Processing Personal Data Flashcards
What is the definition of processing (include Article)?
Include examples from various sectors.
Article 4(2) - any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means
Examples:
- Recording: a customer service call with a client to demonstrate accountability for following procedures
- Retrieving: discovering a typo and correcting the mistake to access account information
- Disclosure: an HR director shares a list of candidates for an open position with their team
- Storage: HR department stores the newly hired employee’s file containing their employment application, performance reviews and benefits information
- Collection: a Product Dev team collects results from customer satisfaction surveys at a trade show
- Adaptation or alteration: hard copies of the surveys are digitised and the data is aggregated
- Structuring: aggregated data is shown on a graph that compares it with results from previous surveys
What are the OECD Guidelines?
- Collection limitation
- Data quality
- Purpose specification
- Use limitation
- Security safeguards
- Openness
- Individual participation
- Accountability
What is collection limitation?
OECD Guideline - there should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject
What is data qualify?
OECD Guideline - personal data should be relevant to the purposes for which they are used, and, to the extent necessary for those purposes, should be accurate, complete, and kept up-to-date
What is purpose specification?
OECD Guideline - the purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose
What is use limitation?
OECD Guideline - personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with the purpose specification principle except (a) with the consent of the data subject; or (b) by the authority of law
What are security safeguards?
OECD Guideline - personal data should be protected by reasonable security safeguards against such risks as loss or authorised access, destruction, use, modification or disclosure of data
What is openness?
OECD Guideline - there should be a general policy of openness about developments, practices, and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller
What is individual participation?
OECD Guideline - an individual should have the right to: (a) obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him; (b) have communicated to him, data relating to him within a reasonable time, at a charge, if any, that is not excessive, in a reasonable manner, and in a form that is readily intelligible to him; (c) be given reasons if a request made under paras (a) and (b) is denied, and to be able to challenge such a denial; and (d) challenge data relating to him and, if the challenge is successful to have the data erased, rectified, completed, or amended.
What is accountability?
OECD Guideline - a data controller should be accountable for complying with measure which give effect to the principles stated above
What is lawfulness, fairness and transparency of processing?
GDPR Processing Principle (Article 5)
Requires honest practices, such as communicating openly with data subjects about processing activities
What is purpose limitation?
GDPR Processing Principle (Article 5)
Requires collecting and processing personal data for the specified purpose only.
To determine if personal data may be processed further, use a compatibility test to look for links between purposes, nature of the data, method of collection, consequences of secondary uses and safeguards
What is data minimisation?
GDPR Processing Principle (Article 5)
Processing only personal data that is relevant and necessary for the purpose
What is accuracy?
GDPR Processing Principle (Article 5)
Processing complete and up-to-date personal data
What is storage limitation?
GDPR Processing Principle (Article 5)
Storing only personal data that is relevant and necessary for the purpose
