4 deliverables). A total of 6 Transfer Impact Assessments ("TIAs") were completed across Phase 4. All TIAs were completed by 4 August 2023.
Phase 5 — Policies, Training & Governance
Phase 5 commenced on 7 August 2023 and focused on the development of NTP's data protection policy suite, the delivery of Board-level GDPR training, and the establishment of operational procedures for data subject rights management and breach notification. Board-level GDPR training was delivered on 22 August 2023 by Kevin Ostrowski and Sara Hendricks to the full NTP Board, including all non-executive directors. The comprehensive policy suite, comprising the Group Data Protection Policy, Data Subject Rights Procedure, Data Breach Notification Procedure, Data Retention Schedule, and the Consumer Subscriber Privacy Notice (NorthCloud Platform), was delivered in final form on 1 September 2023.
DPC Inquiry Response
In addition to the five-phase Program, C&H prepared and assisted with the submission of NTP's comprehensive response to the DPC's preliminary inquiry (reference IN-22-11-3). The response, which was informed by the work undertaken across all five phases and drew in particular upon the TIAs completed during Phase 4 and the transfer mechanisms put in place with Caldwell, was submitted to the DPC on 4 September 2023, signed by Sanjay Mehta in his capacity as NTP's DPO. The DPC acknowledged receipt on the same date.
3. Engagement Team
We take this opportunity to formally acknowledge the members of the C&H engagement team and NTP's internal team who contributed to the successful delivery of the Program.
Calderwood & Harkness LLP Engagement Team:
NTP Internal Team:
We also wish to acknowledge the invaluable contributions of Ashdown Consulting Group Ltd, and in particular Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer), who provided expert data mapping and Sundial Solutions platform configuration and implementation support throughout Phases 1, 2, and 3 of the Engagement. The collaboration between C&H, NTP's internal team, and Ashdown was instrumental in ensuring the comprehensive and efficient delivery of the Program.
4. Complete Schedule of Deliverables Handed Over
Set out below is a complete schedule of all deliverables prepared and delivered by C&H under the Engagement. All deliverables have been transmitted to NTP under separate cover, and this schedule is provided for the purposes of formal record-keeping and accountability. NTP should confirm that all deliverables listed below have been received and are securely stored within NTP's document management systems. Unless otherwise noted, deliverables were provided in both Microsoft Word (editable) and PDF (final) format.
4.1 Phase 1 Deliverables — Assessment & Gap Analysis
1. Gap Analysis Report — Comprehensive report setting out the findings of C&H's assessment of NTP's current state of GDPR and UK GDPR compliance across the NTP Group, including prioritised recommendations for remediation. Delivered 31 March 2023.
2. Data Mapping Questionnaire Template — Standardised questionnaire template distributed to all NTP business units and EU subsidiaries for the purposes of data mapping and processing activity identification. Distributed 1 March 2023.
3. Regulatory Risk Assessment Memorandum — Detailed analysis of the regulatory risk profile arising from the ICO Enforcement Notice (ENF/2021/0934) and the DPC preliminary inquiry (IN-22-11-3), including an assessment of the likelihood of further enforcement action and recommendations for mitigation.
4. Memorandum on UK GDPR vs. EU GDPR Divergence — Post-Brexit regulatory analysis addressing the areas of divergence between the UK GDPR and the EU GDPR, with particular focus on the implications for NTP's dual-regime compliance obligations, including international data transfers, DPIA requirements, and the ICO's regulatory approach compared to that of EU supervisory authorities.
4.2 Phase 2 Deliverables — Records of Processing Activities & Data Mapping
5. ROPA — Controller Activities (NTP PLC, UK Operations) — Records of Processing Activities for NTP PLC's UK operations, cataloguing 89 processing activities. ROPA v1.0, delivered 19 May 2023.
6. ROPA — Controller Activities (EU Subsidiaries) — Records of Processing Activities for NTP's five EU subsidiaries, cataloguing 58 processing activities across Northgate Ireland Ltd (18 activities), Northgate GmbH (16 activities), Northgate B.V. (11 activities), Northgate France SAS (8 activities), and Northgate Iberia S.L. (5 activities). ROPA v1.0, delivered 19 May 2023.
7. ROPA Methodology & Guidance Note — Guidance document setting out the methodology for the creation, maintenance, and periodic review of the ROPA, including procedures for trigger-based updates and the responsibilities of business unit data stewards.
8. Legitimate Interest Assessment (LIA) Template — Template for the conduct of legitimate interest balancing assessments, designed for application to the 64 processing activities within the ROPA that rely upon Article 6(1)(f) (legitimate interests) as the lawful basis for processing. Includes worked examples and guidance notes.
4.3 Phase 3 Deliverables — Data Protection Impact Assessments
9. DPIA-001: NorthCloud AI-Driven Customer Churn Prediction Model — Full DPIA for NTP's AI-driven customer churn prediction model deployed within the NorthCloud platform, including an assessment of automated decision-making implications under Article 22. Classified as high-risk; mitigation plan included.
10. DPIA-002: Network Traffic Analysis and Anomaly Detection — Full DPIA for NTP's network traffic analysis and anomaly detection processing, including an assessment of the proportionality of deep packet inspection techniques and the applicable lawful bases.
11. DPIA-003: Employee Wellbeing Monitoring Platform — NorthPulse — Full DPIA for NTP's employee wellbeing monitoring platform (NorthPulse), including an assessment of special category data processing (health data) and the adequacy of the Article 9(2)(b) employment law basis under UK and EU member state implementing legislation. Classified as high-risk; mitigation plan included.
12. DPIA-004: IoT Device Telemetry Processing (Smart City Pilot, Birmingham) — Full DPIA for NTP's smart city IoT pilot in Birmingham, including an assessment of anonymisation and pseudonymisation measures for device telemetry data that may be linked to identifiable individuals.
13. DPIA-005: Biometric Access Control System (Data Centres) — Full DPIA for NTP's biometric access control system deployed across its UK and EU data centre facilities, including an assessment of the processing of biometric data (fingerprint and iris scan) under Article 9.
14. DPIA-006: Customer Credit Scoring and Fraud Detection — Full DPIA for NTP's customer credit scoring and fraud detection processing, including an assessment of profiling and automated decision-making under Articles 21 and 22.
15. DPIA-007: Marketing Profiling and Targeted Advertising — NorthCloud Freemium Tier — Full DPIA for NTP's marketing profiling and targeted advertising activities directed at users of the NorthCloud freemium service tier, including an assessment of consent mechanisms, the ePrivacy Directive requirements (as transposed into UK and EU member state law), and the adequacy of opt-out mechanisms. Classified as high-risk; mitigation plan included.
16. DPIA-008: CCTV and Facial Recognition Pilot — London HQ — Full DPIA for NTP's CCTV and facial recognition pilot at the London headquarters. Classified as high-risk. C&H recommended discontinuation of the pilot on the basis that the identified risks to data subjects' fundamental rights and freedoms could not be sufficiently mitigated through technical or organisational measures. The NTP Board accepted this recommendation on 14 June 2023. The DPIA is retained for accountability purposes.
17. DPIA-009: Cross-Border HR Analytics and Workforce Planning — Full DPIA for NTP's cross-border HR analytics and workforce planning processing, involving the centralised analysis of employee data from UK and EU subsidiaries for strategic workforce management purposes.
18. DPIA-010: Lawful Intercept and Communications Data Retention (RIPA/IPA Compliance) — Full DPIA for NTP's lawful intercept capabilities and communications data retention obligations under the Regulation of Investigatory Powers Act 2000 ("RIPA") and the Investigatory Powers Act 2016 ("IPA"), including an assessment of the interaction between these statutory obligations and GDPR requirements.
19. DPIA-011: Caldwell Analytics Network Performance Data Transfer to US — Full DPIA for the transfer of network performance data from NTP to Caldwell Analytics Inc. in the United States for analytics and performance optimisation purposes, including an assessment of US surveillance law risks in light of Schrems II and the supplementary measures adopted. Classified as high-risk; mitigation plan included, informed by the corresponding TIA (TIA-001).
20. DPIA Summary Register & Board Report — Summary register of all 11 DPIAs, including risk classifications, key findings, and the status of mitigation measures, presented in a format suitable for Board and Audit & Risk Committee reporting.
4.4 Phase 4 Deliverables — International Data Transfer Mechanisms
21. EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. — Executed EU SCCs (Commission Implementing Decision (EU) 2021/914, Module 2) for the transfer of personal data from NTP (controller, EU) to Caldwell Analytics Inc. (processor, US). Executed 17 July 2023.
22. UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics Inc. — Executed UK IDTA for the transfer of personal data from NTP (exporter, UK) to Caldwell Analytics Inc. (importer, US), adopted pursuant to section 119A of the Data Protection Act 2018. Executed 17 July 2023.
23. UK Addendum to EU SCCs — Template — Template UK Addendum to EU SCCs, for use in connection with 4 transfers that are subject to dual UK and EU regulatory regimes. The template is designed for completion on a transfer-by-transfer basis and includes guidance notes on the completion of each table.
24. Amended Data Processing Agreement — NTP / Pinnacle Cloud Services Ltd — Amended and restated DPA between NTP and Pinnacle Cloud Services Ltd, addressing, among other matters, updated provisions on sub-processor management (including a 14-day prior notification period for new sub-processor appointments), data breach notification obligations (without undue delay, and in any event within 36 hours of becoming aware), audit rights, and international data transfer mechanisms. Executed 28 June 2023.
25. Transfer Impact Assessment — TIA-001: NTP → Caldwell Analytics Inc. (US) — Network Analytics Data — TIA assessing the laws and practices of the United States as they relate to the transfer of network analytics data to Caldwell, including analysis of FISA Section 702, Executive Order 12333, and the US Data Privacy Framework, together with an assessment of supplementary technical, contractual, and organisational measures.
26. Transfer Impact Assessment — TIA-002: Pinnacle Cloud Services → Pinnacle India Pvt Ltd (India) — Infrastructure Support Data — TIA assessing the laws and practices of India as they relate to the onward transfer of infrastructure support data from Pinnacle Cloud Services Ltd to its Indian affiliate, Pinnacle India Pvt Ltd, for the provision of technical support services.
27. Transfer Impact Assessment — TIA-003: Pinnacle Cloud Services → Pinnacle APAC Pte Ltd (Singapore) — Infrastructure Monitoring — TIA assessing the laws and practices of Singapore as they relate to the onward transfer of infrastructure monitoring data from Pinnacle to its Singapore affiliate, Pinnacle APAC Pte Ltd.
28. Transfer Impact Assessment — TIA-004: NTP → Sunderland-Hayes Payroll Services Inc. (US) — Expatriate Payroll — TIA assessing the laws and practices of the United States as they relate to the transfer of payroll data for approximately 45 expatriate employees to Sunderland-Hayes Payroll Services Inc. for payroll processing purposes.
29. Transfer Impact Assessment — TIA-005: NTP GmbH → Caldwell Analytics Inc. (US) — German Subscriber Analytics — TIA assessing the laws and practices of the United States as they relate to the transfer of German subscriber analytics data from Northgate GmbH to Caldwell, including analysis specific to the requirements of the Bundesdatenschutzgesetz ("BDSG") and relevant guidance from the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit ("BfDI").
30. Transfer Impact Assessment — TIA-006: NTP → Moritaka Systems K.K. (Japan) — IoT Platform Analytics — TIA assessing the transfer of IoT platform analytics data (relating to approximately 12,000 device endpoints) from NTP to Moritaka Systems K.K. in Japan, relying on the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419), supplemented by additional contractual and organisational measures.
31. International Transfers Policy & Mechanism Selection Guidance — Group-level policy governing international transfers of personal data, including a mechanism selection decision tree and guidance on the conduct and periodic reassessment of TIAs.
4.5 Phase 5 Deliverables — Policies, Training & Governance
32. Group Data Protection Policy — Northgate Telecommunications PLC — Comprehensive group-level data protection policy establishing the principles, roles, responsibilities, and procedures for GDPR and UK GDPR compliance across the NTP Group. Includes provisions on DPIA thresholds, data subject rights, breach notification, international transfers, data retention, and accountability.
33. Data Subject Rights Procedure — Detailed operational procedure for the receipt, verification, processing, and response to data subject access requests ("DSARs") and other data subject rights requests (rectification, erasure, restriction, portability, and objection), including multi-entity coordination mechanisms and escalation procedures.
34. Data Breach Notification Procedure — Operational procedure for the identification, assessment, containment, and notification of personal data breaches, incorporating the 72-hour notification timeline to supervisory authorities under Article 33 and the communication to data subjects under Article 34, with internal escalation chains and template notification forms.
35. Data Retention Schedule — Comprehensive retention schedule setting out the retention periods for all categories of personal data processed by the NTP Group, with reference to the applicable lawful basis, regulatory requirements, and business justification for each retention period, together with procedures for secure deletion and anonymisation upon expiry.
36. Privacy Notice — Consumer Subscribers (NorthCloud Platform) — Updated privacy notice for NorthCloud platform consumer subscribers, drafted in compliance with Articles 13 and 14 of the EU GDPR and UK GDPR, including transparent disclosures regarding processing purposes, lawful bases, international transfers, data subject rights, and automated decision-making.
37. Board GDPR Training Materials — Presentation materials and supporting documentation delivered to the NTP Board on 22 August 2023, covering Board-level responsibilities under the GDPR and UK GDPR, the key features of the Program, the regulatory landscape, and the ongoing compliance obligations of the NTP Group.
4.6 DPC Inquiry Response Deliverables
38. DPC Inquiry Response (IN-22-11-3) — Draft Submission — Comprehensive response to the DPC's preliminary inquiry, addressing the DPC's questions regarding NTP's cross-border data transfers from Northgate Ireland Ltd to US-based processors, the transfer mechanisms and supplementary measures in place, and the TIAs conducted. Submitted to the DPC on 4 September 2023.
39. DPC Inquiry Response Cover Letter — NTP to Data Protection Commission — Formal cover letter transmitting the inquiry response to the DPC, signed by Sanjay Mehta in his capacity as NTP's Data Protection Officer. Dated 4 September 2023.
5. Financial Summary
We set out below a summary of the financial position of the Engagement as at close.
The Engagement was delivered £32,550 under the aggregate fee cap of £850,000. The fee cap represents the sum of the five individual phase caps as set out above and in Schedule 2 to the Engagement Letter.
Disbursements and travel expenses have been billed separately in accordance with paragraph 7.3 of the Engagement Letter, against the estimated disbursement budget of £32,000. Disbursements are not subject to the fee cap. Final disbursement figures are reflected in the invoices issued during the course of the Engagement.
For reference, the hourly rates applicable to the Engagement, as set out in Schedule 1 to the Engagement Letter, were as follows:
All invoices rendered during the Engagement have been paid in full. There are no outstanding fees or disbursements as at the date of this letter.
6. Outstanding Items and Open Matters
While the Engagement has been completed and all deliverables have been handed over, we wish to draw your attention to the following outstanding items and open matters that will require NTP's ongoing attention following the close of this Engagement.
6.1 DPC Inquiry (IN-22-11-3)
The DPC's preliminary inquiry (reference IN-22-11-3) remains open as at the date of this letter. The comprehensive response prepared by C&H was submitted to the DPC on 4 September 2023, and the DPC acknowledged receipt on the same date. As at the close of this Engagement, no further action, information request, or communication has been received from the DPC.
C&H recommends that NTP continue to actively monitor for any follow-up correspondence from the DPC. We suggest that Sanjay Mehta (DPO) and Marcus Engström (Head of EU Operations, based in Dublin) be designated as the primary points of contact for any further DPC communications, with a protocol in place to ensure that any correspondence is promptly escalated to you as General Counsel.
We wish to emphasise that if the DPC issues any further requests for information, formal notices, or commences a formal investigation (whether under Section 110 of the Data Protection Act 2018 (Ireland) or otherwise), NTP should seek fresh legal advice promptly. The close of this Engagement does not constitute ongoing monitoring of the DPC inquiry on NTP's behalf, and C&H has no continuing obligation to advise in relation to this matter unless a new engagement is entered into.
6.2 DPIA-008 — Facial Recognition Pilot discontinuation
As noted above, the NTP Board accepted C&H's recommendation to discontinue the CCTV and facial recognition pilot at the London headquarters on 14 June 2023. We understand that the pilot was formally discontinued shortly thereafter; however, NTP should ensure that the following steps have been completed and documented:
(a) all biometric data (facial recognition templates and associated images) collected during the pilot period has been securely and irreversibly deleted from all systems, including any backup or archival storage;
(b) documentation of the deletion process, including the date of deletion, the systems from which data was deleted, the method of deletion, and the identity of the individual(s) responsible, has been prepared and retained for accountability purposes under Article 5(2); and
(c) any data subjects whose biometric data was processed during the pilot have been notified of the discontinuation of the pilot and the deletion of their data, to the extent that such notification is practicable and proportionate.
We recommend that the DPO verify and certify the completion of these steps and that the relevant documentation be appended to the DPIA-008 file.
6.3 Moritaka Systems K.K. — Joint Controller Arrangement
During the course of Phase 4, C&H identified that the relationship between NTP and Moritaka Systems K.K. ("Moritaka") in relation to IoT analytics and connected-vehicle telemetry processing may constitute a joint controller arrangement within the meaning of Article 26 of the EU GDPR and UK GDPR. Specifically, NTP and Moritaka appear to jointly determine the purposes and means of processing in respect of certain categories of telemetry data derived from connected-vehicle endpoints.
The TIA (TIA-006) was prepared on the basis of a controller-to-controller transfer. However, should the joint controller characterisation be confirmed upon further analysis, a formal joint controller arrangement under Article 26 will need to be negotiated, documented, and implemented, setting out the respective responsibilities of NTP and Moritaka for compliance with GDPR obligations, including in particular the obligations relating to the exercise of data subject rights and the provision of information to data subjects under Articles 13 and 14.
We recommend that NTP assess this relationship in further detail and seek legal advice on the preparation of a suitable joint controller arrangement if required. This assessment should be prioritised, given the scale of the processing involved (approximately 12,000 device endpoints) and the potential enforcement risk arising from a failure to properly document joint controller arrangements.
6.4 Legislative Monitoring — UK Data Protection and Digital Information Bill
As at the date of this letter (September 2023), the UK Data Protection and Digital Information Bill (the "DPDI Bill") is progressing through Parliament. If enacted in its current or substantially similar form, the DPDI Bill may introduce material changes to the UK GDPR regime across several areas directly relevant to NTP's compliance program, including:
(a) International data transfers: The DPDI Bill proposes a revised framework for assessing the adequacy of data protection in third countries, which may affect the approach to UK IDTAs and the UK Addendum to EU SCCs currently in place;
(b) Data Protection Impact Assessments: The DPDI Bill proposes amendments to the DPIA regime, including changes to the threshold criteria and the circumstances in which a DPIA is required;
(c) Legitimate interest balancing: The DPDI Bill proposes the creation of a "recognised legitimate interests" category, which may affect the LIA assessments conducted under the Program; and
(d) Senior responsible individual: The DPDI Bill proposes replacing the mandatory DPO requirement with a "senior responsible individual" designation, which may have implications for the governance structures established under the Program.
NTP should actively monitor the progress of the DPDI Bill through Parliament and, in the event of enactment, conduct a comprehensive impact assessment to identify any changes required to the policies, procedures, and governance frameworks delivered under this Engagement. We also note that the European Commission's adequacy decision for the UK (Commission Implementing Decision (EU) 2021/1772) is subject to a sunset clause and periodic review, and any material changes to the UK data protection framework could affect the Commission's assessment of UK adequacy, which would in turn have significant implications for NTP's intra-group data flows between UK and EU entities.
7. Ongoing Compliance Obligations and Recommendations
The Program delivered under this Engagement establishes the foundations of NTP's GDPR and UK GDPR compliance framework. However, data protection compliance is an ongoing obligation, not a one-time exercise. Set out below are C&H's recommendations for NTP's ongoing compliance activities following the close of this Engagement.
7.1 ROPA Maintenance
The ROPA delivered under Phase 2 should be treated as a living document and maintained on a continuous basis. Business unit data stewards should notify the DPO of any new processing activities, changes to the purposes of existing processing, changes to the lawful basis relied upon, new categories of personal data or data subjects, new recipients or data flows, or any other material changes to the information recorded in the ROPA.
C&H recommends a comprehensive annual ROPA review, with the next review to be completed no later than May 2024. In addition to the annual review, trigger-based updates should be implemented in accordance with the procedures set out in the ROPA Methodology & Guidance Note delivered under Phase 2. Trigger events include, but are not limited to, the launch of new products or services, the commencement of new processing activities, changes to vendor or processor arrangements, organisational restructuring, and changes in applicable law or regulatory guidance.
The integration between the ROPA and NTP's Sundial Solutions platform (as configured by Ashdown Consulting Group Ltd during the Engagement) should be maintained, and NTP should ensure that the Sundial Solutions platform is kept up to date with any ROPA amendments to enable efficient reporting and regulatory response.
7.2 DPIA Review Cycle
All 11 DPIAs completed under Phase 3 should be reviewed at least annually, and in any event whenever there is a material change to the processing operation assessed. A "material change" includes, but is not limited to, changes to the scope or scale of processing, the introduction of new technologies, changes to the categories of personal data or data subjects involved, changes to the purposes of processing, and changes in the applicable regulatory or legal framework.
The 5 high-risk DPIAs (DPIA-001, DPIA-003, DPIA-007, DPIA-008, and DPIA-011) warrant particular and more frequent attention. In respect of DPIA-008, although the facial recognition pilot has been discontinued, NTP should retain the DPIA for accountability purposes and ensure that any residual matters (including confirmation of data deletion) are fully documented, as set out in Section 6.2 above.
Any new processing activity that meets the DPIA threshold criteria set out in the Group Data Protection Policy (Section 8.3) — including activities that involve systematic and extensive profiling, large-scale processing of special category data or criminal offence data, or systematic monitoring of publicly accessible areas — should undergo a full DPIA before processing commences, in accordance with Article 35(1).
7.3 Transfer Impact Assessment Reassessment
The 6 TIAs completed under Phase 4 should be reassessed at least annually, and whenever there is a material change in the laws or practices of the destination country, a material change in the volume or nature of the data transferred, or a change in the transfer mechanism relied upon. In particular:
(a) US-related TIAs (TIA-001, TIA-004, TIA-005): NTP should monitor developments in US law, including the reauthorisation (or expiry) of FISA Section 702, the implementation and enforcement of Executive Order 14086 and the redress mechanism established thereunder, and developments in the EU-US Data Privacy Framework ("DPF"). C&H notes that Caldwell Analytics Inc. may be eligible to self-certify under the DPF; if Caldwell obtains DPF certification, this may simplify the transfer mechanism analysis for TIA-001 and TIA-005, although supplementary measures may still be appropriate depending on the data categories transferred and the evolving regulatory guidance.
(b) India-related TIA (TIA-002): The Digital Personal Data Protection Act 2023 (India) was enacted in August 2023, shortly before the close of this Engagement. As the implementing rules and regulations under that Act are still forthcoming, TIA-002 should be reassessed once the regulatory framework in India is further clarified. In particular, NTP should assess whether the Indian Act's provisions on cross-border transfers and government access to data materially affect the risk analysis in TIA-002.
(c) Japan and Canada (adequacy-based transfers): NTP should monitor for any changes to the EU adequacy decisions relied upon for transfers to Japan (Commission Implementing Decision (EU) 2019/419) and Canada (Commission Decision 2002/2/EC), including the outcomes of any periodic reviews conducted by the European Commission. Any revocation, suspension, or amendment of these adequacy decisions would require NTP to implement alternative transfer mechanisms.
7.4 Data Processing Agreement Management
NTP should maintain an updated and comprehensive register of all processor and sub-processor agreements, including the identity of each processor and sub-processor, the subject matter and scope of processing, the applicable transfer mechanisms, and the expiry and renewal dates of each agreement.
In respect of the amended DPA with Pinnacle Cloud Services Ltd (executed 28 June 2023), NTP should actively monitor Pinnacle's sub-processor notifications and exercise its objection rights within the 14-day notification period established under clause 7.4 of the amended DPA. NTP should also assess any proposed new sub-processors against the compliance requirements established under the DPA and the Group Data Protection Policy.
NTP should exercise its audit rights under the Caldwell SCCs and the Pinnacle DPA at least annually. We recommend that audit activities be coordinated by the DPO and the CISO, and that audit findings be reported to the Audit & Risk Committee. Where NTP elects to conduct audits through a mandated third-party auditor (as permitted under the applicable agreements), the scope of the audit should be agreed with the DPO in advance to ensure adequate coverage of the relevant compliance areas.
7.5 Training. Board-level GDPR training should be refreshed on an annual basis. The initial Board training was delivered on 22 August 2023; we recommend that the next session be scheduled no later than August 2024, and that it incorporate any material developments in the regulatory landscape, including the outcome of the DPDI Bill and any DPC or ICO enforcement actions relevant to the telecommunications sector.
In addition, all-staff data protection awareness training should be conducted at least annually across all NTP Group entities, with particular emphasis on the practical obligations of employees in relation to data subject rights, breach reporting, and the handling of personal data in day-to-day operations. Role-specific training should be provided to individuals in the following functions:
(a) the Data Protection Officer and the DPO's support team;
(b) the Chief Information Security Officer and the information security team;
(c) the HR function, with particular focus on employee data processing, NorthPulse, and cross-border HR analytics;
(d) the marketing function, with particular focus on profiling, targeted advertising, and consent management under the ePrivacy framework; and
(e) the product engineering team (NorthCloud), with particular focus on privacy by design and by default, data minimisation, and the DPIA process for new product features.
Training records should be maintained for accountability purposes, and training effectiveness should be periodically assessed through appropriate measures such as post-training assessments, phishing simulations (in coordination with the CISO's information security awareness programme), and spot-check audits.
7.6 Data Subject Rights
NTP should monitor DSAR volumes and response times on an ongoing basis and measure performance against the service level expectations established in the Data Subject Rights Procedure. Under the Procedure, NTP has committed to responding to DSARs within one calendar month of receipt, with the possibility of extension by a further two months for complex or voluminous requests, subject to notifying the data subject of the extension and the reasons for it within the initial one-month period, in accordance with Article 12(3).
Given the multi-entity structure of the NTP Group and the distribution of personal data across UK and EU systems, the coordination mechanisms established in the Data Subject Rights Procedure — including the centralised DSAR intake process via the DPO's office and the business unit liaison framework — should be tested periodically to ensure that they are functioning effectively and that response timelines are being met.
NTP should also monitor for any trends in DSAR volumes or the types of rights being exercised, as such trends may indicate areas of data subject concern that warrant proactive attention.
7.7 Breach Response Readiness
NTP should conduct at least one annual tabletop exercise simulating a personal data breach scenario. The exercise should involve, at a minimum, the CISO (Thomas Okoye), the DPO (Sanjay Mehta), the General Counsel, and relevant business unit leads. The purpose of the exercise is to test and validate:
(a) the internal breach detection and escalation chain set out in the Data Breach Notification Procedure;
(b) the assessment and triage process for determining whether a breach is notifiable to supervisory authorities under Article 33 (within 72 hours of becoming aware) and to affected data subjects under Article 34;
(c) the coordination mechanisms between UK and EU entities in the event of a cross-border breach, including the determination of the lead supervisory authority for notification purposes;
(d) the roles and responsibilities of external advisors, forensic investigators, and communications teams; and
(e) the documentation and record-keeping requirements under Article 33(5).
We recommend that the first tabletop exercise be conducted no later than Q1 2024, and that the scenario be designed to test a cross-border breach involving both UK and Irish operations to maximise the exercise's value in light of the DPC inquiry and NTP's multi-jurisdictional presence.
7.8 Data Retention
NTP should conduct periodic audits of data deletion and anonymisation practices against the Data Retention Schedule delivered under Phase 5. These audits should verify that personal data is being deleted or anonymised in accordance with the scheduled retention periods and that no personal data is being retained beyond the specified periods without a lawful basis and documented justification.
NTP should also verify that automated deletion processes within its systems (including the NorthCloud platform, HR systems, CRM systems, and legacy billing platforms) are functioning correctly and are aligned with the Data Retention Schedule. Any discrepancies identified during audit should be remediated promptly and documented in the DPO's compliance records.
7.9 Privacy Notice Updates
The consumer subscriber privacy notice for the NorthCloud platform, and any other external-facing privacy notices published by the NTP Group, should be reviewed at least annually and updated whenever there are material changes to the processing activities described therein. Material changes include, but are not limited to, the introduction of new processing purposes, changes to the lawful bases relied upon, new categories of recipients, new international data transfers, and changes to data retention periods.
Any updates to privacy notices should be communicated to data subjects in a clear and transparent manner in accordance with Articles 13 and 14, and in line with the ICO's and EDPB's guidance on transparency. Where consent is the applicable lawful basis, any material changes may necessitate the collection of fresh consent from affected data subjects.
7.10 Regulatory Engagement
NTP should maintain its active ICO registration (Registration Number ZA482917) and ensure that the registration details remain current and accurate. NTP should also continue its engagement with the DPC as the lead supervisory authority for NTP's EU operations, acting through Northgate Ireland Ltd (CRO Number 587214) as NTP's main establishment in the EU for the purposes of Article 56.
NTP should monitor for any new supervisory authority inquiries, complaints, or enforcement actions directed at any NTP Group entity, and ensure that any such matters are promptly escalated to the General Counsel and the DPO. NTP should also monitor relevant enforcement actions, decisions, and guidance issued by the ICO, the DPC, and other EU supervisory authorities, particularly those affecting the telecommunications sector, to identify any implications for NTP's compliance program.
8. Recommendation for Annual External Review
C&H strongly recommends that NTP engage external counsel to conduct an annual compliance health check of the GDPR and UK GDPR compliance program established under this Engagement. We recommend that the first such annual review be commissioned no later than Q1 2024, to allow for a thorough assessment approximately six to nine months after the Program's completion.
The annual review should encompass, at a minimum, the following areas:
(a) ROPA completeness: Verification that the ROPA has been maintained and updated since the Program close, and that all new processing activities have been captured;
(b) DPIA currency: Review of all DPIAs to confirm that they remain current and that any material changes to the processing operations assessed have been reflected in updated DPIAs;
(c) TIA reassessment: Reassessment of all TIAs in light of any developments in the laws and practices of the relevant destination countries;
(d) Policy updates: Review of the Group Data Protection Policy and supporting procedures to ensure that they remain aligned with current regulatory requirements and best practices;
(e) Training effectiveness: Assessment of the adequacy and effectiveness of data protection training delivered across the NTP Group;
(f) Breach response preparedness: Review of breach response readiness, including an assessment of tabletop exercise outcomes and any lessons learned from actual incidents; and
(g) Regulatory developments: Analysis of any material regulatory or legislative developments (including the DPDI Bill, if enacted) and their implications for NTP's compliance program.
C&H would be pleased to discuss the scope, timing, and terms of such an engagement should NTP wish to instruct the Firm for this purpose.
9. Confidentiality and Privilege
All deliverables, advice, memoranda, and other work product provided by C&H under this Engagement are subject to legal professional privilege (including, where applicable, legal advice privilege and litigation privilege under English law and the equivalent protections under applicable EU member state laws) and the confidentiality obligations set out in Section 12 of the Engagement Letter dated 13 February 2023.
NTP should ensure that all privileged materials delivered under this Engagement are appropriately marked as privileged and confidential, stored securely within NTP's document management systems with access restricted to individuals who have a legitimate need to access such materials, and disclosed only in accordance with applicable privilege protections. In particular, NTP should exercise caution before disclosing any privileged materials to third parties, regulators, or in the context of litigation or regulatory proceedings, as such disclosure may result in a waiver of privilege.
We recommend that NTP establish and maintain a privilege log for all materials delivered under this Engagement, and that any proposed disclosure of privileged materials be reviewed by the General Counsel (or external counsel) before the disclosure is made.
10. Formal Close of Engagement
This letter confirms the formal close of engagement SC/NTP/2023-0213/PDS as of 8 September 2023. The engagement status is recorded as closed — completed in C&H's matter management system.
C&H's file in respect of this Engagement will be retained in accordance with the Firm's document retention policy, a copy of which was provided to NTP with the Engagement Letter. Under the Firm's current retention policy, engagement files are retained for a period of seven years from the date of engagement close, subject to any applicable legal or regulatory requirements that may necessitate a longer retention period.
We wish to make clear that the close of this Engagement does not create any ongoing retainer, duty to advise, or solicitor-client relationship between C&H and NTP in respect of any matter, unless and until a new engagement is entered into pursuant to a separate engagement letter. In particular, C&H has no obligation to monitor regulatory developments, supervise NTP's ongoing compliance activities, or provide advice in connection with any future inquiries, investigations, or enforcement actions unless separately instructed to do so.
11. Acknowledgements
We wish to express our sincere thanks to you, Fiona, and to the broader NTP team for the highly collaborative and constructive engagement throughout the duration of the Program. In particular, we acknowledge the exceptional commitment and cooperation of Sanjay Mehta (DPO), Thomas Okoye (CISO), Laura Dearden (VP, Product & Engineering, NorthCloud), Philippa Crane (Head of People & HR), and Marcus Engström (Head of EU Operations), each of whom made themselves and their teams available throughout the Engagement and contributed significantly to its successful and timely delivery.
We also wish to acknowledge the important contributions of Ashdown Consulting Group Ltd, and in particular Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer), whose expertise in data mapping, privacy engineering, and Sundial Solutions platform implementation was invaluable to the quality and efficiency of the Phase 1, Phase 2, and Phase 3 workstreams.
Finally, we note the constructive engagement of Pinnacle Cloud Services Ltd (and in particular Graham Alderton, Head of Legal & Compliance) and Caldwell Analytics Inc. (and in particular Jennifer Huang, Vice President, Legal & Privacy), together with Caldwell's external counsel at Hargrove Lister & Webb LLP (Natalie Prescott, Partner), during the negotiation and execution of the amended DPA and the SCCs/IDTA, respectively. The cooperative approach adopted by all parties materially contributed to the efficient completion of Phase 4.
We are pleased to have assisted NTP with this important programme of work and remain available to discuss any questions arising from the deliverables or this letter. Please do not hesitate to contact Kevin Ostrowski or Sara Hendricks should you wish to discuss any aspect of this letter or the ongoing recommendations set out herein.
Yours sincerely,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP
cc:
Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC
Thomas Okoye, Chief Information Security Officer, Northgate Telecommunications PLC