The DUAA introduces changes to data protection requirements. The key changes to the Local Government Pension Scheme are listed below:
Data Subject Complaints
Schemes must acknowledge complaints within 30 days and respond, “without undue delay” (which is interpreted by the ICO to mean “as soon as possible”).
ICO Powers
The ICO can now compel interviews and require the production of specific documents to assess compliance.
Data Subject Access Requests (DSAR)
The Shropshire County Pension Fund typically are now only expected to carry out “reasonable and proportionate” searches when responding to DSARs.
The one-month response deadline can be paused under the “stop the clock” rule while awaiting identity verification or clarification from the member, with the clock restarting once the requested information is received.
These changes codify existing ICO guidance on DSARs.
Automated Decision Making (ADM)
The Shropshire County Pension Fund may now rely on a wider range of lawful bases – including legitimate interests – when using ADM involving non-special category data.
Safeguards are now mandatory when using ADM (whether special category data or personal data is involved). These include informing the individual about the automated decision; allowing them to make representations, offering human intervention on request or as required by law; and enabling them to challenge the decision.
Restrictions still apply when special category data is involved, and the Secretary of State has a broader power to expand what qualifies as ‘special category’ data under UK GDPR.
Purpose Limitation
Shropshire County Pension Fund may be able to reuse member data for certain processing activities without needing to conduct a fresh compatibility assessment, due to the expanded list of ‘automatically compatible’ purposes.
However, if the new purpose isn’t on the list, the Pension Fund, will still need to assess whether the reuse is appropriate. DUAA sets out factors that controllers are to consider when determining “purpose compatibility” for data reuse in other circumstances.
