Week 4 Flashcards
What three key dimensions are in play when considering data protection?
- Privacy (philosophy): The right to be let alone
- EU General Data Protection Regulation (law)
- Information Security (technology, procedures, governance)
Explain Responsibility, Accountability, Liability and Due process
- Responsibility: free moral agents are responsible for the actions they take (forward looking)
- Accountability: agents should be held accountable to others for the consequences of their actions (backward looking)
- Liability: agents are liable for damages they incur to others (legal)
- Due process: laws are known and understood, and there is an ability to appeal to a higher authority to ensure laws are carried out
Why would people prefer secrecy over transparency?
- To preserve something precious, private, prohibited, shameful or sacred (e.g. early love; ritual)
- To prevent harm (e.g. national security)
- To protect plans before execution (e.g. in negotiations)
- To protect personal identity (e.g. musical choice)
- To protect property (e.g. copyright; patents)
What is the GDPR?
The GDPR is a regulation applying its ‘force’ directly to its member-states and subjects. The GDPR governs (inter alia) how, when and why ‘Data Controllers’ and Processors process ‘Personal Data’. It aims to harmonize practices and strengthens the protection of natural persons.
What is personal data?
Personal Data: any information relating to an identified or identifiable natural person (‘data subject’)
What are the 3 actors of GDPR?
- Data subject: Natural person, about whom data is processed
- Data Controller: [Art. 4(7)]: Determines purposes and means of processing of personal data
- Data Processor: [Art. 4(8)]: Processes personal data on behalf of the controller
Explain Profiling
Profiling: the use of personal data to evaluate certain personal aspects relating to a natural person.
Explain processing
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.
Explain Consent
Consent: Any freely given, specific, informed and unambiguous indication that the data subject by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
5 special categories of personal data
- Racial or ethnic origin;
- Political opinion, religious or philosophical beliefs
- Trade union membership
- Genetic and/or biometric data processed for the purpose of identifying a person
- Health, sexual life or sexual orientation
Explain GDPR principle 1: Lawfulness, Fairness and Transparency
Lawfulness: GDPR provides the following grounds for lawful processing:
- Consent of the data subject
- Necessity to enter a contract
- A legal obligation
- Necessity to protect the vital interests of the data subject or of another person
- Necessity for performing a task in the public interest
- Necessity for the legitimate interests of the controller or a third party, if not overridden by the interests and rights of the data subject
- Fair:* As much as possible, controllers should act in compliance with the wishes of the data subject. Especially if the basis of processing is consent. Can be linked to ethical behavior.
- Transparency:* Customers must be aware of and really understand what is happening with their data, and its risks. Linked with Fairness. Can refer to the information given to the individual before processing starts, during processing, or the information given once the data subject requests access.
Explain GDPR principle 2: Puprose limitation
Purpose limitation: Personal data shall be: “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes”
Every new purpose, incompatible with the original, requires a new legal basis.
Explain GDPR principle 3: Data minimization
Data Minimization: personal data shall be ” adequate_, relevant and limited_ to what is necessary in relation to the purposes for which they are processed.”
Explain GDPR principle 4: Data Accuracy
Data Accuracy: Personal data shall be “accurate and, where necessary, kept up to date”.
“Every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purpose for which they are processed, are erased or rectified without delay.”
Explain GDPR principle 5: Storage limitations
Storage Limitations: Personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”.
