QFC Data Protection Regulations 2021

Highlights

• Principles and accountability: data must be processed securely (Article 8, Principle 6), and controllers must be able to demonstrate compliance .
• Consent: where relied on, consent must be freely given, specific, informed and unambiguous, and the controller must be able to show it (Article 11).
• Cookies: the DPO's guidance says that where marketing cookies process personal data such as IP address or location, visitors must be able to consent before processing. Only strictly necessary cookies should default to "on".
• Security: protect the confidentiality, integrity, availability and resilience of processing systems (Article 29).
• Breach notification: notify the DPO within 72 hours of becoming aware of a personal data breach (Article 31(1)). Processors must notify controllers without undue delay (Article 31(7)).
• Powers: the DPO can investigate, audit, order rectification, restrict or ban processing, order DPIAs, and impose penalties (Articles 33 and 36).

Enforcement on record

On 2 September 2024 the DPO issued a reprimand and a US$150,000 penalty against a QFC-licensed firm. The case followed a data breach involving inadequate security, insufficient monitoring and logging, and late notification. The firm's processor had known of the breach 13 days before telling the firm (QFC DPO public notice).

What this means for a QFC firm's website

• Run a consent banner where only strictly necessary cookies are on by default.
• Keep logs that would let you detect and investigate an incident.
• Put processor contracts in place that require prompt breach notice, so the 72-hour clock is achievable.