Chapter 4 Data Protection Concepts Flashcards
What are four building blocks that comprise the meaning of PD?
Any information
Related to
Identified or identifiable
Natural Person
- BLOCK - INFORMATION
Which aspects of the concept “information” help define when information will be considered PD and explain each of them
NATURE - any type of statement about the person, objective or subjective. E.g. the employee is the head of IT; the employee is a good worker. Information does not need to be true to be considered personal data!
CONTENT - any sort of information not limited to the individual’s private or family life. Include any activity undertaken by the individual in professional or public sphere or in private life. E.g. individual’s work phone number.
FORMAT - processed by automated or manual means if the data “form part of the filing system”
Data kept on paper, computer memory, on a tape …
GDPR is technology neutral
- BLOCK - RELATING TO
Explain the meaning of this block
Information must be about an individual, there must be a relationship between the information and the individual.
Some types of information will always relate to an individual (e.g. tax number), for other types of information (e.g. information that relates to objects, processes and events) it depends on how it is being used or how it is being considered in a particular context.
WP29: for PD to relate to an individual, one of the following 3 elements must apply:
- content element: the information is about the individual in the most common sense of the word
- purpose element: if the info is processed to evaluate, consider, or analyze the individual in a certain way
- result element: processing of certain information has impact on individual’s rights and interests
- BLOCK - IDENTIFIED OR IDENTIFIABLE
Explain the meaning of this block
Identifiable:
- it is not yet identified but it is possible to do so
- Person may be identified DIRECTLY or INDIRECTLY (e.g. by IP address)
-** information combined with other pieces of information will allow the individual to be distinguished from others**
Possibility of identification: how likely it is for the means of identification to be used to identify the individual - cost of and the time required for identification, technology available and technological developments.
Data anonymisation - is increasingly difficult. Anonymised data is not PD.
Pseudonymisation - helps to satisfy data minimisation requirements but data is still PD. To identify a DS, you need additional information which is kept separately.
Pseudonymisation and data sharing
- BLOCK - NATURAL PERSON
applies to natural persons universally, regardless of their country of residence, taking into account the GDPR’s territorial scope
GDPR does not apply to deceased persons, which may be protected through SCCs.
Explain sensitive personal data?
special categories of PD (SCPD) merit specific protection as their nature means their processing could create significant risks to individual’s fundamental rights and freedoms
PD revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data (for unique identification), data concerning health or sex life/orientation
Genetic data - inherited or acquired genetic characteristics which give unique information about the physiology or health of a natural person and is acquired by an analysis of a biological sample
health information:
- physical or mental health
- provision of health care services
- health status
biometric data - processed through specific technical means allowing unique identification or authentication of a NP
If a photograph or video footage is processed to deduce SCPD, Article 9 applies
Why is it important to correctly allocate the role of the controller and processor?
To correctly determine the allocation of legal obligations arising under the GDPR, which is essential for protecting the rights and freedoms of DS
Definition of the controller
the natural or legal person, public authority, agency or other body
alone or jointly with others determines the purposes and means of processing
it is a decision maker
carries most of the responsibilities (informing DS, legitimate basis, DS rights, DPIA, security, notification)
controller will be the first target of the enforcement actions by DPAs
by determining the controller we determine who is responsible for the compliance with DP laws and how individuals can exercise their rights
controller carries primary data protection responsibility and liability
allocation of the controller will also determine which SA can supervise the processing activity
the location of the controller is important to determine any local DP laws
Definition of the processor
processes PD only on documented instructions by the controller
obligations - international data transfers, security, notifying controllers in case of a data breach
Guidelines explaining the controllers/processors
EDPB Guidelines 7/2020
5 building blocks within definition of the controller
natural or legal person, public authority, agency or other body
determines
alone or jointly with others
purposes and means
of the processing of PD
natural or legal person, public authority, agency or other body
including individual or group of individuals
individual inside an organization, responsible for a processing activity, is not a controller because it acts on behalf of a controller
such individual may not act outside the scope of the authority given by the controller and the controller should have T&O measures in place to prevent this
determines
has a decisive influence
legal context and factual elements and circumstances must be considered
- a national or member state law can set out a task and identify the controller
- the law imposes an obligation on an organization which involves the processing of PD - the nature of data is determined by law but the organization that is subject to obligation will be the controller
jointly or with others
several different entities may be controllers for the same processing if they are all involved in the relevant decision making.
purposes and means
why and how of the processing activity
purpose: goal, anticipated result, reason
means: the customer must determine essential means and can leave non-essential means to the processor but the controller must be fully informed of the means used because of its obligations to:
- - be able to demonstrate compliance with GDPR (A24)
- - only use processors providing sufficient guarantees (A28)
- - ensure appropriate level of security (A32)
systems and infrastructure but also other elements necessary to achieve the purpose (which data, how long, categories of recipients, categories of DS)
non-essential means - more practical aspects (e.g. use of SW)
