Article
Pensions: what's new this week - 18 September 2023
International data transfers: action may be required
Schemes that transfer personal data outside the EEA in reliance on a mechanism known as ‘standard contractual clauses’ (SCCs) may need to update their contracts before 21 March 2024 to permit those transfers to continue.
If a data controller or data processor is transferring data to which the GDPR applies, and the data is being transferred/made accessible to a separate controller or processor located in a country outside the UK, then this is a ‘restricted transfer’ of personal data and certain further conditions must be complied with.
A restricted transfer may be made to a receiver that is covered by UK ‘adequacy regulations’ (these include the EEA and certain other countries and organisations). If no adequacy regulations apply, then a transfer can only be made subject to ‘appropriate safeguards’. The ‘appropriate safeguards’ include a number of different transfer mechanisms, including the use of binding corporate rules and SCCs.
In March 2022, two new documents replaced the former SCCs: an international data transfer agreement and an international data transfer addendum to the European Commission’s SCCs (read more). The new documents were required to be used for data transfer agreements being entered into after 21 September 2022. Transitional arrangements were provided in relation to agreements entered into before that date, but these end on 21 March 2024, meaning that any such agreements need to be revisited (if the transfers are continuing).
If your scheme currently relies on SCCs as an appropriate safeguard to permit restricted transfers, you will need to check that the wording of these has been updated using one of the new documents. Please contact your usual A&O team if you would like help with this. Where SCCs are used in transfer agreements between your administrator and a third party you should confirm with your administrator that it has entered into the new agreement or addendum.
A transfer risk assessment (TRA) is also required; in the pension scheme context, where the transfer is typically carried out by an administrator or other service provider, the TRA would be conducted by that entity rather than by the scheme. For more information, please see the ICO’s guidance on TRAs and TRA tool.
Read the ICO’s guidance on international transfers.
PPF consultation on 2023/24 levy rules
The Pension Protection Fund (PPF) has published a consultation on its levy rules for 2023/24. In response to a strong funding position, the PPF is proposing a reduction of the levy from GBP200 million to GBP100 million. It expects 99% of levy paying schemes to see their levy fall compared to the current year. The PPF intends to hold the levy at this level for future years unless there is a significant change in risks or the legislative framework.
Minimal changes to the levy methodology are being proposed: the Levy Scaling Factor will increase from 0.37 to 0.40; the Scheme-based Levy Multiplier will change from 0.000019 to 0.000015; and some clarificatory changes will be made. Unlike previous years, given the limited changes, draft versions of the revised Determination, Appendices and Guidance have not been published – these will be released alongside the final policy statement.
The consultation also seeks views on ways of simplifying the levy in future and methodology changes needed to maintain a levy of GBP100 million (the lowest amount the PPF believes it can safely be set at to be able to respond to a funding challenge should one arise) while keeping a reasonable spread of levy burden across schemes. The PPF believes that, to maintain a levy of GBP100 million, significant change in future years is likely to be required.
The consultation will close on 30 October 2023 and the PPF expects to publish its conclusions and final policy statement in December 2023, although these will not include conclusions on the potential changes to the levy after 2023/24 – these will be covered in future consultations.
TPR’s new approach to working with administrators
The Pensions Regulator (TPR) has published a blog post outlining its new approach to working with pension scheme administrators. It will replicate its pension scheme supervision approach with a number of strategically important pension administrators, with the aim of better understanding challenges and tackling risks. TPR has identified the following areas of focus:
- systems and processes;
- data quality;
- trustee focus, understanding and willingness to pay;
- member engagement and communication; and
- pension dashboard readiness.
Pensions Academy Online: 26 and 28 September 2023
Pensions Academy – our regular update on topical issues for pension schemes and the people that run them – is back for Autumn 2023. This Academy will be tackling the following topics:
Tuesday 26 September, 9.30am-10.30am: Responding to a cyber breach – getting it right when things go wrong
Cyber breaches are increasingly a fact of life, and one for which all schemes should be prepared: your immediate next steps can make all the difference to the quality and speed of your response and the mitigation of risk. Join Andy Cork and Benjamin Scrace for a session focusing on lessons learned from recent breaches and how to respond well to an unexpected challenge.
Thursday 28 September, 9.30am - 10.30am: Legal update – what’s changing, now and next
Will they/won’t they… so many pensions developments have had a stop/start feel to them over the last few years, but with the General Code now due to go live this Autumn and a swathe of new ideas in the Chancellor’s Mansion House speech, there’s plenty to discuss. Helen Powell and Angela Stafford will help you prepare for the incoming tide of pensions developments.
If you would like to attend either or both of the sessions, please sign up here.
Related capabilities
