Loading...

Author: Parama Bose

A guide on the EU Corporate Sustainability Due Diligence Directive(CS3D)

by Parama Bose

What is the CS3D?

The EU’s Corporate Sustainability Due Diligence Directive (“CS3D”) is a proposed due diligence framework for companies within the EU. It aims to hold companies responsible for possible abuses of human rights and the environment in their supply chains. Companies under the CS3D must conduct the necessary due diligence procedures and alter their operations and supply chains to meet CS3D standards.

The European Union Council approved the measure on 15 March this year. It is now waiting to be formally approved by the European Parliament before becoming law.

 

Backlash and Concessions

Although NGOs praised the legislation as a milestone for corporate accountability, it has been significantly altered from its original form, resulting in what some describe as a “watered down” version of the original directive.

Germany has been the key player in weakening the CS3D, even though the country has been vital in pushing the directive for the last couple of years (the CS3D-originally proposed in February 2022). It initially abstained from voting to move through the CS3D in February this year. This led to unrest and further abstentions among other EU member states.

Germany’s last-minute change of heart can mainly be attributed to its Free Democratic Party (“FDP”). This economically liberal, pro-business party is part of the German coalition government.

German industrialists have raised several concerns about the CS3D. Thilo Brodtmann, managing director of the Mechanical Engineering Industry Association (VDMA), stated, ‘The EU is putting the nail in the coffin for the international competitiveness of European industry.’ This criticism reflects the fear that the CS3D could burden European companies excessively, potentially affecting their global competitiveness.

Another major industry complaint was the increased bureaucracy associated with the new regulations. Wolfgang Große Entrup, director of the Association of the Chemical Industries (VCI), claimed that “companies are already suffocating in bureaucracy” and that the CS3D “would be another blow.”

 

The German disruption has led to several grants of vital concessions concerning the CS3D. Here are a few: 

  • Non-EU companies will only have to be CS3D-compliant if they generate a turnover of €450 million (previously €150 million)
  • EU companies will only have to be CS3D-compliant if they have over 1,000 employees (previously 500 employees)
  • Industries that have a high impact on the environment will be subject to the same threshold as all other companies (previously, they were going to be subject to lower thresholds)

 

What else do you need to know about the CS3D?

Despite the CS3D’s marginally reduced scope after disruption from Germany and other members, it could still lead to significant changes for all companies that do business with the EU, significantly larger ones.

The final vote for the approval of the legislation occurs on 24 April 2024. After this, companies will begin the process of becoming CS3D-compliant.

The largest companies will be given a reasonable three years to implement corporate policies to fulfill their obligations under the CS3D. In comparison, smaller companies will have a more flexible four to five years. Each member state will decide on punishment for not fulfilling CS3D obligations, providing a clear timeline and room for adjustment.

 

TenIntelligence Insight

The legislation is gradually watering down. However, the new CS3D will still mean significant changes for companies doing business with the EU. To avoid issues with CS3D, it’s crucial to perform due diligence on your supply chain. Remember that CS3D requirements may expand in the future, even if compliance isn’t currently mandatory for your company. Take a proactive approach and guarantee your company is CS3D-compliant from the outset. This will help mitigate potential risks and prepare your company for future CS3D expansion.

 

Written by

James Weeds

Navigating Due Diligence in Emerging Economies 

by Parama Bose

Introduction

Working on due diligence investigations in emerging economies mean our days are never boring and never the same, from working on different subjects, languages, or jurisdictions. As a team, we aim to maintain an outstanding and consistent reputation for excellence, integrity, and success. This is only possible because we pay close attention to changes in the global market and work together to deliver the highest level of professional support to our clients. 

However, what happens when we are entrusted to produce a report from a country considered an emerging economy? In this article, discover the intricacies of conducting due diligence assessments in emerging economies and the unique challenges they present.

 

Defining Emerging Economies

The term “emerging markets” remains undefined. However, it is recognised as a developing nation with low income and fast growth. These countries use economic liberalization to promote their economic development. In other words, their governments have removed restrictions and regulations in the economy to promote a free market approach, which will promote competition and help their economies grow. These emerging economies fall into two categories: those developing countries in Asia, Latin America, Africa, and the Middle East, and those classed as ‘transition economies’ in China and countries that were part of the former Soviet Union.

 

Opportunities and Risks in Emerging Markets

As these economies develop, they will inevitably become more involved in the global markets. The trade volume will increase with the foreign direct investment. Some advantages of having assets in these countries are that they often offer attractive returns to investors over the years. Emerging markets are expected to adopt the same reforms that established markets have implemented, which could potentially expose investors to various risks, including political instability, currency volatility, and domestic infrastructure issues. These markets strive to comply with the standards of developed economies like those in Europe or the United States of America.

 

Challenges and Strategies

1. Conducting due diligence investigations before investment, acquisitions, or recruitment mitigates potential threats, safeguards reputations, and enables informed decisions.

2. Navigating less structured regulatory environments and assessing political stability pose challenges in emerging economies.

3. Accessing reliable information sources and verifying legitimacy requires extensive local expertise and networks.

4. Tailoring investigation strategies to suit both client needs and jurisdictional nuances is essential for success.

5. Adopting a collaborative approach combining cultural sensitivity and technology helps navigate complexities effectively.

 

Due Diligence Investigation Process

We go above and beyond to provide premium independent analysis reports for our clients. Our due diligence review includes

This process involves leveraging all sources available to gather information that aids us in identifying any risks or opportunities that could impact our clients.

Due diligence investigations demand a meticulous and thorough approach. It can be more or less challenging depending on factors such as the jurisdiction in which the investigation needs to be conducted.

 

Contrasting Environments: Established vs. Emerging Economies

For example, in the United Kingdom, due diligence has a more established legal framework, regulatory environment, and access to reliable open information sources. It facilitates information gathering, and a much more transparent assessment process is usually similar in all established economies worldwide. The degree of success varies in the collection of information from official channels of communication.

In contrast, conducting due diligence investigations in emerging economies presents additional challenges. It includes navigating unstructured regulatory environments, assessing political stability and potential corruption risks, and dealing with the potential unavailability of reliable information.

 

TenIntelligence Thoughts

Due diligence investigation in emerging markets requires more extensive local expertise, networks, and reliable resources to gather information and verify its legitimacy. Nonetheless, tailoring the investigation to suit our client’s and the jurisdiction’s needs is one of our many skills. Our multicultural multilingual team is proficient in adapting research strategies to the nuances of emerging economies. We adopt a collaborative approach that combines cultural sensitivity and technology to help navigate the unique challenges and complexities of due diligence in emerging markets effectively.

 

Submit your request to learn more about Tenintelligence’s due diligence solutions or reach out to our experts at  info@tenintel.com.

 

Lisseth Ortiz Diaz

Written by

Lisseth Ortiz Diaz

ICO announces new data protection fining guidance March’24

by Parama Bose

The Information Commissioner’s Office unveils new data protection fining guidelines, offering clarity on penalty issuance and fine calculation, enhancing transparency for organizations. The new guidance is issued to replace sections of the ICO Regulatory Action Policy, published in November 2018.

With data breaches and privacy infringements increasingly making headlines, regulatory authorities worldwide have bolstered their oversight to ensure strict adherence to data protection laws. Thus, understanding the ICO’s stance on fines is essential for organizations to ensure compliance and mitigate risks effectively. Read this article to explore the new data protection fining guidance  from the Information Commissioner’s Office (ICO) issued in March 2024, shedding light on its approach to fines and enforcement strategies. 

 

Deciphering ICO’s latest data protection fines

In the United Kingdom, the Information Commissioner’s Office (ICO) holds a pivotal role in enforcing regulations such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), wielding the authority to levy fines for any infringements.

Under the UK GDPR and DPA, the ICO possesses the ability to impose fines for infringements, ranging from failures to implement adequate security measures to unauthorised data processing. These fines serve the dual purpose of penalising non-compliance and deterring future violations. Consequently, simplifying the navigation of legislation.

At the core of the ICO’s enforcement strategy lies the concept of an ‘undertaking,’ which encompasses any entity engaged in economic activities. This expansive definition ensures the accurate calculation of fines. Thus, uniformly applying it across organizations of varying sizes and legal structures.

 

The five fundamental steps for effective enforcement and compliance

The ICO adheres to a structured approach outlined in its Data Protection Fining Guidance. The steps are as follows : 

  1. Assessment of the seriousness of the infringement: For instance, in the scenario where a healthcare provider inadvertently exposes sensitive patient data due to weak internal access control procedures, the ICO evaluates the severity of the breach. It considers factors such as the volume of data compromised, the sensitivity of the information, and the potential harm to individuals. 
  2. Consideration of turnover: In assessing fines, the ICO factors in the turnover of larger organizations, ensuring fines are commensurate with their financial capacity while serving as an effective deterrent. 
  3. Calculation of the starting point: For instance, if a major corporation engages in systemic data misuse for financial gain, the ICO may impose a substantial fine to deter similar misconduct by other entities operating within the same sector.
  4. Assessment of aggravating or mitigating factors: The ICO takes into account various factors, such as the organisation’s response to the breach and its cooperation during investigations, which may warrant an increase or decrease in the fine.
  5. Adjustment to ensure effectiveness: Finally, the ICO evaluates fines to strike the right balance between deterrence and proportionality, ensuring they are sufficient to achieve their intended objectives without exceeding the statutory maximum amount. 

 

Hints and Tips for Organisations: 

  • Prioritize Data Protection: Allocate adequate resources and establish clear policies to prioritise data protection within your organisation. 
  • Stay Informed: Keep track of updates on developments in data protection regulations. Especially, issued by authorities such as the ICO to ensure ongoing compliance with evolving requirements. 
  • Conduct Regular Risk Assessments: Regularly assess your organisation’s data processing activities and associated risks. The assessments will help identify potential compliance gaps and take corrective action proactively. 
  • Invest in Training: Provide comprehensive training and awareness programs for employees. This step will ensure their responsibilities and obligations under data protection laws. 
  • Implement Robust Security Measures: Prevent data breaches and unauthorised access to sensitive information by deploying advanced security measures.
  • Engage Legal Counsel: Seek guidance from legal experts specializing in data protection. It is essential to obtain advice tailored to your organisation’s specific circumstances and compliance needs. 
  • Maintain Documentation: Keep detailed records of your organisation’s data processing activities, risk assessments, and compliance efforts. This process will help demonstrate accountability and transparency to regulatory authorities. 

 

Examples of Fines: 

  1. In 2023, the ICO imposed a fine of £20 million on a telecommunications company. The company had unlawfully sent millions of marketing messages, reflecting both the severity of the breach and the company’s significant turnover.
  2. A healthcare provider faced a £10 million fine by ICO. The organisation was accused of exposing patient records due to inadequate security measures.

This highlights the ICO’s commitment to enforcing data protection laws across diverse sectors. 

Summary

The ICO’s latest guidance on Data Protection Fining offers a comprehensive roadmap for organisations abiding by GDPR and DPA compliance. Adhering to the structured approach outlined can ensure robust data protection measures, mitigation of risks, and maintenance of trust. 

Seeking guidance from a Data Protection Officer (DPO) provides invaluable insights and assistance in implementing effective compliance strategies. DPOs offer practical advice on risk assessments, policy formulation, and staff training. 

Have questions on compliance and ICO fines? Submit your query at  info@tenintel.com and let our seasoned DPO experts help you.

Digitalization in Finance in the UAE

by Parama Bose

The UAE has been undergoing a digitalization in finance. In other words, all governmental services are available digitally under the UAE Digital Government Strategy 2025.   

In September 2023, the United Arab Emirates (“UAE”) issued Federal Decree Law No. 14/2023 through presidential decree, introducing new digital legislation. The new law sets out to regulate digital trade and offer additional protection to resident sellers and consumers in the UAE or abroad. The new law will replace its predecessor, Federal Decree Law No. 9/2022, as it offers a wider range of protections and covers various types of additional technology. In the last few years, e-commerce has surpassed its traditional website format and now encompasses several other platforms, such as apps and blockchain. These are now covered by the Federal Decree Law No. 14/2023, as are all other digital means of trade.     

 

Digital Finance  

In December 2023, the Central Bank of the UAE joined the Gulf Cooperation Council (GCC) AFAQ payment system. AFAQ is a digital payment system operated by Gulf Payment Company. It facilitates secure financial transactions within the GCC in local currencies instantly and at reduced fees. This marks a significant progress in digital finance, enhancing integration within the GCC region.

Furthermore, the UAE government adopted blockchain to ensure data security and accessibility. Introduced in 2018, the Emirates Blockchain Strategy aimed to digitize 50% of government transactions in 2021. A prime example is UAE Pass, utilizing biometrics and blockchain, granting digital access to government services instantly. Additionally, blockchain is utilized in healthcare, supply chain management, and smart contracts, ensuring transparency and data integrity.

 

Cryptocurrency  

In February 2024, the UAE achieved its first successful cross-border transfer of fifty million digital dirhams (approx. USD 13 million) from its Central Bank’s digital dirham to China. During the same week, the Central Bank signed a Memorandum of Understanding with digital asset provider Fuze. The aim was to develop compliant digital assets solutions.

Cryptocurrency has seen an exponential rise in use and reliance in the region in the last couple of years, as it facilitates cross-border transactions and acts as an alternative form of investment.   

In February 2024, the UAE completed its first successful cross-border transfer of fifty million digital dirhams (approximately USD 13 million) from its Central Bank’s digital dirham to China. During that week, the Central Bank and Fuze, a digital asset provider, signed a Memorandum of Understanding to create digital asset solutions that adhere to the legal regulations.

As these new strategies and digitalisation processes are increasingly gaining momentum in the UAE, Federal Law No. 4/2022 was issued to help protect virtual asset investors. As a result, the Virtual Assets Regulatory Authority was put in place to help support their protection.  

 

Virtual Assets Regulatory Authority (VARA): Appointing a Data Protection Officer 

With the launch of Dubai’s Virtual Assets Regulatory Authority (VARA) in March 2022, VARA became the world’s first independent regulator overseeing the provision, use, and exchange of virtual assets, commonly known as crypto assets or crypto/digital currency. 

With this pioneering innovation, VARA serves as a transparent authority for the regulation and compliance of virtual asset brokers, cryptocurrency companies, and other supporting service providers. VARA intends to “develop the regulations, rules, and standards required for regulating, supervising, and overseeing Virtual Asset Platforms, Virtual Asset Service Providers, and all other matters related to Virtual Assets.” 

As part of its regulations, VARA recognises that with the continued rise in cyber-attacks and data breaches, it requires all its Member Organisations to adhere to an increased focus on securing personal and company data and meeting data protection compliance regulations.   

Therefore, entities seeking to obtain a license with VARA must demonstrate and comply with data protection laws by fulfilling the data privacy requirements, including the appointment of a Data Protection Officer and/or Chief Information Security Officer (CISO) as outlined under Rule II, A1 & A2.The mentioned requirements will ensure that existing Member Organisations of VARA and future license applicants, meet the UAE’s recent Personal Data Protection Law (PDPL), the Dubai International Financial Centre (DIFC) Data Protection Law 2020 (DPL), and if applicable other international regulations and legislation including GDPR. 

VARA outlines its expectations for data protection compliance by stating the following Rules: 

  

Rule II, A1: Compliance with Applicable Data Protection Law 

 

1.VASPs (“Virtual Asset Service Providers”) must comply with all applicable data protection and data privacy requirements in all relevant jurisdiction[s] as follows: 

a) within the UAE, including the PDPL and any sectoral or free zone laws and regulations that may apply to the VASP; and 

b) any data protection laws outside of the UAE that may apply to the VASP’s activities wherever conducted. 

2. Compliance with all applicable data protection and data privacy requirements under Rule II.A.1 of this Technology and Information Rulebook shall include, but not be limited to, where data may be stored or located and how such data is transferred. 

  

Rule II, A2: Compliance Programme 

 

  1. VASPs shall produce and implement a written compliance program to protect the privacy of Personal Data, following all applicable data protection laws. 
  2.  Not withstanding the requirements of any applicable data protection laws, VASPs shall at a minimum comply with the following VARA requirements: 

a) Appoint a Data Protection Officer who has the appropriate competencies and experience to perform the statutory duties and responsibilities associated with this role under applicable data protection laws [including under Article 11 of the PDPL] [Data Protection Officer]. The Data Protection Officer can be the same individual as the CISO of the VASP; and 

  

b) Establish a function in their organisation that is responsible for the management and protection of Personal Data by all applicable laws and is appropriate for the level of risk involved with such Personal Data, including responsibility for implementing and maintaining appropriate policies, procedures, systems, and controls. 

 

The role of Data Protection Officer (or DPO) is a designated individual who has the experience to be responsible for overseeing an organisation’s data protection strategy and ensuring compliance with data protection laws. The DPO acts as a bridge between the organisation, data subjects, and regulatory authorities. They play a crucial role in maintaining data privacy and security. 

 

TenIntelligence Thoughts   

These structural and technological advancements to the UAE’s governmental and financial sector have led to a more enhanced security system with a wide accessibility and efficiency. The nation’s ambitions of becoming a leading destination for digital assets is well underway. However, it is working to ensure the proper laws are in place. In these instances, it is vital to maintain user privacy and compliance with the corresponding regulations.  

If you are based in the UAE or are looking to invest in their digital financial sector, submit your interest or contact us at info@tenintel.com for expert guidance. 

 

Achieving ISO 27001 Certification for Data Security Excellence

by Parama Bose

Introduction:

ISO 27001 is a vital framework for data security, providing organizations with clear guidelines to protect sensitive information. Our recent recertification highlights not only our expertise but also our unwavering commitment to maintaining the highest standards of data protection. As experienced professionals in this field, we are well-equipped to support others in their compliance journey, strengthening their data security practices.   Continue reading “Achieving ISO 27001 Certification for Data Security Excellence” →