gunnercooke operates as a group of associated firms and non-profits. Each member in the group brings a distinct character and set of aims; from consulting and training to connecting businesses with aligned charities. Find out more about the gunnercooke group.
We are a team of more than 500 professionals, with the depth of experience which makes us genuine experts in our fields. Together, gunnercooke’s people have strength across just about every corporate discipline and sector. We provide legal, commercial and strategic advice that delivers real value to the clients we work with, which span from multinational enterprises through to unicorns and non-for-profit organisations. Our breadth of expertise covers some of the most interesting and important emerging disciplines, from ESG and charity law, to blockchain and competition.
gunnercooke has 12 offices globally including the UK, Scotland, US, Germany and CEE, with further plans for growth in the coming years. These offices enhance the existing in-house capability of our dedicated international teams and dual-qualified experts that cover China and Hong Kong, Spain, France, Italy, Brazil and Portugal. Our team has experience working across 101 different countries, speaking 30 languages and are dual-qualified in 15 jurisdictions. Our expertise means we can offer large teams to carry out complex cross-border matters for major international clients.
gunnercooke is the fastest growing corporate law firm in the UK, now making its mark globally. We comprise a rapidly growing number of experts spanning legal and other disciplines. Clients benefit from flexible options on fees to suit their needs, access to a wider network of senior experts throughout the relationship, and legal advice which is complemented by an understanding of the commercial aspects of running a business.
Crypto entities, and other organisations leveraging blockchain and distributed ledger technologies, are built on a tech stack that differs fundamentally from the tech stack of traditional industries. These differences include transparency, immutability and the potential for immediate global publication. These differences are the features which enable the innovative products, services and operational efficiencies enjoyed in this industry.
Prosaically, an organisation’s tech stack does not excuse compliance with any relevant laws. Hence, even in the blockchain and crypto industry, financial services licenses must be applied for, taxes must be paid, and privacy must be hard-wired ‘by design and default’ into an organisation’s practices and procedures.
What are “Website Privacy Policies”?
The UK data protection regime comprises the UK GDPR (that is, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR)), along with the Data Protection Act 2018 (DPA 2018).
The UK’s data protection regulator, the Information Commissioner’s Office (the ICO), groups the core principles of the UK GDPR into the ten categories listed in the table below.
The ICO requires organisations to include certain information in this notice, such as the source of the personal data, the lawful bases relied on to justify the processing, and the categories and locations of recipients of any personal data(for example categories of service providers, business partners or counterparties, as well as their countries).
Website privacy policies – why are they more crucial for blockchain and crypto entities than for entities using traditional technology?
To lawfully send personal data outside the UK, organisations must apply appropriate safeguards to ensure that the recipient applies the same standards of data protection as the UK GDPR. These safeguards include contractually obliging the recipient to protect the data (for example using ‘standard contractual clauses’) or by transferring data only to an ‘approved country’.
However, blockchain entities cannot usually comply with these requirements. The immutability and transparency of blockchain, and its potential for immediate global publication, often means that any personal data which has been moved on-chain has been transferred outside the UK, cannot be removed or corrected, and is potentially accessible and visible globally. Picture a ‘peer to peer’ exchange, or the interactions between nodes on a protocol, or the interactions between wallets: these interactions are made possible by the real-time transmission of data on a decentralised basis. Requiring each node on a protocol or each counterparty in a peer to peer exchange to complete the vendor due diligence or other privacy compliance safeguards before sending them any data would defeat the beauty of blockchain’s speed and transparency.
How then can blockchain entities comply with the UK GDPR? How can they mitigate their risk of regulatory fines or legal actions from individuals?
Often, such entities tell themselves that any public data is not personal data. This is incorrect. Any data which can identify an individual (either alone, or when used with technology or other information) is personal data. This includes work email addresses, work titles, social media handles, wallet addresses, public keys, IP addresses, telephone numbers, digital identities among other identifiers. Whether this data is already publicly available is irrelevant. There are very few exceptions to compliance with UK GDPR, and ‘public personal data’ is not among them.
So how can they comply? There is debate among regulators about whether UK GDPR compliance is in fact possible. The consensus is that where personal data must be moved onchain and cannot first be anonymised by technologies such as zero knowledge proofs, arming individuals with sufficient information to enable them to give valid and fully informed consent is the best route to compliance. This requires full disclosure about the use of their personal data, its transmission onchain, and that being onchain means that personal data is being transferred globally (potentially), and will be unable to avail of UK GDPR protections such as the rights to deletion and correction.
What are the penalties for breach?
Failing to comply with the UK GDPR could attract enforcement by the ICO. Their powers include assessment notices, warnings, reprimands, enforcement notices, and administrative fines. Serious breaches of the data protection principles can attract fines of up to £17.5 million or 4% or annual turnover, whichever is higher.
In October 2022, the ICO issued a fine of £1,350,000 for contravention of one of the core transparency principles by collecting, processing, and using personal and special category data in an unsatisfactory manner.
Other recent monetary penalties issued by the ICO include a fine of £12.7 million for numerous breaches by TikTok, and a fine of £78,400 against a hospital trust for sending bulk emails to its users.
To contact Ash, or read more about her practice, click here.
Privacy & Cookies Policy
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.