Data Protection Law & Regulation Flashcards
Personal Data
Any information relating to an identified or identifiable natural person.
Sensitive Personal Data
Subset of personal info; usually requires additional safeguarding of its collection, use, and disclosure
Pseudonymized Data
A unique code or pseudonym is used as a temporary solution to protecting info.
It is reversible.
Subject to EU data protection laws
Anonymous Data
Not related to an identified or an identifiable natural person aka unidentifiable
Not protected by the GDPR
Data Processing
Any operation performed on data
Controller
An organization or individual that decides how and why personal data is processed
Data Processor
An organization or individual that processes information on behalf of the data controller
Data Subject
An individual about whom the data is processed
Territorial Scope
- Processing of personal data when a controller or processor established in the EU (regardless of whether or not the actual processing takes place in the EU).
- Processing the personal data of data subjects in the EU relating to offering goods or services or monitoring behaviour in the EU (where the controller or processor is not established in the EU).
- Processing of personal data by a controller not established in the EU but in a place where member state law applies by virtue of public international law.
Material Scope
Activities covered by the GDPR
Processing of personal data wholly or partly by automated means
And to the processing of personal data other than by automated means which form part of a filing system
Exclusions to Material Scope
(Processing not regulated by the GDPR)
- Activities outside of the scope of EU law: for example national security activities.
- Law Enforcement and Public Security
- Purely personal or household activities.
Organizations that are not established in the EU that monitor behavior will be subject to the GDPR when:
The behavior being monitored occurs within the EU
GDPR Processing Principles
Article 5
Lawfulness, Fairness and Transparency of Processing Purpose Limitation Data Minimization Accuracy Storage Limitation Integrity and Confidentiality Accountability
Lawfulness, fairness, and transparency
GDPR processing principle:
Data subjects must be aware of the fact that their personal data will be processed, including how the data will be collected, kept and used, so they can make informed decisions
Purpose Limitation
Principle that requires collecting and processing personal data for the specified purpose only
Proportionality
considers the amount of data to be collected and whether it is adequate and relevant in relation to the purposes for which it is being processed
Accuracy
GDPR Principle that states organizations ensure personal data is accurate, complete, and up-to-date
Storage limitation (retention)
retaining only personal data that is relevant and necessary for the purpose
organizations should retain personal information only as long as necessary to fulfill the stated purpose
Integrity and Confidentiality
GDPR requires that controllers and processors implement measures to ensure the ongoing confidentiality, integrity, availability and resilience (CIAR) of processing systems and services.
Integrity refers to the consistency, accuracy and trustworthiness of the data
aka security safeguards (OECD)
Data Minimization Principle (EU specific)
Data controllers must only collect and process personal data that is relevant, necessary and adequate to accomplish the purposes for which it is processed.
Controllers should consider Necessity and Proportionality when applying Data Minimization principle
Lawful Processing Criteria
- Consent
- Contract
- Legal obligations
- Vital interests
- Public Interest or official authority
- Legitimate interests
Consent
clearly distinguishable intelligible in clear and plain language freely given as easy to withdraw as it was to provide specific informed unambiguous
Explicit consent
Article 9 - special categories
unambiguous, freely given, specific, informed
+ a clear affirmative act by the data subject
(checking opt-in or choosing technical settings for web apps)
Contractual necessity
Lawful basis for processing
Performance of a contract if the processing is necessary to perform the contract (and data subject is party)
or if the data subject requests the processing to enter into a contract
Ex: Customer purchases book from company, they need process in order to send book
