On 1 July, the long anticipated Bribery Act 2010 came into force.   The Act attracted significant debate during its passage into law, largely due to concerns about how the newly-created s.7 offence of “failure by a commercial organisation to prevent bribery” would apply in practice. 

At an overview level, any organisation carrying on business in the UK can potentially be liable under s.7 for a bribe paid by its “associated persons” (including employees, contractors and subsidiaries), whether or not it knew of the bribe.  There is no requirement that the bribe must take place in the UK – organisations can attract liability for bribes paid by “associated persons” in overseas jurisdictions.  Criminal penalties apply for breach, including unlimited fines and even the prospect of personal liability (including jail time) for directors.  These onerous liabilities, coupled with the wide jurisdictional reach of s.7, are enough to give any senior executive sleepless nights.

“Adequate procedures” to guard against bribery risk

Organisations charged under s.7 have a defence if they can show that they had implemented “adequate procedures” to protect against bribery risk.  With a view to clarifying the anti-bribery measures it expects organisations to adopt, the Government published guidance on implementing “adequate procedures” in March this year (available here: www.justice.gov.uk/guidance/docs/bribery-act-2010-guidance.pdf).  This explained that implementation of “adequate procedures” by an organisation to guard against bribery risk should be informed by six principles: (i) Proportionate procedures; (ii) Top-level commitment; (iii) Risk assessment; (iv) Due diligence; (v) Communication (including training); and (vi) Monitoring and review of anti-bribery policies and procedures.  

FFW has separately published detailed overviews (including FAQs) of the Bribery Act and the Government’s “adequate procedures” guidance at http://www.ffw.com/feature/the-bribery-act-2010.aspx. 

Due diligence and data protection

With the excitement surrounding s.7 and the need to mitigate bribery risk by implementing “adequate procedures”, it’s all too easy for organisations to overlook their privacy compliance responsibilities.  However, organisations that do not take proper account of the privacy consequences of implementing “adequate procedures” risk jumping out of the frying pan and into the fire – on the one hand, mitigating risk under the Bribery Act while on the other hand exposing themselves to a raft of potential liabilities under UK and European data protection legislation.

This is particularly the case with counterparty due diligence.  Undertaking appropriate due diligence will be a compliance cornerstone in guarding against risk under the Bribery Act.  Of critical importance – for both data privacy and Bribery Act purposes – is that any due diligence conducted must be proportionate to its aims. The level of due diligence appropriate in any given situation will necessarily depend on a variety of factors, including the nature of the role and the organisation concerned, the services to be provided, and any other readily identifiable business or bribery risks. 

In the course of conducting due diligence, businesses will undoubtedly handle sensitive personal data relating to prospective clients, employees and contractors – such as information relating to criminal convictions and proceedings, political affiliations (e.g. if the data subject is a ‘politically exposed person’), trade union membership or otherwise.  This raises a number of issues, not least in terms of the need to make (or update) suitable data processing registrations with the Information Commissioner’s Office in order to reflect any sensitive data processed – bearing in mind that failing to make and maintain accurate and up-to-date registrations is, itself, a criminal offence. 

In particular, sensitive data benefits from enhanced protection under data protection law, and organisations must establish a lawful basis to legitimise their sensitive data processing in the first place.  In this context, it is important to note that the Bribery Act does not create a legal obligation to conduct due diligence or to process sensitive data.  It says only that “adequate procedures”, where implemented, are a defence to liability under the Bribery Act.  For this reason, simply assuming that the Bribery Act itself legitimises due diligence processing of sensitive data is misguided.  Businesses must instead consider the sensitive data processing grounds set out in the Data Protection Act 1998 and identify those that permit the specific due diligence processing in question.  Whilst various grounds potentially exist, it is important to identify the specific grounds that will be relied on in any given case, and to ensure that the sensitive data processing keeps within the scope of those grounds.  In many cases, it may be necessary to obtain explicit, informed consent directly from the due diligence subject to enable processing of his or her sensitive data.

The jurisdictional reach of the Bribery Act also has the potential to strain data privacy compliance.  Given their potential liability for acts of bribery conducted by overseas employees, subsidiaries and contractors, a natural response for UK organisations would be to conduct due diligence on any overseas counterparty they engage, either directly or through a subsidiary.  However, overseas data protection regimes may not readily permit processing of sensitive data for due diligence activities designed to mitigate risk under UK law (Spanish and Belgian data protection regimes, for example, impose strict requirements for sensitive data processing).  As a consequence, overseas subsidiaries and contractors that want to process and share due diligence data with UK businesses for Bribery Act compliance purposes may find themselves hindered by their national data protection regimes.  Likewise, overseas organisations that carry on business in the UK may want to implement due diligence procedures to guard against Bribery Act risk, but find themselves constrained by their local data protection laws.   Organisations therefore need to consider carefully how to implement “adequate procedures” in a way that fully addresses the requirements of wider European (and other) data protection regimes where these apply.

Why this matters

Any organisation implementing “adequate procedures” to mitigate Bribery Act risk must consider carefully its responsibilities under data protection law.  Without doing this, it runs the risk of implementing procedures that, while carefully designed to protect against bribery risk, attract liabilities under data protection law.  Due diligence is just one example, but organisations also need to consider other data privacy liabilities arising when, for example, implementing ‘speak up’ or whistleblowing procedures, or when conducting internal investigations into allegations of bribery by staff.

At first glance, the Bribery Act and data protection law might appear to impose conflicting demands on organisations that are difficult to resolve.  However, proportionality is at the heart of both regimes: whatever the “adequate procedures” implemented, they must be proportionate in light of the actual risks to the organisation.   For this reason, rather than considering data protection as a barrier to Bribery Act compliance, it should be viewed as an enabler to implementing effective and proportionate Bribery Act compliance mechanisms.  By considering and identifying potential privacy risks at the outset and rolling out “adequate procedures” that take account of these risks, a happy – and compliant – compromise can be achieved.

If you would like more information, please contact Phil Lee, Senior Associate, at phil.lee@ffw.com.