GDPR

General Data Protection Regulation

Introduction

The main ideas of the GDPR, its enforcement and possible penalties.

The requirements, as well as advice on what you need to do to comply with your existing privacy policy

Main ideas

1. The protection of natural persons with regard to the processing of personal data is a fundamental right.

2. Any processing of personal data must be lawful and fair.

It must be clear to natural persons that personal data about them was collected, used or otherwise processed, and to what extent exactly the personal data is or will be processed.

3. If the processing is based on the consent of the data subject, the party processing the data must document that the data subject gave consent to the processing operation

4. Personal data must be processed only if the purpose of the processing cannot reasonably be achieved by other means. To guarantee that personal data is not stored longer than necessary, time limits must be set by the controller for erasure or for periodic review.

"Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

The principles of data protection should apply to any information concerning an identified or identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, for direct or indirect identification of the natural person.

for example "All Finnish people in the Swiss office are great"

Files or sets of files, as well as their cover pages, which are not structured according to specific criteria, should not fall within the scope of these Rules

Enforcement and penalties

The following sanctions may be imposed:

A written warning in cases of a first and unintentional non-compliance
Regular periodic data protection audits
A fine of up to €20 million or 4% of the company's annual turnover (whichever is greater)

Actual practice will come through court cases in many years

Requirements

The user must be informed

Transparency is a key principle. Tell your users what, why, where, how and when data is collected.

Data availability and portability

You need to make it crystal clear what exactly you know about each user.

The export of this data must be done in a popular machine-readable format.

Data rectification

There must be a way to correct the data (on request or automatically, if possible)

Erasure

Consent to data processing can be withdrawn at any time Unneeded data must be deleted.

Provide for the situation of a restricted right to data processing.

In special cases (by a court decision, for example) the data must be retained but not used.

Direct marketing object

Demonstrate consent

You must be able to say how and when a person accepted the privacy policy

Restrict access

Which tasks require access to this information. Who performs them?

Make sure the circle of people is known and adequate → conduct an audit → check the technical restrictions

Ensure data encryption, set up user account management, and so on.

Documentation

You must document all procedures related to the protection of personal data.

Update the document flow and data processing, train the staff, and so on.

Contracts

The terms of data processing must be set out with partners. Perhaps someone else processes your data (an accounting company, for example) You may be processing a client's data (for example, hosted on your servers)

Monitoring

Data breaches must be recorded within 72 hours.

You are legally obliged to notify the supervisory authority without undue delay.

Your clients must be notified if a leak of their personal data is discovered.

What needs to be done

Find the data (find all personal data) → Determine whether it is needed, and delete it if it is not. If it is needed, find out who needs it and for what purpose. → Policy (create or update a privacy policy that describes the information) → Consent (obtain consent from all persons involved) → Repeat as necessary.

First of all, the documentation needs to be put in order. Find all lists containing personal information.

Never create unorganised lists containing personal information.
- A new security policy must be created for every new client
- Do not send documents with personal information by email; store them in the cloud and send download links.
- If a document that could be taken for a list containing personal information exists, do not keep it on your desk. It must be kept in a safe or destroyed.

Links

gdprchecklist.io eur-lex.europa.eu

Article author: Andrei Olegovich