Common use of Procedural Clause in Contracts

Procedural. Gatekeeping is the programme of work associated with making a decision as to whether to commence an assessment in respect of a country, by reference to numerous policy factors reflecting HMG and UK interests. • Assessment is the programme of work associated with collecting and analysing information relating to the level of data protection in another country. • Recommendation is the programme of work associated with the DCMS UK Adequacy Assessment team making a recommendation to the Secretary of State who will then decide whether to make a finding of adequacy and make UK Adequacy Regulations in respect of another country. • Procedural is the programme of work associated with making the relevant UK Adequacy Regulations, laying these in Parliament, and any subsequent publication of the ICO’s opinion. • The ICO’s role in relation to UK Adequacy Assessment Work – in line with its independent regulatory role and statutory responsibilities – includes: • During the Gatekeeping and Assessment phases in response to being engaged by officials in DCMS: providing comments and advice to DCMS officials, including via provision of relevant factual information that relate to a country’s data protection laws and practices (e.g. the role and effectiveness of the relevant country’s regulator); • During the Recommendation phase: providing a response on the draft conclusions of a DCMS assessment so that the Commissioner’s view can be included in the recommendation to the Secretary of State and factored into their decision making. In forming its view, the ICO will consider, inter alia, the features of a country’s data protection laws and practices in the round, recognising that different countries have different ways of ensuring adequate levels of data protection; and • During the Procedural phase: providing advice and/or an opinion to Parliament, including on the process followed and the factors taken into consideration by the DCMS Adequacy Assessment team and the Secretary of State. • The Parties agree, where appropriate, to provide assistance to each other, in light of their particular roles, as set out below: DCMS ICO Gatekeeping Share factual research Provide comments and and analysis relating to advice, including factual countries’ data protection information to supplement laws and practices. DCMS research and Share information on analysis, especially on which countries are being issues the ICO is well- considered as potential placed to comment on (e.g. candidates for future the practical assessment. implementation of relevant Provide the list of data protection law and countries agreed by the its understanding of the Secretary of State to role of the foreign commence assessments regulator). (the ‘pipeline’). Assessment Request comments and supplementary information from the ICO. Share issues relating to a foreign country’s laws or practices that differ from the UK. Provide comments and advice on supplementary information to DCMS. Provide informal views on issues identified by DCMS (including what recommendations they will make in any advice or opinion to Parliament). Recommendation Share a proposed policy position with the ICO prior to the Secretary of State taking a decision. Take any appropriate follow-up action in light of the ICO response to this policy position. Make recommendations to the Secretary of State, incorporating the views of the ICO. Notify the ICO of the decision. Share a response on the proposed policy position so that this view can be included in the recommendation to the Secretary of State and factored into their decision- making. Procedural Notify the ICO of the proposed timeline for Where requested, provide comments to assist DCMS laying UK Adequacy regulations in Parliament. with the drafting of relevant adequacy regulations. Notify DCMS of the ICO's timings for the publication of any advice or opinion for Parliament after adequacy regulations are laid in Parliament. • In respect of all phases of work both Parties agree to meet at agreed intervals to discuss: • The ongoing and future programme of UK Adequacy Assessment Work, including sharing information where appropriate on upcoming milestones and timelines and; • International engagement opportunities, including those opportunities where HMG and the ICO can appropriately engage with other stakeholders together (e.g., in conversations with another country and its regulator(s)). • In respect of all phases of UK Adequacy Assessment Work both Parties agree, where appropriate, to share relevant information relating to resourcing capacity, assumptions, and risks so that the programme of UK Adequacy Assessment Work is not hindered by a bottleneck due to the DCMS-ICO relationship. • DCMS will ensure that only appropriate material arising from all phases of the UK Adequacy Assessment Work is shared with the ICO, protecting (amongst other things) HMG's national security, broader policy and legal interests, whilst still seeking to ensure that the ICO has sufficient information for it to provide meaningful and detailed comments, advice and opinions to DCMS and to Parliament. Information will be shared via the appropriate processes, including appropriate Government IT systems, dependent on classification of the material to be exchanged. • Confidentiality • All information will be appropriately classified under the Government Security classification system and protected by each party accordingly. • In particular, the ICO confirms that its usual process will be for it not to publish, share, disclose or otherwise disseminate or make available, directly or indirectly, any information (including its opinion) about UK Adequacy Assessment Work in relation to a particular country, except in exceptional circumstances or if such a disclosure (etc.) is required by law, in which case ICO would consult with DCMS prior to such disclosure (save in exceptional circumstances). Notwithstanding the foregoing, in accordance with the ICO’s role in the Procedural phase, the ICO will, if appropriate, publish any advice and/or opinion relating to the specific UK Adequacy Regulations once those UK Adequacy Regulations have been made and laid in Parliament. • Similarly DCMS confirms that it will not publish, share, disclose or otherwise disseminate or make available, directly or indirectly, any information provided to it by ICO in relation to UK Adequacy Assessment Work without prior agreement with the ICO, except in exceptional circumstances or if such a disclosure (etc.) is required by law, in which case DCMS would consult with ICO prior to such disclosure (save in exceptional circumstances). • Nothing in this MoU shall be taken as in any way affecting any legal obligation or duties or powers of either Party, including but not limited to any obligations under the Freedom of Information Act 2000. • The Parties agree, to the extent permitted by law and where appropriate to do so, to co-operate with each other to enable them to comply with their respective legal obligations, including but not limited to those arising under the Freedom of Information Act 2000. • In particular, to the extent permitted by law and where appropriate to do so, the Parties agree to notify each other in advance of sharing, disclosing or otherwise disseminating or making available, directly or indirectly, any information in respect of UK Adequacy Assessment Work, including where this is to be done in compliance with any legal obligation. • Review • This MOU will be reviewed between 1 July 2021 and 31 December 2021 and annually thereafter, unless a review is mutually agreed to be required sooner.