Chapter 10 - Consumer Protection & Dispute Resolution Flashcards
Who does UK GDPR apply to?
What does UK GDPR do?
What does UK GDPR require firms to do?
UK inc. NI - Replaced EU GDPR
= Places legal obligations on controllers and processors of data.
= Requires firms to show they apply with the principles, e.g. accountability. e.g. by documenting the decisions they make about a processing activity
What information does UK GDPR apply to?
= Applies to personal data if an identified living individual
What does information does personal data include?
E.g. Race/Ethnic Origin
Politics
Religion
Trade Union Membership
Genetics
Health
Sexual orientation
What are the principles of UK GDPR?
- Accountability - Comprehensive but proportionate governance methods
- Lawfulness, fairness and transparency - full compliance with person
- Purpose limitation - should be collected for specified purpose
- Data Minimisation - relevant to what is necessary
- Accuracy - up to date
- Storage limitation - kept in a way which permits identification of data for no longer than necessary
- Integrity and confidentiality - ensure appropriate security of personal data
What 6 factors are required for GDPR processing to be lawful?
- Consent - must be informed and unambiguous
- Contract - firm must have contract with individual
- Legal Obligation - necessary for firm to comply with the law
- Vital interest - protecting individuals livelihood
- Public task - necessary to perform a task in public interest
- Legitimate interest
What rights do individuals have under UK GDPR?
What other factors did UK GDPR introduce? - Important
- Right to be informed
- Right of access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Right in relation to automated decision making & profiling
- Accountability - Comprehensive but proportionate governance methods e.g. privacy impact assessments
- Breach Notification -> data breaches must be reported to Information Commissioners Office and in some cases to individuals affected
- Transfer of personal data to third countries -> cannot transfer data outside of EU, to third countries or international organisations
Briefly explain the Data Protection Act 2018.
What are the main elements?
Coincided with implementation EU GDPR but has been amended to reflect the UK GDPR and is the current legislation governing data protection in the UK
Main elements:
- Ensuring health, social care and education data can be processed, to ensure confidentiality
- Restricting the rights to access and delete data (national security)
- Setting an age whereby parental consent is not needed to process data online
- Providing the Information Commissioners Office (ICO) with enhanced powers to regulate and enforce data protection laws - with much higher fines.
What did the Consumer Rights Act 2015 do?
What does it cover?
What do terms related to subject matter of have to be in the consumer contracts?
Consolidated and clarified existing consumer legislation on unfair contract terms, removing conflicting overlaps with other government policy. Is between a consumer and a trader, seller or supplier.= Ensures terms used in contracts are only binding if they are fair. (unfair = put customers at disadvantage)
Covers both consumer contracts and notices (e.g. renewal notice) & sets factors a court should take into account when determining whether a term is fair.
Transparent - Expressed in plain language
Prominent - Brought to consumers attention
What is the ‘grey list’ of unfair terms relating to the Consumer Rights Act of 2015?
- Terms which exclude/hinder the consumer’s right to take legal action
- Terms which alter the contract unilaterally (by one side) without a valid reason
- New Additions:
-> High charges where consumers decides to cancel contract
-> Terms allowing trader to determine price after contract is bound
-> Terms enabling to determine characteristic of subject matter after contract is bound
Who regulates the Consumer Rights Act 2015
CMA or the FCA - can bring action to prevent further use of the terms & compensatory payments to consumers who have suffered.
What is the definition of a complaint according to the Dispute Resolution: Complaints (DISP) sourcebook?
Any oral or written expression of dissatisfaction, whether justified or not, from or on behalf of, a person about the provision of, or failure to provide, a financial service, which alleges that the complainant has suffered financial loss, material distress or inconvenience.
Who can make an ‘eligible’ complaint:
- Consumer
- Micro enterprise
- Charity with annual income sub 6.5m
- Trustee of trust with net asset value of sub 5m
- Consumer buy-to-let
- Small business at time of complaint
- Guarantor
What are eligible complaints subject to?
FCA complaints handling rules and right of access to FOS. FOS determines eligibility by reference to evidence,
What must firms have in place for non-eligible complaints?
Appropriate procedures for registering and responding to the expression of dissatisfaction
How must complaints be recorded?
- Complaints files retained for 3 years from the date the complaint was received. And record of measures taken for its resolution
- Must keep a register of all complaints and full details of complaints which have been investigated and steps to ensure similar complaints do not occur in the future.
- The register is a permanent record
