CIPPE Module 10 - Accountability Flashcards
What does TOM for protection personal data mean in practical terms?
- Data protection by design and default
- Data protection impact assessment
- Data processing records
- Data Protection Officer.
Although most of this applies to DC, DPs also have a role. They must support the DCs and help them demonstrate compliance.
What does data protection by design and default mean?
DPbyDesign: Orgs have to think about data protection beginning in the design phase of their services and extending throughout the lifecycle. (e.g. designing for use of pseudonymization, data minimization). These practices must continue into the operations phase (i.e. once data processing begins).
DPbyDefault: Most protective setting must apply by default. For example, collect only minimal data as default, and limits its accessibility - like what IAM does (user has no access to anything unless explicitly permitted).
What is a DPIA?
- Data Protection Impact Assessment or Privacy Impact Assessment.
- DPIAs help organization incorporate data protection into org planning
-DPIAs function as tools to manage risks to data subjects. - Demonstrate compliance to a supervisory authority.
When is a DPIA required?
- If there is a high risk to rights and freedoms of natural persons.
- Must also consider nature, scope, purpose, context and new technologies involved in processing.
- If automated processing and profiling based decision with legal effects are in play
- Large scale processing of special category of data or criminal data
- Systematic monitoring of public areas on a large scale.
- SAs must publish lists of activities that require DPIA and those that dont.
How do you conduct a DPIA?
- Initial risk assessment to identify data risks
- Measures to address identified risks
What should the DPIA include?
- Description of the processing;
- Legitimate interest being pursued
- Necessity, proportionality to the purpose
- Risks of processing
- Mitigating measures
Essentially the DPbyDesign and DPbyDef controls.
When must the DPA/SA be contacted?
- If the DPIA indicates high risk without the mitigating measures.
The information must also supply a) Responsibilities of DC and DP b) purpose and means of processing c) Measures and safeguards and d) DPO contact details e) DPIA
DPA/SA will assess if mitigating measures are sufficient; may block processing (if deemed insufficient).
What is the role of a Data Protection Policy?
- Part of the TOM to protect data; set the organizational tone
- Part of a larger data protection program
- Explain to employees what they can and cannot do.
- Employee training and awareness
Such policies should be clear, concise and accessible to employees.
What is a ROPA?
ROPA = Record of Processing Activity
Controllers and processors have to maintain it.
It contains names and contact details of processors
Categories of processing activities
Transfer of personal data to a third country
Description of TOMs.
What is purpose of the ROPA?
- Demonstrating compliance - it is about accountability.
Who needs to maintain ROPAs?
- DC and DPs
- Any organization with more than 250 employees
- Any org that processes data frequently
- Sensitive data or criminal data
- If the processing can cause risk to the DS.
What is the role of the DPO?
The role of the DPO is to ensure and demonstrate compliance with the GDPR. However, they are not personally responsible. Compliance is still the responsibility of the DC & DP.
Both controller and processor may have to designate a DPO in select cases per Article 37:
a) if the controller is a public authority
b) if the DC’s core activity is regularly and systematically monitoring DS on a large scale
c) if the data processing is on a large scale and involve sensitive data
What are the tasks & responsibilities of the DPO?
- Ensure compliance with the regulation
- Advise Controllers and Processors
- Manage Risk
- Be a point of contact
- Communicate with DS
- Monitor DPIA
- Exercise professional secrecy.
What are the responsibilities of DC & DPs with respect to the DPO?
Per article 38
1. Ensure DPO is involved properly and in a timely manner on data protection issues
2. Provide resources; access to personal data; resource to maintain expert knowledge
3. DPO reports to highest management
4. No conflict of interest; not penalized for doing their job
What does article 27 say about an EU representative?
DCs and DPs must designate a representative in the EU Member states
i.e. IF they are consistently processing personal data.
The Rep will be the point of contact for SAs and DSs.
