CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice

CALDERWOOD & HARKNESS LLP Privacy & Data Security Practice
25 Old Broad Street, London EC2N 1HQ
DATA PROTECTION IMPACT ASSESSMENT SUMMARY REGISTER & BOARD REPORT
Executive Summary of Phase 3 DPIA Programme
Northgate Telecommunications PLC
Prepared for: Audit & Risk Committee, Board of Directors Northgate Telecommunications PLC
Prepared by: Sara Hendricks, Lead Associate Privacy & Data Security Calderwood & Harkness LLP
Supervised by: Kevin Ostrowski, Responsible Partner Privacy & Data Security Calderwood & Harkness LLP
Date: 7 July 2023
Engagement Reference: SC/NTP/2023-0213/PDS
Classification: CONFIDENTIAL — LEGALLY PRIVILEGED
Version: 1.0 (Final)
This document has been prepared by Calderwood & Harkness LLP for the sole use of Northgate Telecommunications PLC and its Board of Directors. It is subject to legal professional privilege and must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the General Counsel of Northgate Telecommunications PLC. This document does not constitute legal advice to any person other than the addressee. Calderwood & Harkness LLP accepts no liability to any third party in respect of this document.
Right-click to update Table of Contents
1. Executive Summary
The purpose of this report is to provide the Audit & Risk Committee of Northgate Telecommunications PLC ("NTP" or the "Company") with a consolidated summary of all Data Protection Impact Assessments ("DPIAs") completed during Phase 3 of the Company's comprehensive GDPR compliance programme build. This report is intended to serve both as a board-level summary of the DPIA outcomes and as a standing register that will be maintained and updated on an ongoing basis as part of the Company's accountability framework.
Calderwood & Harkness LLP ("C&H") was retained by the Company pursuant to a letter of engagement dated 13 February 2023 (engagement reference SC/NTP/2023-0213/PDS) to design and implement a comprehensive GDPR and UK GDPR compliance programme covering NTP's United Kingdom and European Union operations. The programme was structured in three phases:
•  Phase 1 — Gap Analysis: Delivered 31 March 2023. This phase identified significant compliance gaps across NTP's data processing activities, particularly in the areas of international data transfers, marketing consent mechanisms, employee data handling, and automated decision-making governance.
•  Phase 2 — Record of Processing Activities ("ROPA"): Delivered 19 May 2023. This phase catalogued a total of 147 processing activities across NTP's UK and EU operations, comprising 89 processing activities in the United Kingdom and 58 across the Company's European Union subsidiaries (Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.).
•  Phase 3 — Data Protection Impact Assessments ("DPIAs"): Commenced 22 May 2023 and completed 7 July 2023. This phase, which is the subject of this report, involved the completion of DPIAs for all processing activities identified during Phases 1 and 2 as presenting a high risk to the rights and freedoms of data subjects.
A total of 11 DPIAs were completed during Phase 3, covering the high-risk processing activities identified through the Gap Analysis and ROPA. The risk distribution across the 11 completed DPIAs is as follows:
•  High risk: 5 DPIAs (DPIA-001, DPIA-003, DPIA-007, DPIA-008, DPIA-011), representing 45.5% of the assessed activities;
•  Medium risk: 4 DPIAs (DPIA-002, DPIA-004, DPIA-005, DPIA-006), representing 36.4% of the assessed activities; and
•  Low risk: 2 DPIAs (DPIA-009, DPIA-010), representing 18.2% of the assessed activities.
Of particular significance to the Audit & Risk Committee is the outcome of DPIA-008 (CCTV & Facial Recognition Pilot at London HQ), which resulted in a recommendation to discontinue the proposed facial recognition pilot on the grounds that no viable lawful basis could be identified for the processing of facial biometric data in this context and that the processing was disproportionate to the stated security objectives. This recommendation was presented to the NTP Board on 14 June 2023 and was accepted. The facial recognition pilot has been discontinued, and confirmation of the deletion of any biometric data collected during the testing phase is pending certification by the Chief Information Security Officer.
The processing activities assessed during Phase 3 collectively affect a substantial population of data subjects. The data subjects potentially affected by the assessed processing activities include approximately 6.3 million consumer subscribers, 42,000 enterprise clients, 11,400 employees, and approximately 28,000 contractors, temporary workers, job applicants, and website visitors across NTP's UK and EU operations.
The DPIA programme was undertaken against a backdrop of heightened regulatory scrutiny. The Company received an ICO Enforcement Notice (ENF/2021/0934) on 15 September 2021, accompanied by an administrative fine of £320,000, relating to inadequate consent mechanisms for direct marketing cookies on the NorthCloud portal. Remediation of the matters identified in that Enforcement Notice was completed in March 2022, but the enforcement action remains a material consideration for the Company's ongoing compliance posture. In addition, the Irish Data Protection Commission ("DPC") opened preliminary inquiry IN-22-11-3 in November 2022 regarding cross-border data transfers from Northgate Ireland Ltd to processors in the United States. This inquiry remains open and is directly relevant to DPIA-011 (Caldwell Analytics Network Performance Data Transfer). Against this regulatory backdrop, the Board Audit & Risk Committee passed a resolution on 8 December 2022 mandating the comprehensive GDPR programme build that C&H was subsequently retained to deliver.
All DPIAs were conducted in consultation with the following NTP personnel and external advisers:
•  Sanjay Mehta, Data Protection Officer (DPO);
•  Thomas Okoye, Chief Information Security Officer (CISO);
•  Laura Dearden, Vice President, Product & Engineering;
•  Philippa Crane, Head of People & HR;
•  Marcus Engström, Head of EU Operations;
•  Ashdown Consulting Group Ltd (technical data mapping and privacy engineering), represented by Robert Fairclough (Managing Director) and Anita Chakravarti (Lead Privacy Engineer).
The following sections of this report set out the legal and regulatory framework, the detailed DPIA register, the consolidated risk assessment, the mitigation implementation tracker, the governance and review schedule, and C&H's recommendations to the Audit & Risk Committee.
2. Legal and Regulatory Framework
2.1 DPIA Obligation under GDPR and UK GDPR
The obligation to conduct a Data Protection Impact Assessment arises under Article 35 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, in respect of the Company's UK operations, under Article 35 of the UK GDPR (the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019). The two provisions are substantively identical in their current form.
Article 35(1) provides that where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is "likely to result in a high risk to the rights and freedoms of natural persons", the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. The concept of "high risk" is not defined exhaustively in the Regulation, but guidance from the European Data Protection Board ("EDPB") and the Information Commissioner's Office ("ICO") provides a framework for identifying processing that meets this threshold.
Article 35(3) identifies three categories of processing that are mandatorily subject to a DPIA:
(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; and
(c) a systematic monitoring of a publicly accessible area on a large scale.
In addition to the mandatory triggers in Article 35(3), the ICO and EDPB have published guidance identifying additional criteria that indicate processing is likely to result in high risk. The EDPB Guidelines on Data Protection Impact Assessments (wp248rev.01), originally adopted by the Article 29 Working Party and endorsed by the EDPB, identify nine criteria, any two of which in combination generally indicate that a DPIA is required:
1.  Evaluation or scoring (including profiling and predicting);
2.  Automated decision-making with legal or similarly significant effect;
3.  Systematic monitoring;
4.  Sensitive data or data of a highly personal nature;
5.  Data processed on a large scale;
6.  Matching or combining datasets;
7.  Data concerning vulnerable data subjects;
8.  Innovative use or applying new technological or organisational solutions; and
9.  Processing that in itself prevents data subjects from exercising a right or using a service or a contract.
The ICO's published guidance on DPIAs (last updated March 2023) applies these criteria in the UK context and provides a screening checklist that NTP has adopted, in conjunction with the EDPB Guidelines, as the basis for identifying processing activities requiring a DPIA.
Article 36 GDPR / UK GDPR requires that where a DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller cannot sufficiently mitigate the residual risk, the controller must consult the relevant supervisory authority prior to the processing. As set out in Section 4.2 below, no prior consultation was required in respect of the 11 DPIAs completed during Phase 3, as residual risks were mitigated to acceptable levels in all cases (or, in the case of DPIA-008, the processing was discontinued).
2.2 DPIA Triggers Identified for NTP
The Phase 2 ROPA exercise catalogued 147 processing activities across NTP's UK and EU operations (89 in the UK and 58 across the five EU subsidiaries). Each of these processing activities was assessed against the Article 35(3) mandatory triggers and the EDPB/ICO screening criteria. This screening process identified 11 processing activities requiring a full DPIA, based on the following trigger categories present across NTP's operations:
•  Special category data processing: 14 of the 147 processing activities were identified as involving the processing of special category data within the meaning of Article 9(1) GDPR. These include the processing of employee health data (including occupational health records, sickness absence data, and self-reported wellbeing indicators), trade union membership data held by the People & HR function, and biometric data processed through access control systems at NTP data centres and the London headquarters.
•  AI-driven and automated decision-making systems: NTP operates several AI and machine learning systems, including the NorthCloud customer churn prediction model and automated credit scoring and fraud detection systems. These systems involve systematic evaluation of personal aspects relating to natural persons based on automated processing, meeting the Article 35(3)(a) trigger.
•  Large-scale profiling and monitoring: NTP's marketing profiling operations on the NorthCloud freemium tier, its network traffic analysis systems, and its customer churn prediction model each involve profiling and monitoring activities on a large scale, affecting a significant proportion of NTP's approximately 6.3 million consumer subscriber base.
•  International transfers to jurisdictions without adequacy decisions: NTP transfers personal data to processors and sub-processors located in the United States, India, and Singapore, jurisdictions for which no adequacy decision under Article 45 GDPR has been adopted. In particular, the transfer of subscriber analytics data to Caldwell Analytics Inc. in the United States represents a high-risk processing activity requiring a DPIA, especially in the context of the post-Schrems II legal landscape and the active DPC inquiry.
•  Innovative technology use: NTP's proposed facial recognition pilot (DPIA-008) and its IoT telemetry processing for the Birmingham Smart City pilot (DPIA-004) each involve the deployment of innovative technologies that present novel risks to data subjects' rights and freedoms.
2.3 Methodology
The DPIAs documented in this report were conducted in accordance with a methodology derived from the ICO's DPIA template and the EDPB Guidelines on DPIAs (wp248rev.01). This methodology was adapted to NTP's specific organisational context and processing operations, and was agreed with the DPO (Sanjay Mehta) prior to commencement of the Phase 3 work.
Each DPIA followed a four-step structure:
Step 1 — Systematic Description of the Processing: A detailed description of the nature, scope, context, and purposes of the processing; the categories of personal data processed; the categories of data subjects affected; the data flows (including any international transfers); the technology used; and the retention periods applicable.
Step 2 — Necessity and Proportionality Assessment: An assessment of the lawful basis for the processing; the necessity of the processing in relation to its stated purpose; the proportionality of the processing (whether the purpose could be achieved by less intrusive means); the data minimisation measures in place; and the safeguards for data subjects' rights (including transparency, access, rectification, erasure, restriction, objection, and rights relating to automated decision-making).
Step 3 — Risk Identification and Assessment: Identification of the risks to data subjects arising from the processing, assessed against a risk matrix combining likelihood and severity. The risk assessment matrix adopted for the DPIA programme is set out below:
Step 4 — Measures to Mitigate Risk: Identification and documentation of the technical and organisational measures to be implemented to mitigate the identified risks, together with an assessment of the residual risk remaining after mitigation.
The risk assessment matrix used throughout the DPIA programme applies a two-dimensional framework:
This matrix was applied consistently across all 11 DPIAs to ensure comparability of risk ratings and to provide the Audit & Risk Committee with a coherent view of the Company's overall risk profile.
The following consultation process was followed for each DPIA:
•  The DPO (Sanjay Mehta) was consulted on all 11 DPIAs in accordance with the DPO's advisory function under Article 39(1)(c) GDPR, which requires the DPO to provide advice in relation to DPIAs and to monitor their performance.
•  The CISO (Thomas Okoye) was consulted on all DPIAs in respect of the technical security measures applicable to each processing activity.
•  Relevant business owners were consulted on each DPIA as identified in the individual DPIA summaries below (Section 3), including Laura Dearden (VP Product & Engineering), Philippa Crane (Head of People & HR), and Marcus Engström (Head of EU Operations).
•  Ashdown Consulting Group Ltd, the Company's external privacy engineering advisers, provided technical data mapping inputs and assisted with the configuration of the Company's Sundial Solutions platform for DPIA documentation, monitoring, and review scheduling.
All DPIA documentation has been recorded in the Company's Sundial Solutions platform to facilitate ongoing monitoring, review scheduling, and mitigation tracking. Hard copy archives of all DPIA documentation are held by Calderwood & Harkness LLP under engagement reference SC/NTP/2023-0213/PDS.
3. DPIA Summary Register
3.1 Register Overview Table
The following table provides a summary view of all 11 DPIAs completed during Phase 3. Detailed summaries of each DPIA are provided in Sections 3.2 through 3.12 below.
The risk rating distribution across the 11 DPIAs is as follows: 5 high-risk (45.5%), 4 medium-risk (36.4%), and 2 low-risk (18.2%). Detailed analysis of the risk distribution and cross-cutting themes is provided in Section 4 below.
3.2 DPIA-001: NorthCloud AI-Driven Customer Churn Prediction Model
DPIA Reference: DPIA-001 Completion Date: 2 June 2023 Risk Rating: HIGH
Controller: Northgate Telecommunications PLC
Processing Description: NTP deploys an AI/ML model on the NorthCloud SaaS platform that analyses customer usage patterns, billing history, support ticket data, and behavioural signals to predict churn likelihood and trigger retention interventions. The model ingests multiple data streams from NTP's CRM, billing, and support systems, processes them through a machine learning pipeline, and produces a churn probability score for each subscriber. Subscribers identified as high churn risk are flagged for targeted retention interventions, which may include personalised offers, account manager outreach, or service upgrade suggestions. The model was developed by NTP's internal data science team under the supervision of Laura Dearden (VP Product & Engineering) and is hosted on NTP's cloud infrastructure.
Data Subjects: Approximately 6.3 million consumer subscribers and 42,000 enterprise clients across 14 EU/EEA member states and the United Kingdom. All subscribers with active accounts are processed through the model on a rolling basis.
Categories of Personal Data: Account data (name, contact details, account identifiers), usage and interaction data (service usage logs, feature engagement metrics, login frequency), billing and payment data (payment history, outstanding balances, payment method), support history (ticket volumes, issue categories, resolution outcomes), and behavioural profiling scores (inferred churn probability, engagement scores, lifetime value estimates).
Lawful Basis: Legitimate interest (Article 6(1)(f) GDPR / UK GDPR). A legitimate interest assessment ("LIA") was conducted as part of this DPIA. NTP's legitimate interest in retaining customers and optimising service delivery was identified and balanced against the rights and freedoms of data subjects. The LIA concluded that, subject to the implementation of the mitigation measures described below (in particular, transparency requirements and the right to object), the legitimate interest basis is appropriate.
DPIA Triggers: This processing activity triggers a DPIA requirement under multiple criteria:
•  Automated decision-making and profiling (Article 35(3)(a) / EDPB criteria 1 and 2);
•  Large-scale processing (EDPB criterion 5);
•  Innovative technology — AI/ML (EDPB criterion 8); and
•  Evaluation or scoring (EDPB criterion 1).
Key Risks Identified:
1.  Algorithmic bias leading to discriminatory treatment: The churn prediction model may produce systematically different outcomes for different demographic groups if training data reflects historical biases. For example, if certain customer segments have historically received poorer service, the model may predict higher churn for those segments and inadvertently reinforce differential treatment through targeted retention efforts.
2.  Lack of transparency to data subjects regarding profiling logic: At the time of this DPIA, NTP's privacy notice did not contain sufficiently detailed information about the existence of the churn prediction model, the logic involved, or the significance and envisaged consequences of the profiling for data subjects, as required by Articles 13(2)(f) and 14(2)(g) GDPR.
3.  Potential for re-identification of pseudonymised datasets: The model processes pseudonymised data internally, but the combination of multiple data sources creates a re-identification risk if access controls are not rigorously maintained.
4.  Risk of automated decisions producing legal or similarly significant effects without human intervention: If retention interventions triggered by the model (such as service modifications, contractual changes, or pricing adjustments) are implemented without human review, there is a risk that automated decisions may produce effects on data subjects that are legal or similarly significant within the meaning of Article 22(1) GDPR.
Mitigation Measures:
1.  Human-in-the-loop review: No automated retention action that modifies the terms of a subscriber's contract, applies differential pricing, or results in any other outcome with legal or similarly significant effects is to be implemented without prior human review and approval by a member of the retention team.
2.  Data minimisation: Only features that are necessary and relevant to the churn prediction objective are retained in the model input. A feature relevance review is to be conducted quarterly to identify and remove redundant or disproportionate data inputs.
3.  Model explainability requirements: The data science team is implementing SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) outputs for each individual prediction, enabling human reviewers and, where requested by data subjects, providing meaningful explanations of the factors contributing to individual churn scores.
4.  Bias auditing on a quarterly cycle: A structured bias audit is to be conducted quarterly, analysing model outputs across protected characteristics (where such data is available for audit purposes) to identify and remediate any discriminatory patterns. The first bias audit is scheduled for Q4 2023.
5.  Enhanced transparency in privacy notice: NTP's privacy notice is to be updated to include clear, accessible information about the churn prediction model, including the categories of data used, the logic involved, the significance and envisaged consequences of the profiling, and the data subject's rights in relation to profiling.
6.  Data subject right to object to profiling: NTP will implement a clear and accessible mechanism for data subjects to exercise their right to object to profiling under Article 21 GDPR, with objections processed in accordance with the statutory timeframe.
Mitigation Status: Measures are being implemented by Laura Dearden's engineering team in coordination with the data science function. Target completion for all measures is Q4 2023. The privacy notice update is expected to be deployed in September 2023.
Residual Risk: Medium (reduced from high following adoption of mitigation measures). The residual risk reflects the inherent complexity of AI/ML bias risks and the need for ongoing monitoring to ensure mitigation measures remain effective.
Next Review: 12 months from completion (June 2024), or upon any material change to the model (including changes to training data, model architecture, or the scope of retention interventions).
3.3 DPIA-002: Network Traffic Analysis and Anomaly Detection
DPIA Reference: DPIA-002 Completion Date: 30 May 2023 Risk Rating: MEDIUM
Controller: Northgate Telecommunications PLC
Processing Description: NTP operates a network monitoring system that analyses traffic patterns across its telecommunications infrastructure and identifies anomalies for cybersecurity and network optimisation purposes. The system processes subscriber metadata, including source and destination identifiers, timestamps, session duration, and data volume metrics, to detect threats such as distributed denial-of-service (DDoS) attacks, network intrusions, and abnormal usage patterns indicative of compromised accounts. The same data is used in aggregated form for network capacity planning and optimisation. The system does not process the content of communications.
Data Subjects: Approximately 6.3 million consumer subscribers whose network traffic traverses NTP's infrastructure.
Categories of Personal Data: Subscriber metadata (not content), device identifiers, IP addresses, location-derived data (cell tower and approximate geographic indicators), and session timestamps and durations. No content of communications is processed or accessed.
Lawful Basis: Legitimate interest (Article 6(1)(f) GDPR / UK GDPR) — specifically, NTP's legitimate interest in maintaining the security and integrity of its network infrastructure and in optimising network performance for its subscribers. This lawful basis is further supported by Recital 49 GDPR, which recognises network and information security as a legitimate interest.
DPIA Triggers: Systematic monitoring (EDPB criterion 3) and large-scale processing (EDPB criterion 5).
Key Risks Identified:
1.  Potential for surveillance-like monitoring of communications patterns: While the system processes metadata rather than content, the analysis of communications patterns (who communicates with whom, when, and for how long) can reveal sensitive information about data subjects' private lives, social connections, and behaviours.
2.  Risk of location tracking: The use of cell tower data and IP addresses for anomaly detection creates a capability for location tracking of individual subscribers, even if this is not the stated purpose of the processing.
3.  Data minimisation concerns regarding retention of granular metadata: At the time of the DPIA, granular individual-level metadata was retained for network optimisation purposes beyond the period necessary for real-time security monitoring, raising data minimisation concerns.
Mitigation Measures:
1.  Aggregation of data within 24 hours for non-security purposes: Individual-level granular metadata used for network optimisation (as opposed to security purposes) is aggregated within 24 hours of collection, ensuring that ongoing analytics operate on aggregated, non-individual-level data.
2.  Access controls limiting analyst access to individual-level data: Access to individual-level metadata is restricted through role-based access controls to authorised security analysts within the CISO's team, with all access logged and subject to periodic audit.
3.  Retention period capped at 12 months for security data: Individual-level metadata retained for security purposes is subject to a maximum retention period of 12 months, after which it is securely deleted.
4.  Pseudonymisation at ingestion: Subscriber identifiers are pseudonymised at the point of ingestion into the anomaly detection system, with the re-identification key held separately under strict access controls.
Mitigation Status: All mitigation measures have been implemented. Technical controls were already substantially in place prior to the DPIA; the DPIA resulted in the formalisation of the 24-hour aggregation requirement and the 12-month retention cap, which have been implemented.
Residual Risk: Low. The residual risk is assessed as low following the implementation of mitigation measures. The processing is necessary for the security and integrity of NTP's network, and the measures in place ensure that individual-level data is minimised and access is appropriately restricted.
Next Review: 12 months from completion (May 2024).
3.4 DPIA-003: Employee Wellbeing Monitoring Platform (NorthPulse)
DPIA Reference: DPIA-003 Completion Date: 9 June 2023 Risk Rating: HIGH
Controller: Northgate Telecommunications PLC
Processing Description: NTP has developed and deployed an internal employee wellbeing platform branded "NorthPulse." The platform collects self-reported health and wellbeing data from employees through periodic pulse surveys and wellbeing check-ins. Data collected includes self-assessed stress levels, general health indicators, work-life balance satisfaction, and free-text sentiment responses. The platform performs sentiment analysis on free-text responses and generates aggregated team wellbeing scores that are made available to line managers and the People & HR function for workforce planning purposes. Individual-level data is accessible only to the People & HR function and, in limited circumstances, to the occupational health team.
Data Subjects: Approximately 11,400 NTP employees globally, of whom approximately 8,200 are located in the United Kingdom and EU member states and are therefore within the scope of the GDPR and UK GDPR.
Categories of Personal Data: Employee health data (special category under Article 9(1) GDPR), including self-reported physical health indicators, mental health and stress indicators, sentiment responses, and team-level performance correlations derived from wellbeing data aggregated with existing HR performance metrics.
Lawful Basis: Explicit consent (Article 9(2)(a) GDPR). An analysis was conducted as part of this DPIA to assess whether legitimate interest (supported by an Article 9 condition) or another lawful basis would be more appropriate. Given the inherent power imbalance in the employer-employee relationship, and the established position of the EDPB and ICO that consent in the employment context is generally difficult to rely upon as freely given, C&H considered whether explicit consent could be genuinely freely given in this context. The conclusion of this analysis was that explicit consent is the most appropriate basis, provided that the voluntary nature of participation is rigorously safeguarded through the mitigation measures described below. In particular, the Company has committed to a documented policy that non-participation in NorthPulse will have no adverse consequences for the employee.
DPIA Triggers:
•  Special category data processing (Article 35(3)(b) / EDPB criterion 4);
•  Systematic monitoring of employees (EDPB criterion 3);
•  Power imbalance — employer-employee relationship (EDPB criterion 7 — data concerning vulnerable data subjects); and
•  Evaluation or scoring (EDPB criterion 1 — sentiment analysis and wellbeing scoring).
Key Risks Identified:
1.  Coercive consent due to employment relationship power imbalance: The primary risk identified in this DPIA is that employees may feel pressured to participate in the NorthPulse platform, or may fear adverse consequences from non-participation, notwithstanding the Company's stated commitment to voluntary participation. In the employment context, the power imbalance between employer and employee is well recognised by supervisory authorities as a factor that can undermine the validity of consent.
2.  Risk of individual identification from team-level aggregate reports in small teams: Where team sizes are small (e.g., fewer than 10 members), aggregated team wellbeing scores may inadvertently enable the identification of individual respondents' data, particularly where certain team members are known not to have participated.
3.  Potential for use in performance management decisions despite stated wellbeing purpose: There is a risk of function creep, whereby wellbeing data, or insights derived from wellbeing data, could be used by line managers or the People & HR function in performance management, disciplinary, or termination decisions, contrary to the stated purpose of the processing.
4.  Data security of sensitive health information: The processing of health-related data creates a heightened security risk, as any breach of this data could cause significant distress and harm to affected employees.
Mitigation Measures:
1.  Voluntary participation with no adverse consequences for non-participation: A documented policy commitment has been obtained from Philippa Crane (Head of People & HR) confirming that participation in NorthPulse is entirely voluntary and that no adverse employment consequences will follow from a decision not to participate. This commitment is communicated to employees at the point of consent collection and is reflected in the platform's terms of use.
2.  Anonymisation of aggregate reports with minimum group size of 10: Team-level aggregate wellbeing reports will only be generated and made available to line managers where the team consists of a minimum of 10 participating employees, thereby minimising the risk of re-identification.
3.  Strict purpose limitation: A binding internal policy has been adopted providing that NorthPulse data cannot be used for performance management, disciplinary, or termination decisions under any circumstances. This policy is enforceable through the Company's internal disciplinary procedures and has been communicated to all line managers.
4.  Enhanced access controls: Access to individual-level NorthPulse data is restricted through role-based access controls to authorised members of the People & HR function and the occupational health team on a strict need-to-know basis. All access is logged and subject to periodic audit.
5.  Data minimisation: Only data that is necessary for the stated wellbeing objectives is collected through the NorthPulse platform. The categories of data collected have been reviewed and reduced to exclude information not directly relevant to employee wellbeing assessment.
6.  Regular consent renewal: Consent for participation in NorthPulse is renewed annually. Employees are provided with a clear and accessible mechanism to withdraw consent at any time, with immediate effect.
Consultation: This DPIA was conducted in consultation with Philippa Crane (Head of People & HR) and representatives of NTP's employee representative forums, who were briefed on the DPIA process and invited to provide feedback on the mitigation measures.
Mitigation Status: Partially implemented. The policy changes (voluntary participation commitment, purpose limitation policy, and consent renewal process) are in effect. The technical anonymisation thresholds (minimum group size of 10) are being configured by Ashdown Consulting Group Ltd (Anita Chakravarti, Lead Privacy Engineer) and are expected to be operational by Q3 2023.
Residual Risk: Medium (reduced from high). The residual risk remains at medium due to the inherent difficulty of ensuring truly voluntary consent in the employment context and the sensitivity of the data categories involved. Ongoing monitoring is required to ensure that the mitigation measures are effective in practice.
Next Review: 6 months from completion (December 2023), reflecting the sensitivity of the health data processed and the ongoing implementation of technical mitigation measures. This accelerated review cycle will allow for an early assessment of the effectiveness of the mitigation measures in practice.
3.5 DPIA-004: IoT Device Telemetry Processing (Smart City Pilot, Birmingham)
DPIA Reference: DPIA-004 Completion Date: 26 May 2023 Risk Rating: MEDIUM
Controller: Northgate Telecommunications PLC
Processing Description: NTP operates an IoT connectivity platform that processes telemetry data from smart city infrastructure devices deployed as part of a pilot programme in Birmingham. The infrastructure includes traffic flow sensors at key intersections, environmental monitoring devices (air quality, noise, temperature), and public Wi-Fi access points deployed in partnership with Birmingham City Council. The platform ingests data from these devices and processes it for traffic management analytics, environmental monitoring, and public Wi-Fi usage analytics. The processing includes the collection of device identifiers (including MAC addresses from devices probing for Wi-Fi connections), which creates a capability to track the presence and movement of individuals carrying Wi-Fi-enabled devices within the pilot area.
Data Subjects: Members of the public in the vicinity of the IoT devices. Given the deployment in public areas of Birmingham city centre, the number of individuals whose device data may be captured is estimated in the thousands daily, though no attempt is made to identify any individual.
Categories of Personal Data: Device identifiers, MAC addresses (captured from Wi-Fi probe requests), location data (derived from Wi-Fi probe request signal strength and triangulation between access points), environmental sensor data correlated with pedestrian flow patterns, and public Wi-Fi session metadata.
Lawful Basis: Legitimate interest (Article 6(1)(f) GDPR / UK GDPR) — NTP's legitimate interest in delivering smart city analytics services and optimising IoT connectivity infrastructure.
DPIA Triggers:
•  Systematic monitoring of a publicly accessible area (Article 35(3)(c));
•  Innovative technology (EDPB criterion 8); and
•  Location data processing (EDPB criterion 4 — data of a highly personal nature).
Key Risks Identified:
1.  Tracking of individuals via persistent device identifiers: If MAC addresses are not randomised or hashed, persistent device identifiers could be used to track the movement of individuals over time and across multiple locations within the pilot area.
2.  Lack of data subject awareness: Members of the public passing through the pilot area are unlikely to be aware that their device data is being captured, and it is inherently difficult to provide meaningful individual privacy notices to passers-by.
3.  Difficulty in providing meaningful privacy notice: The challenge of informing transient members of the public about the processing in a way that is accessible and meaningful is a recognised difficulty with IoT deployments in public spaces.
4.  Data retention concerns: Retention of granular location-derived data beyond the period necessary for real-time analytics creates a risk of enabling retrospective tracking of individual movements.
Mitigation Measures:
1.  MAC address randomisation/hashing at point of collection: All MAC addresses captured from Wi-Fi probe requests are immediately hashed using a salted cryptographic hash function at the point of collection, preventing the retention of persistent device identifiers.
2.  Retention limited to 7 days for granular data: Granular device-level data is retained for a maximum of 7 days, after which it is aggregated to a level that does not permit the identification of individual devices.
3.  Signage deployed at pilot locations informing of processing: Prominent signage has been deployed at the perimeter of the pilot area and at key locations within it, informing members of the public that IoT sensors are in operation, that device data may be captured, and directing individuals to NTP's privacy notice for further information.
4.  Data minimisation: No attempt is made to identify individual data subjects from the device data collected. The purpose of the processing is limited to aggregate analytics.
5.  Opt-out mechanism via publicly available web form: A web form has been published on NTP's website allowing individuals to register the MAC address of their device for exclusion from data capture, providing a practical (if imperfect) opt-out mechanism.
Mitigation Status: All mitigation measures have been implemented.
Residual Risk: Low. The residual risk is assessed as low following the implementation of mitigation measures, in particular the MAC address hashing, the 7-day retention limit, and the absence of any attempt to identify individual data subjects.
Next Review: 12 months from completion (May 2024), or upon any expansion of the pilot beyond the current Birmingham deployment area.
3.6 DPIA-005: Biometric Access Control System (Data Centres)
DPIA Reference: DPIA-005 Completion Date: 1 June 2023 Risk Rating: MEDIUM
Controller: Northgate Telecommunications PLC
Processing Description: NTP operates a fingerprint-based biometric access control system at its data centres in London, Frankfurt, Amsterdam, and Dublin. The system requires authorised personnel (NTP employees and approved contractors) to authenticate using their fingerprint to gain physical access to data centre facilities. The biometric access control system was deployed as an enhanced security measure to protect critical network infrastructure and customer data hosted in these facilities.
Data Subjects: Approximately 350 NTP and contractor data centre staff across the four locations.
Categories of Personal Data: Biometric data in the form of fingerprint templates. Fingerprint templates are classified as special category data under Article 9(1) GDPR (as the processing of biometric data for the purpose of uniquely identifying a natural person).
Lawful Basis: Substantial public interest (the security of critical national telecommunications infrastructure) is relied upon as the Article 9 condition in the United Kingdom, supported by Schedule 1, Part 2 of the Data Protection Act 2018. Explicit consent is relied upon as a supplementary basis in certain EU jurisdictions, particularly Germany and the Netherlands, where national law imposes additional requirements on biometric data processing in the employment context.
DPIA Triggers:
•  Special category data — biometric data (Article 35(3)(b) / EDPB criterion 4); and
•  Systematic monitoring (EDPB criterion 3).
Key Risks Identified:
1.  Irrevocability of biometric data if compromised: Unlike passwords or access cards, fingerprint data is inherently irrevocable — if biometric templates are compromised, the data subject cannot change their fingerprints. This creates a heightened security imperative.
2.  Cross-border considerations for German and Dutch operations: Germany (Northgate GmbH, Friedrichstraße 91, Berlin) and the Netherlands (Northgate B.V., Amsterdam) have stricter national requirements regarding biometric data processing in the workplace, including Works Council consultation obligations under the German Works Constitution Act (Betriebsverfassungsgesetz) and the Dutch Works Councils Act (Wet op de Ondernemingsraden).
3.  Proportionality of biometric vs. alternative access methods: The proportionality of using biometric access control (as opposed to less intrusive alternatives such as access cards, PIN codes, or multi-factor authentication without biometrics) was assessed as part of this DPIA.
Mitigation Measures:
1.  Biometric templates stored locally on access cards: Fingerprint templates are stored locally on the individual's access card (using secure element technology) and are not held in any centralised database. Authentication is performed through on-card matching, reducing the risk of large-scale compromise.
2.  Template deletion upon termination of access rights: Biometric templates are securely deleted from access cards upon the termination of an individual's access rights (whether due to role change, contract end, or employment termination). A documented process ensures deletion within 5 business days of access rights revocation.
3.  Alternative non-biometric access available upon request: Individuals who do not wish to use biometric access may request an alternative non-biometric access method (access card with PIN), ensuring that biometric access is not compulsory.
4.  Encryption of template data: All biometric template data is encrypted using AES-256 encryption, both on the access card secure element and during any communication with the access control reader.
5.  Jurisdiction-specific consent processes: For the German operations (Northgate GmbH), the Works Council (Betriebsrat) was consulted in accordance with Section 87(1)(6) of the Works Constitution Act. For the Dutch operations (Northgate B.V.), the relevant employee representation body was consulted. Explicit consent is obtained from employees at both locations as the Article 9 condition, supplementing the substantial public interest basis.
Mitigation Status: All mitigation measures have been implemented. The on-card storage architecture was part of the original system design; the alternative access option, consent processes, and Works Council consultations were implemented or confirmed as part of the DPIA process.
Residual Risk: Low. The residual risk is assessed as low following the implementation of mitigation measures. The on-card storage architecture and the availability of non-biometric alternatives are particularly effective in mitigating the identified risks.
Next Review: 12 months from completion (June 2024).
3.7 DPIA-006: Customer Credit Scoring and Fraud Detection
DPIA Reference: DPIA-006 Completion Date: 5 June 2023 Risk Rating: MEDIUM
Controller: Northgate Telecommunications PLC
Processing Description: NTP operates a credit scoring system for consumer subscribers applying for telecommunications contracts, and an ongoing fraud detection system that analyses transaction patterns to identify potentially fraudulent activity. The credit scoring system ingests identity data, financial data, and credit reference data from third-party credit reference agencies to generate a credit score that is used in the decision to approve or decline a telecommunications contract application. The fraud detection system monitors ongoing transaction patterns (e.g., call volumes, data usage spikes, international call patterns) to identify anomalies indicative of fraud (such as SIM-swap fraud, account takeover, or subscription fraud).
Data Subjects: Consumer subscribers applying for or holding NTP contracts, being a subset of the approximately 6.3 million consumer subscriber base.
Categories of Personal Data: Identity data (name, address, date of birth, identity verification documents), financial data (income indicators, employment status), payment history (NTP payment records), credit reference data (obtained from third-party credit reference agencies under reciprocal data sharing arrangements), transaction patterns (call, data, and messaging usage patterns), and fraud indicators (flags generated by the fraud detection system).
Lawful Basis: Contract performance (Article 6(1)(b) GDPR) for credit scoring in the context of contract entry (the credit assessment is a necessary pre-contractual step); legitimate interest (Article 6(1)(f) GDPR) for ongoing fraud prevention.
DPIA Triggers:
•  Automated decision-making producing legal effects — credit scoring decisions to approve or decline a contract constitute decisions producing legal effects or similarly significantly affecting data subjects (Article 35(3)(a) / EDPB criterion 2); and
•  Profiling (EDPB criterion 1).
Key Risks Identified:
1.  Automated refusal of service without human review: The credit scoring system has the capability to automatically decline contract applications that fall below a defined credit threshold, potentially without any human review, which would engage Article 22 GDPR (right not to be subject to solely automated decision-making producing legal effects).
2.  Inaccurate data from credit reference agencies: Credit reference data may be inaccurate, outdated, or incomplete, leading to incorrect credit decisions that unfairly disadvantage data subjects.
3.  Discriminatory outcomes: Credit scoring models may produce systematically disadvantageous outcomes for certain demographic groups, particularly where financial indicators correlate with protected characteristics.
4.  Lack of transparency regarding scoring criteria: Data subjects may not have access to meaningful information about the criteria used in credit scoring decisions, the logic involved, or the significance and envisaged consequences of the processing.
Mitigation Measures:
1.  Human review available for all automated refusals: A human review process has been implemented for all credit scoring decisions that result in an automated refusal of a contract application. The review is conducted by a trained member of the credit operations team within 48 hours of the automated decision.
2.  Right to contest decision and obtain human intervention: Data subjects are informed of their right under Article 22(3) GDPR to contest the decision, to express their point of view, and to obtain human intervention. This right is communicated at the point of decision and in NTP's privacy notice.
3.  Regular accuracy auditing of credit reference data: NTP conducts regular accuracy audits of the credit reference data received from third-party agencies, and provides data subjects with the ability to challenge and correct inaccurate data.
4.  Transparency in privacy notice regarding automated decision-making logic: NTP's privacy notice has been updated to include meaningful information about the existence of automated credit scoring, the logic involved, the significance and envisaged consequences, and the data subject's rights in relation to the decision.
5.  Fraud detection thresholds reviewed quarterly: The thresholds and rules used in the fraud detection system are reviewed on a quarterly basis by the fraud operations team, in consultation with the CISO, to ensure they remain proportionate and accurate.
Mitigation Status: All mitigation measures have been implemented.
Residual Risk: Low. The residual risk is assessed as low following the implementation of mitigation measures. The human review process for automated refusals, combined with the right to contest and obtain human intervention, effectively addresses the Article 22 risks.
Next Review: 12 months from completion (June 2024).
3.8 DPIA-007: Marketing Profiling & Targeted Advertising (NorthCloud Freemium Tier)
DPIA Reference: DPIA-007 Completion Date: 16 June 2023 Risk Rating: HIGH
Controller: Northgate Telecommunications PLC
Processing Description: NTP profiles users of the NorthCloud freemium tier for the purpose of serving targeted advertising and upselling premium services. The profiling involves the analysis of behavioural data (feature usage patterns, login frequency, engagement metrics), inferred demographic characteristics, and cross-device tracking to create comprehensive user profiles that are used to personalise advertising content and premium service recommendations. The processing involves the use of cookies, tracking pixels, and similar technologies on the NorthCloud portal, and extends to cross-device linkage (matching a user's activity across multiple devices based on login events and device fingerprinting).
Data Subjects: NorthCloud freemium tier users, being a subset of the consumer subscriber base across the EU/EEA and the United Kingdom. The precise number of affected data subjects varies with platform usage but represents a significant proportion of the consumer subscriber base.
Categories of Personal Data: Account data (name, email address, account identifiers), behavioural and usage data (feature usage, login frequency, session duration, engagement metrics), device identifiers (device IDs, browser fingerprints), IP addresses, inferred demographic and interest categories (age range, geographic location, interest segments), cross-device linkage data (associations between multiple devices attributed to the same user), and cookie/tracking identifiers.
Lawful Basis: Consent (for targeted advertising under the Privacy and Electronic Communications Regulations 2003 ("PECR") implementing the ePrivacy Directive, and under GDPR). The reliance on consent for this processing is of particular significance given NTP's prior enforcement history: ICO Enforcement Notice ENF/2021/0934, issued 15 September 2021 with a £320,000 administrative fine, related specifically to inadequate consent mechanisms for direct marketing cookies on the NorthCloud portal. Remediation of the matters identified in the Enforcement Notice was completed in March 2022, but this DPIA identified further gaps, as described below.
DPIA Triggers:
•  Profiling (EDPB criterion 1);
•  Large-scale processing (EDPB criterion 5);
•  Cross-device tracking and matching of datasets (EDPB criteria 5 and 6);
•  Prior regulatory enforcement action (heightened risk factor); and
•  Innovative use of technology — cross-device tracking (EDPB criterion 8).
Key Risks Identified:
1.  Lack of granular consent mechanisms: Although remediation following the ICO Enforcement Notice introduced a basic consent mechanism for marketing cookies, this DPIA identified that the existing consent management solution does not provide sufficiently granular per-purpose consent controls. Users are presented with an all-or-nothing choice for "marketing cookies" without the ability to consent separately to different types of profiling (e.g., behavioural advertising vs. premium upselling vs. cross-device tracking).
2.  Opaque profiling logic not adequately communicated to data subjects: The privacy notice does not provide sufficiently detailed information about the profiling logic, the specific categories of inferred data, or the envisaged consequences of the profiling for data subjects, as required by Articles 13(2)(f) and 14(2)(g) GDPR.
3.  Cross-device tracking creating comprehensive behavioural profiles: The combination of data from multiple devices attributed to the same user creates comprehensive behavioural profiles that are significantly more intrusive than single-device tracking, raising proportionality concerns.
4.  Potential for discriminatory targeting: Inferred demographic and interest categories could be used to serve advertising in ways that are discriminatory (e.g., differential pricing or service offers based on inferred socioeconomic characteristics).
5.  Data subject fatigue undermining consent validity: Excessive consent requests may lead to "consent fatigue," where users click "accept" without genuinely engaging with the consent information, undermining the validity of consent as a lawful basis.
6.  Interaction with ePrivacy Directive cookie requirements: The use of cookies and similar technologies for profiling and targeted advertising engages the specific consent requirements of Article 5(3) of the ePrivacy Directive (as implemented by PECR in the UK), in addition to GDPR consent requirements.
Mitigation Measures:
1.  Implementation of granular consent management platform ("CMP"): A new CMP is being developed and deployed, providing per-purpose consent controls that allow users to consent separately to behavioural advertising, premium upselling, and cross-device tracking. The CMP will comply with the IAB Transparency and Consent Framework v2.2 and will be designed to meet the ICO's and EDPB's requirements for valid consent.
2.  Profiling transparency dashboard accessible to users: A user-facing profiling transparency dashboard is being developed that will show each user the inferred categories attributed to them, the basis for the targeting, and the ability to edit or delete inferred categories.
3.  Opt-out mechanism for profiling: A clear and accessible mechanism for users to opt out of profiling at any time, separate from the withdrawal of consent for cookies.
4.  Cross-device tracking only with explicit consent: Cross-device tracking will be activated only where the user has provided explicit consent specifically to cross-device tracking, separate from consent to single-device profiling.
5.  Privacy notice updated to include meaningful information about profiling logic: The privacy notice will be updated to include detailed information about the profiling logic, the categories of inferred data, the significance and envisaged consequences, and the data subject's rights.
6.  Regular consent validity auditing: Periodic audits of consent records will be conducted to assess the validity of consent, including monitoring of consent rates, withdrawal rates, and the granularity of consent choices.
7.  Advertising partner data sharing subject to written agreements: All data sharing with third-party advertising partners will be subject to written agreements incorporating Article 28 (processor) or Article 26 (joint controller) requirements, as applicable, ensuring that personal data is not further processed beyond the scope of NTP's consent arrangements.
Mitigation Status: The new CMP is being deployed with a target deployment date in Q4 2023. The profiling transparency dashboard is in development by Laura Dearden's engineering team. Policy and privacy notice updates are in preparation. Until the CMP is fully deployed and the transparency dashboard is operational, the residual risk remains elevated.
Prior Enforcement Note: This DPIA specifically addresses the risk area that led to ICO Enforcement Notice ENF/2021/0934. The remediation measures implemented following that enforcement action have been incorporated into the baseline for this DPIA, but the DPIA identified further gaps, particularly regarding cross-device tracking and profiling transparency, that were not addressed by the earlier remediation. The continued regulatory attention to this area underscores the importance of completing the outstanding mitigation measures promptly.
Residual Risk: Medium (reduced from high, contingent on full CMP deployment and transparency dashboard implementation). The residual risk will be reassessed following the completion of the outstanding measures.
Next Review: 6 months from completion (December 2023), reflecting the accelerated review cycle mandated by the prior ICO enforcement history and the ongoing implementation of mitigation measures.
3.9 DPIA-008: CCTV & Facial Recognition Pilot (London HQ)
DPIA Reference: DPIA-008 Completion Date: 12 June 2023 Risk Rating: HIGH — RECOMMENDATION: DISCONTINUE PROCESSING
Controller: Northgate Telecommunications PLC
Processing Description: NTP proposed a pilot deployment of facial recognition technology integrated with the existing CCTV system at its London headquarters, Northgate Tower, 88 Canary Wharf Boulevard, London E14 5HN. The pilot was intended to test the use of automated facial recognition for building access verification (replacing or supplementing existing badge-based access) and for security threat identification (matching live CCTV feeds against a watchlist of individuals identified as security threats). The pilot was proposed by the facilities management function and had received preliminary internal approval prior to the commencement of this DPIA.
Data Subjects: NTP employees, contractors, and visitors at the London headquarters, estimated at 2,500 or more individuals on a daily basis. This includes persons entering and exiting the building, as well as persons present in the building reception area and lobby, which are publicly accessible areas.
Categories of Personal Data: Facial biometric data (special category under Article 9(1) GDPR), CCTV footage, visitor identity data (names and company affiliations recorded for visitor management purposes), and access logs.
Lawful Basis Assessed: A detailed analysis of the available lawful bases for the facial recognition component of the proposed pilot was conducted as part of this DPIA:
(a) Substantial public interest (Article 9(2)(g) GDPR / Schedule 1, Part 2 of the Data Protection Act 2018): This basis was considered and rejected. The "substantial public interest" conditions available under UK law for biometric data processing relate primarily to public safety and law enforcement functions. Private-sector building security does not engage the "substantial public interest" conditions in a manner that would support facial recognition processing.
(b) Explicit consent (Article 9(2)(a) GDPR): This basis was considered and rejected. In the employment context, consent is generally not freely given due to the inherent power imbalance between employer and employee. Moreover, employees would be unable to avoid the monitored areas (the building entrance, reception, and lobby), meaning that consent would not be genuinely voluntary. The ICO has consistently taken the position that consent is unlikely to be a valid basis for employee facial recognition in the workplace.
(c) Legitimate interest (Article 6(1)(f) GDPR): This basis is not available as a standalone lawful basis for special category data processing. An Article 9 condition must also be met, and as set out above, no viable Article 9 condition was identified.
The DPIA concluded that no viable lawful basis could be ide