While the GDPR has been in place for several months, the ICO kicked off the new year by updating their data protection guidance with more details in the realm of encryption and password practices. Here are the highlights:

• All organisations should possess a proper encryption policy, detailing the use of encryption and outlining associated staff training protocol. The policy should include these standards:
  • Encryption must be included in company risk assessments.
  • The planned encryption method should meet standards such as FIPS 140-2 and FIPS 197.
  • Personal data should be transmitted within an encrypted communication channel over any untrusted networks.
• The ICO emphasises that businesses with an effective password system possess these qualities:
  • The system needs a proper hashing algorithm. Never store passwords in plaintext.
  • All login pages require HTTPS protection. Limit available login attempts.
  • Users must create a password with more than 10 characters.
  • Two-factor or multifactor authentication should be available as needed.

Time is limited for the UK and the EU to craft a proper withdrawal agreement before Brexit takes place on 29th March 2019, leaving room for a range of possible outcomes. Despite the uncertainty, however, it’s crucial for your business to be prepared for anything—especially in the realm of data and technology. No-deal or not, ensure your organisation remains successful and compliant during the Brexit process.

• Transferring data—Regardless of Brexit’s impact, the GDPR is here to stay. But in terms of data transfers, it’s important for your organisation to review its current export practices. Businesses that transfer data between the UK and EU should keep in mind that this could be considered an international practice post-Brexit. This means your organisation must comply with the GDPR’s restrictions on international data transfers by creating a contractual clause.
• Protecting your database—Currently, an EU right known as the Sui Generis right protects all EU databases. In a no-deal, UK businesses established by UK nationals may lose this right. Protect your database in this scenario by including developers with EU connections in your workforce.
• Securing your supply chain—In the event of a no-deal, any arrangements your business has involving the circulation of technology or hardware with the EU may suffer at the hands of customs delays and potential border regulations. Be sure to revisit your supply chain and develop methods to limit your risk.
•  Reviewing your workforce—Many UK organisations employ EU nationals within their workforce. This practice could be problematic if a no-deal takes place and changes current immigration requirements. Make sure all EU nationals have applied for ‘settled status’ to ensure they can continue working for your organisation post-Brexit.
• Updating agreements—Finally, your business should review all contracts and agreements for material technology with Brexit in mind. Pay close attention to elements such as the territorial scope of licences, the location of personal data, rights in databases and currency changes. In addition, ensure ultimate peace of mind during Brexit by securing proper cover, such as trade
  credit insurance. For more information, contact Hamilton Leigh today.

In 2018, testing autonomous vehicle technology did indeed pick up momentum. In Arizona, autonomous vehicle manufacturers and other stakeholders–including insurance companies–are now speeding up their road testing programmes, following a brief hiatus after the fatal self-driving Uber crash. They are driven by the introduction of rules, regulations and official law to makes roads safer. The UK leads the way in terms of legislation and codes of practice relating to autonomous vehicle operations. In July 2018, the UK Government adopted the Automated and Electric Vehicles Act 2018, laying down a regulatory framework that brings automated vehicle insurance into line with the long-standing practice of motor insurance.

The Act ensures that British drivers are covered both when they drive and when the driver legitimately gives the vehicle control. Legislative support was not so easily granted elsewhere. The US had to pass a bill that prevented individual states from blocking driverless car tests after some strict regulations citing public safety concerns. It can be argued that public confidence is exactly what autonomous vehicle technology currently lacks. This is mainly due to the large number of unanswered questions concerning issues such as safety (what criteria are used to define safety in the autonomous era?), liability (when something inevitably goes wrong, who is responsible?), accessibility (who can use a driverless car safely) and so on.

As autonomous vehicle technology continues to advance, and testing becomes more thorough, the insurance industry is really starting to engage. Not everyone can be an expert, but we take the time to learn about the risks. Hamilton Leigh, for example, keep up to date with the latest technological advances and the latest legal and regulatory decisions so that we can keep our clients informed as they continue to accelerate their interest in autonomous vehicle technology.