Autor: MURRAY, Anthony
Due to the nature of a hedge funds business being inherently multi-jurisdictional it is likely that the data protection legislation in at least two or more jurisdictions, if not more, will apply. The European Union (“EU”) is widely regarded as the most progressive political entity to have legislated in this area with the the EU Data Protection Directive (“EU Data Protection Directive”), passed in 1995. As it was passed in the form of a Directive, the European Union member states are subject to minimum standards as set out in the Directive, and may implement higher standards which several states have done. The laws of the EU member states should therefore be considered when analyzing the rules that apply for registration or notification with respect to the standards and requirements for holding personal data. One of the key points to note is the extraterritorial nature of the EU Data Protection Directive which requires that personal data, subject to certain exceptions, may not be transmitted to a jurisdiction that does not have a level of protection which is adequate by the EU. In the United States, the situation is more complex as there is generally no federal laws regulating the protection of data in the same manner as the EU Data Protection Directive and it has been left to the individual states to pass legislation in this area. Massachusetts is a notable jurisdiction which has adopted some of the strictest data protection legislation and which hedge fund managers and service providers should be aware of, in the event that personal data is held on Massachusetts residents.
What data is in scope?
The data which is regarded as in scope and the parties to whom the data relates differs between the jurisdictions. Under the EU Data Protection Directive, the data is described as “Personal Data”. Personal Data includes information that identifies the “Data Subject”, which is the person to whom the data applies. Data Subjects are natural persons, and therefore the Directive would not apply to data on a corporate entity. It will of course apply to the Personal Data relating to natural persons obtained in respect of the corporate entity e.g. the directors or shareholders.
As many of the rules in this area follow the person to whom the data applies it is critical to understand the obligations you may have in the jurisdictions where your investors are based. By way of example, Massachusetts has enacted some of the strictest data protection laws in the U.S. Under the Massachusetts regulations an entity is subject to their rules simply by holding personal data on a Massachusetts resident. A party covered by those rules does not need to have a place of business in the state or other nexus with the state (which is required for the regulations in other states to apply). The data which would bring an entity in scope of the Massachusetts regulations is holding a resident’s first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver’s license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account.
What restrictions are placed on the use of data?
It is very unlikely that a hedge fund or service provider will use personal data received other than for the purposes of processing an investment and meeting their legitimate reporting and record keeping obligations. In this regard the EU imposes the strictest uses on the handling and use of personal data. The EU Data Protection Directive imposes a number of principles to the handling of data including requiring that data is processed fairly and lawfully and for a specific legitimate purpose. Other principles applying under the EU Data Protection Directive require that only relevant information is collected (i.e. additional information not directly required is obtained), and importantly, personal data is destroyed when no longer required. In addition, when complying with the principles data if further processing or use of the data is to be undertaken this may only be done when the Data Subject consents or other exceptions provided by law or other public interest exclusions apply. In addition, the EU Data Protection Directive requires that the party holding the data discloses to the data subject upon request what data they hold on them.
What are the notification requirements for a breach of data protection rules?
Most U.S states have implemented data breach notification statutes, including California, Arizona, Massachusetts amongst others. Generally, the data breach notification laws will require that the person to whom the data relates is notified of the breach. Notification is also normally required to the state (e.g. Attorney General). The procedures, penalties, required actions and liabilities for a data breach vary from state to state. In the European Union certain countries have also enacted data breach notification requirements and the EU Commission has proposed that rules relating to such breaches should be incorporated in amendments to the EU Data Protection Directive.
What impact do the data protection rules impose on contractual negotiations?
When negotiating contracts or agreements where a third party (e.g. a service provider such as an Administrator), the parties should take care to oblige the service provider to ensure that they comply with relevant data protection laws and will protect the data which they receive or will process. A careful review of the liability clauses and indemnities should be reviewed to establish which party will be liable in the event that there is a breach. Certain jurisdictions require paperwork to be put in place covering export or transfers of data (see the references to the EU Model Contracts below). In addition, by way of example the Massachusetts data protection regulations require that parties include a contractual provision in contracts to implement and maintain appropriate security measures for the safeguarding of personal information. As from March 2012, parties were required go back and request that such a provision be included in existing contracts.
What terms should be included in an Offering Memorandum or Subscription document to cover data protection?
When preparing the disclosures in the offering memorandum and subscription documents, consideration should be given to including risk disclosures that information may be transferred to jurisdictions which do not have comparable data protection standards, opt-in or opt-out clauses for investors to decide if they want to share their information (or consents) and consents in the event that information is to be shared with third parties.
What restrictions apply to data export from the EU?
In European Union, the key term is that a third country to which information is exported must have data protection measures which are “adequate”. Note the use of the term “adequate” rather than “equivalent”. The European Union currently recognizes a limited number of jurisdictions as having adequate data protection measures. The jurisdictions are Argentina, Canada, Guernsey, Isle of Man and Switzerland. For the purposes of the EU Data Protection Directive those jurisdictions are therefore treated in the same way as data being transmitted between EU member states. For countries (including the U.S.) which are not so recognized as having adequate data protection standards then additional steps must be taken in order to export the data to such third countries.
The European Union and the U.S. agreed to a special arrangement where data transfers from the EU to the U.S may be regarded as subject to “safe harbor” provisions. Under the terms of the safe harbor, if an entity in the U.S. wishes to process data on EU Data subjects they must self certify to comply with certain data protection principles set out in the EU Data Protection Directive (which are similar to the principles applying to data processors in the EU).
Transfers to other countries which do not have adequate data protection standards, can be achieved on a case-by-case basis by entering into “model contracts” under the terms of the EU Data Protection Directive. The European Union has agreed the form of the “model contracts”. The terms of the model contracts are quite standard, however, it should be noted that election as to the type of information being exported may need to be specified. In addition, some European Union member states require registration of the model contracts, while others do not. Therefore, it is important to verify what the laws of the relevant member state require to make the data export under the model contracts effective.
Do you have a proper data protection system or require further advice?