Chapter 11 - Accountability Requirements

Question 1

What is accountability in the GDPR?

Answer 1

-Means the different obligations with which an organisation must comply to show and evidence their compliance with the data protection framework.

-It was first outlined in the 1980 OECD Guidelines and featured in the original Data Protection Directive.

Question 2

What does Article 5 cover?

Answer 2

-Article 5(1) lists six principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality.

-Article 5(2) requires data controllers to demonstrate compliance with these principles.

Question 3

What does Article 24 cover?

Answer 3

-Article 24(1) requires data controllers to implement appropriate technical and organisational measures to ensure and demonstrate compliance with the GDPR, considering the nature, scope, context, and purposes of processing and the risks to individuals’ rights and freedoms.

-Article 24(2) requires the implementation of appropriate data protection policies.

Question 4

What should be included in internal data protection policies?

Answer 4

-Scope, policy statement, employee responsibilities, management responsibilities, reporting incidents, and policy compliance.

Question 5

How should responsibilities be allocated in an organisation?

Answer 5

-Create a privacy management team or council with representatives from business function areas or key stakeholders.

-Alternatively, appoint an individual with primary responsibility for the data protection framework.

Question 6

What should be included in training programs?

Answer 6

-Address legal data protection obligations and policy requirements, related policies, and tailor programs to business operations and employee roles.

-Document and monitor rollout and completion rates.

Question 7

What does Article 25 cover?

Answer 7

-Data protection by design and by default
-Requires data controllers to implement technical and organisational measures to protect individuals’ rights and freedoms, including minimising data processing, pseudonymisation, and applying security standards

Question 8

What does Article 30 cover?

Answer 8

-Outlines the records that must be kept by data controllers and processors, including names and contact details, purposes of processing, categories of data subjects and personal data, recipients, transfers to third countries, retention periods, and security measures.

Question 9

What does Article 31 cover?

Answer 9

-Requires companies to cooperate with DPAs in the performance of their tasks.

Question 10

What does Article 35 cover in relation to DPIAs?

Answer 10

-Requires DPIAs for processing activities likely to result in high risks to individuals’ rights and freedoms.
-DPIAs must include a description of processing operations, assessment of necessity and proportionality, risk assessment, and measures to address risks.

Question 11

What does Article 37 cover in relation to DPO?

Answer 11

-Requires the appointment of a DPO for public authorities, regular and systematic monitoring of individuals on a large scale, and processing special categories of personal data on a large scale.

Question 12

What is the role of the DPO?

Answer 12

-Inform and advise the company and employees, monitor compliance, provide advice on DPIAs, cooperate with supervisory authorities, and act as the point of contact for supervisory authorities.

Question 13

What are Binding Corporate Rules (BCRs)?

Answer 13

-Privacy framework implemented by companies to facilitate cross-border transfers of personal data, ensuring compliance with high data protection standards.
-They require approval and monitoring by the lead DPA.

Question 14

How can companies achieve and demonstrate accountability?

Answer 14

-Develop appropriate privacy policies, embed good privacy standards and practices within corporate operations and culture, ensure privacy and protection of personal data during development phases, and build a clear picture of data processing activities.

Question 15

What is the significance of the CNIL’s (French DPA) Standard?

Answer 15

-Outlines specific requirements for privacy governance procedures, including internal and external privacy policies, the appointment and status of a DPO, data protection audits, and handling data subject access requests and data breaches.

-Companies that comply can obtain a “privacy seal.”

Question 16

What are the examples of high-risk processing in Recital 75?

Answer 16

Processing that gives rise to:

-discrimination
-Identity theft
-fraud
-financial loss
-damage to reputation
-loss of confidentiality
-unauthorized reversal of pseudonymisation
-significant economic social disadvantage
-deprivation of rights and freedoms
-processing special categories of personal data, children’s data, or data related to criminal convictions.

Question 17

What are the three key areas to consider for achieving compliance with the accountability requirement in GDPR?

Answer 17

(1) internal policies
(2) internal allocation of responsibilities
(3) training.

Question 18

Why has accountability become relevant in today’s data protection environment?

Answer 18

-Over the last twenty years, there has been much discussion about how organizations can better embed data protection within their businesses and operations. Formally calling out accountability in the GDPR supports this outcome.

-Regulators and legislators seek an approach that goes beyond a ‘tick-box’ exercise, looking for companies to show they have developed and embedded a culture of data protection within their corporate DNA.

Question 19

What should be included in the policy statement of an internal data protection policy?

Answer 19

-Should set out the company’s commitment to personal data processing, describe the purposes for collecting and processing personal data, and reiterate the principles for processing personal data as stated in Article 5(1).

Question 20

What should be included in the scope of an internal data protection policy?

Answer 20

-Include a brief statement explaining to whom the internal policy applies
- the type of processing activities it covers.

Question 21

What should be included in the employee responsibilities section of an internal data protection policy?

Answer 21

-Should describe employee roles in relation to personal data collection
-specify limitations on the use of collected personal data
-outline steps for maintaining data accuracy
-detail security obligations
-provide guidelines for transferring and destroying personal data.

Question 22

What should be included in the reporting incidents section of an internal data protection policy?

Answer 22

-Require employees to report incidents involving:

(1) loss
(2) theft
(3) unauthorized disclosure
(4) inappropriate use of personal data
(5) clarify steps to be taken when notified by third-party service providers, and reference incident response plans.

Question 23

What should be included in the management responsibilities section of an internal data protection policy?

Answer 23

Specify senior management roles responsible for:

-Assessing business risks
-Developing procedures and controls
-Allocating responsibility for data protection.

Question 24

What should be included in the policy compliance section of an internal data protection policy?

Answer 24

-Clarify that noncompliance may result in civil and criminal penalties, damage to the company’s reputation, and disciplinary action.

Question 24

What is the significance of internal allocation of responsibilities in GDPR compliance?

Answer 24

-Internal allocation of responsibilities facilitates supervision by DPAs -Allows data subjects to exercise their rights -Enables regular updates to policies, procedures, and processes.

Question 25

What is the role of a privacy management team or council in GDPR compliance?

Answer 25

-A privacy management team or council oversees compliance within the data protection framework, comprising representatives from business function areas or key stakeholders.

Question 26

What is the importance of training in GDPR compliance?

Answer 26

-Training informs employees of legal data protection obligations and policy requirements -Tailors training programs to business operations and employee roles, and documents and monitors training completion rates.

Question 27

What is the significance of achieving a culture of data protection within an organization?

Answer 27

-Achieving a culture of data protection involves incorporating key requirements such as developing privacy policies -Embedding good privacy standards and practices, and ensuring privacy and protection of personal data during development phases. -This helps organisations build a clear picture of their data processing activities, understand risks, and ensure employees understand their role in delivering the privacy framework.

Question 27

What are the seven foundational principles of Privacy by Design (PbD)?

Answer 27

-Developed by Ann Cavoukian -These principles advocate embedding data protection into the design specifications of new systems and technologies. 1.Proactive, Not Reactive – Prevent issues before they happen. 2.Privacy as Default – Users’ data is protected automatically. 3.Embedded into Design – Privacy is built into systems, not added later. 4.Positive-Sum, Not Zero-Sum – Privacy and functionality can coexist. 5. End-to-End Security – Protect data from collection to disposal. 6. Transparency – Be open about privacy practices. 7.User-Centric – Give users control over their data.

Question 28

What are the circumstances in which a Data Protection Officer (DPO) must be appointed?

Answer 28

-When processing is carried out by a public authority -If the core activities of the controller or processor consist of regular and systematic monitoring of individuals on a large scale -OR if the core activities consist of processing special categories of personal data on a large scale.