9. Respond: Data Subject Rights

Question 1

Privacy Notice - is the privacy information that you make available or provide to individuals when you collect information about them.

Privacy Notice - External Document

Purposes of a Privacy Notice:

Answer 1

Purposes of a Privacy Notice:
- Compliance
- Fairly & Transparently process PII
- Making information accessible regarding how PII is used
- Meeting individuals expectations
- Building trust and confidence

Question 2

Privacy Notice Content and Accessibility

Answer 2

Privacy Notice typically explains:
- Who the organization is
- What information it collects
- How the information will be used
- With whom it will share the information

Strategies to keep privacy notice accessible:
- Layered Approach
- Just-In-Time Notice
- Icon/Symbols
- Privacy Dashboards

Question 3

Consent vs Opt-In/Opt Out

Answer 3

Privacy Notices inform individuals of an organization’s privacy practices, but do not solicit or imply consent.

Opt In - involves an active, affirmative indication
Opt Out - a lack of action implies choice

Record of consent
Prechecked box is not sufficient

Procedures for Withdrawal of Consent:
- address when and how consent may be withdrawn
- rules for communication with individuals
- method for withdrawing and documenting requests

Question 4

Procedures for Withdrawal of Consent:

Answer 4

• address when and how consent may be withdrawn
• rules for communication with individuals
• method for withdrawing and documenting requests

Question 5

Tailoring Privacy Notice to Children & Ensuring Parental Consent

Answer 5

• Compliance: laws specify rules around privacy notice to children
• Language and Delivery
• Age
• Purpose of Processing

COPPA, GDPR: special privacy notice for children, parental consent

CCPA: selling requires parental consent

Question 6

Data Subject Rights and Data Portability

Answer 6

Data Subject Rights - it is critical for organizations to have robust policies related to data subjects rights and be able to respond in a timely manner.

EU-Specific Data Subject Rights - affects organizations within and outside the EU, given the broad scope of GDPR.

Data Portability - means that PII must be transferrable is a right under GDPR based on consent or contract.

Question 7

Right to Erasure vs Right to be Forgotten

Answer 7

Right to Erasure - Under GDPR, individuals have the right to erasure of their PII.

Erasure - ceasing processing and deleting data.

Right to be Forgotten - applies to PII that has been made public by the organization (Erasure has been broadened to include this right)

Question 8

Internal Procedures for Privacy Complaints

Answer 8

• Differentiating between sources & types of complaints
• Designing proper receipts
• Implementing a centralized intake process
• Tracking the process
• Reporting and documenting resolutions
• Redress

Departments & Roles should be easy to reach through phone, email or physical address.