GDPRsimple

Processing by a processor must be governed by an agreement that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of individuals and obligations and rights of the controller.  That agreement must provide, in particular, that the processor:

• Processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country;
• Ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• Implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as varying likelihood and severity for the rights and freedoms of individuals;
• Does not engage a sub-processor without prior specific or general written authorization of the controller, and in the case of a general written authorization does not add or replace a sub-processor without informing the controller so the controller has the opportunity to object to the addition or replacement;  
• Applies the same data protection obligations as set out in the agreement between the controller and the processor to the relationship between the processor and the sub-processor with respect to processing on behalf of the controller;
• Remains fully liable to the controller for the performance of the sub-processor’s obligations;
• Taking into account the nature of the processing, assists the controller by appropriate technical and organizational measures, insofar as possible, for the fulfilment of the controller’s obligation to respond to requests for exercising individual rights;
• Taking into account the nature of the processing and the information available to the processor, assists the controller in ensuring compliance with the obligations to:
  • Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk;
  • In the case of a personal data breach, notify the supervisory authority not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals;
  • Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, communicate the personal data breach to the individuals without undue delay;
  • Where a type of processing uses new technologies and taking into account the nature, scope, context and purposes of the processing is likely to result in high risk to the rights and freedoms of individuals, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (DPIA); and
  • Consult the supervisory authority prior to processing where a DPIA indicates that the processing would result in a high risk in the absence of measures taken to mitigate the risk.
• At the choice of the controller, delete or return all personal data to the controller after the end of providing services relating to processing; and
• Make available to the controller all information necessary to demonstrate compliance with the foregoing obligations and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. 

If the processor engages a sub-processor with respect to processing on behalf of the controller, the exact same provisions in the agreement between the controller and the processor must be in the agreement between the processor and the sub-processor.

This blog is the 24^th in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool can help SMEs implement the GDPR and demonstrate their implementation.  Each of the bite size pieces is part of one of the eight topics in GDPRsimple.

Next blog:  What is a data breach under the GDPR and what do you do when one happens?

Whenever you as a controller use a processor to process personal data for you, you need to make sure that the processor will provide appropriate technical and organizational security measures that protect the rights of individuals.  In order to do that, you must have a written agreement between you and the processor.

If you are a processor who processes personal data for a controller or if you process personal data for a processor (i.e. a sub-processor), then you must have a written agreement between you and the controller or between you and the sub-processor.  An agreement between a processor and a sub-processor must contain the same data protection provisions as the agreement between the controller and the processor.   If the sub-processor fails to fulfill its obligations under the agreement with the processor, the processor remains fully liable to the controller for the performance of the sub-processor’s obligations.

A processor cannot engage or replace a sub-processor without the authorization of the contractor.  If a processor determines the purposes and means of processing of personal data, then it is no longer a processor and is considered a controller with respect to that processing

This blog is the 23^rd in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool can help SMEs implement the GDPR and demonstrate their implementation.  Each of the bite size pieces part of one of the eight topics in GDPRsimple.

Next blog:  What needs to be in the agreement between the controller and the processor? 

As was discussed in an earlier blog, there is a distinction between a controller and a processor. 

• A controller determines the purposes and means of processing of personal data.  The controller, taking into account the nature, scope, context, and purpose of the processing and the risks of varying likelihood and severity for the rights and freedoms of individuals, must implement appropriate technical and organizational measures.
• A processor processes personal data on behalf of the controller. 

Under the GDPR, it is important to know whether you use a processor to process personal data or whether you are a processor who processes personal data.  The reason is that the GDPR requires the controller to obtain from the processor certain promises before the controller can use a processor.  Likewise, if you are a processor, the GDPR requires you to make certain promises to the controller before you can act as a processor and requires you to obtain from sub-processors certain promises before you can use them as sub-processors.  

Until it has obtained the prior specific or general written authorization of the controller, the processor cannot engage a sub-processor.  Where the prior written authorization is general, the processor must inform the controller of any intent to add or replace a sub-processor.  This notice is so the controller has the opportunity to object to any change in sub-processors. 

If a processor determines the purposes and means of processing of personal data, then the processor will be considered to be a controller with respect to the processing.

Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers.  Joint controllers must set forth their respective roles and responsibilities with respect to individuals, but individuals may exercise their rights against each of the joint controllers.

The processor, and any person acting as an agent of the controller or the processor, who has access to personal data, cannot process that personal data unless instructed to do so by the controller or unless required to do so by law.

This blog is the 22nd in a series of blogs that explains, in bit size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.  Each of the bite size pieces is part of one the topics in GDPRsimple.

Next blog:  What kind of agreements do you need if you are a processor or use a subprocessor?

Contract is the third most common legal basis for organizations to process personal data.  In order to determine whether a controller can use contract as the legal ground for processing personal data, ask whether the processing is:

• Necessary
• For the performance of a contract to which the individual is a party 
• In order to take steps at the request of the individual prior to entering into a contract

Performance of a contract to which the individual is a party must be interpreted strictly and does not cover situations where the processing is not genuinely necessary for the performance of a contract.  It is important to determine the exact rationale of the contract, i.e., its substance and fundamental objective.   This legal ground only applies to “performance” of a contract and does not apply to all actions taken in the execution of a contract.  The fact that some data processing is covered by a contract does not mean that the processing is “necessary” for its performance.  Common examples of processing for the performance of a contract are processing an individual’s address so that goods bought online can be delivered or processing credit card details in order to pay for goods bought online.

Processing that takes place “prior” to entering into a contract covers precontractual actions provided that the steps are taken at the request of the individual and are not initiated by the controller or a third party.  Common examples of processing prior to entering into a contract are individuals requesting retailers to send them offers for products and the retailers keeping the address details and information on the offers requested for a limited time period or an individual requesting a quote for car insurance and the insurer using the make and age of the car in order to prepare the quote.  On the other hand, direct marketing at the initiative of the retailer is not an example of processing at the request of the individual.

This blog concludes the three most common legal grounds for processing personal data – consent, legitimate interest and contract.  The next blog will start a discussion of the rights individuals have under the GDPR, beginning with the different types of privacy notices there are.

This blog is the 21st in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, can help SMEs implement the GDPR and demonstrate their implementation.

Next blog:  Do you use a processor to process or are you a processor who processes personal data?

In order for a controller to use legitimate interest as the legal ground for processing personal data, the controller will need to conduct a legitimate interest assessment (LIA).  A LIA consists of at least five parts:

• The purpose for the processing of the personal data 
• The necessity of the processing  
• If the processing is necessary, whether the impact on individuals overrides the organization’s legitimate interests
• If the impact on individuals overrides the organization’s legitimate interest, whether safeguards sufficiently minimize the impact on individuals
• If safeguards do not sufficiently minimize the impact on individuals and security risks exist, whether technical and organizational security measures sufficiently minimize the impact on individuals

The purpose of the processing is where you identify your legitimate interest.  You (or a third party) must have a clear and specific benefit or outcome in mind.  A vague or generic business interest is not sufficient.  The recitals to the GDPR recognize preventing fraud, ensuring network and information security, or indicating possible criminal acts or threats to public security as a legitimate interest and indicate that processing employee or client data, direct marketing or administrative transfers within a group of companies may be a legitimate interest.  These are not the only situations that are or might be a legitimate interest, but they are good examples.

The processing must be necessary for the purposes of the identified legitimate interest.  The processing doesn’t have to be essential, but it does have to be a proportionate way of achieving the purpose.  You need to consider whether there is a less intrusive way to achieve the purpose, and if there is a less invasive way, then the more invasive way is not necessary.

The last three parts make up the balancing test.  You need to consider the interests and fundamental rights and freedoms of the individual and whether they override your identified legitimate interest.  If the impact on individuals overrides your legitimate interest, consider whether there are any safeguards that can be put into place to reduce or mitigate this risk.  If safeguards do not sufficiently mitigate the impact on individuals and security risks exist, then consider whether technical and organizational security measures can be put into place to reduce or mitigate these risks. 

If your LIA concludes that the impact on individuals overrides your legitimate interest, then you are not able to process personal data for the identified particular purpose using legitimate interest as the legal ground for processing.  However, you may use another legal ground for processing if it applies. 

This blog is the 20^th in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, can help SMEs implement the GDPR and demonstrate their implementation. 

Next blog:  What does it mean to use contract as a legal ground for processing personal data?

Legitimate Interests is one of the more common legal grounds for a controller to process personal data.  Legitimate interest is different from consent; it is not processing that the individual has specifically agreed to; it is not processing linked to a specific purpose (like the one specified in a contract with the individual (contract as a legal ground to process will be discussed in a future blog); it is flexible and could theoretically apply to any type of processing.  Since consent is more restrictive under the GDPR, some think of legitimate interest as the catch all basis for processing personal data.  This view is incorrect.

In order to decide whether legitimate interest can be used as a legal ground to process personal data, you must conduct a balancing test to determine whether:  

• The impact on individuals overrides the organization’s legitimate interests
• If the impact on individuals overrides the organization’s legitimate interests, safeguards sufficiently minimize the impact on individuals
• If safeguards do not sufficiently minimize the impact on individuals and security risks exist, security measures sufficiently minimize the impact on individuals.

If safeguards and security measures do not sufficiently minimize the impact on individuals, then legitimate interest cannot be used as the legal ground to process.  In order for processing of personal data to proceed, another legal basis for processing must exist.

It is not only the organization’s legitimate interests.  It could also be the legitimate interests of any third party.  The “third party” could be third party organizations or third party individuals.  Also, the legitimate interests of the public in general may play a part when deciding whether the legitimate interests in the processing override the individual’s interests and rights.  If the processing has a wider public interest for society at large, then this may add weight to your interests when balancing those against those of the individual.

If you think you want to use legitimate interest as the legal ground to process personal data, then you will have to do a legitimate interest assessment.  You must perform the legitimate interest assessment before you start processing the personal data.  How to conduct a legitimate interest assessment will be discussed in the next Blog.

This blog is the 19^th in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, can help SMEs implement the GDPR and demonstrate their implementation. 

Next blog:  How to conduct a legitimate interest assessment

Consent is one of the most common legal grounds for a controller to process personal data.  Consent of the individual means any:

• Freely given (i.e. real choice and control).  An example is when individuals have to agree to get access to a website; then they do not have choice and control and consent is not freely given.  Employers and other organizations in positions of power over individuals should avoid relying on consent as it is unlikely that it is freely given.
• Specific (i.e. the description of the reason for the purpose of the processing must be granular and must be separate from information about other matters).  An example is when a website seeks to market to an individual by mail and by phone, the individual must be able to consent separately to mail and to phone.
• Informed (i.e. the individual must know the controller’s identity, the purpose of  each processing operation for which the controller is seeking consent, the type of data that will be collected and used, the existence of the right to withdraw consent, if relevant the existence of the right not to be subject to automated decision-making, including profiling, and the possible risks of transferring personal data outside the EU).
• Unambiguous indication of the individual’s agreement to the processing of personal data (i.e. there must be a clear affirmative and deliberate action).  An example is when an individual checks a checkbox.

All of these requirements must be met.  Furthermore, individuals must be able to withdraw their consent, and it must be easy for them to do so.

The subject of the next blog is one of the other common legal grounds for a controller to process personal data:  legitimate interests.

This blog is the 18th in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, can help SMEs implement the GDPR and demonstrate their implementation. 

Next blog:  What does it mean for an organization to have a legitimate interest to process personal data?

Under the GDPR, a business that determines how personal data are processed can only begin activities that involve the processing of personal data if at least one of the following legal grounds apply:

• The individual has given consent to the processing of his or her personal data for one or more specific purposes (an example is when an individual agrees to receive marketing emails from you);
• Processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract (an example is when individuals buy items on line, they need to use the individuals’ addresses in order to deliver the items) ;
• Processing is necessary for compliance with a legal obligation to which the business is subject (an example is when you need to use an individual’s personal data to pay employment taxes);
• Processing is necessary in order to protect the vital interests of the individual or of someone else (an example is when the emergency room of a hospital accesses the medical records of an unconscious individual);
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the business (an example is when the business processes payments from individuals for a governmental agency, it will have access to individuals’ personal data);
• Processing is necessary for the purposes of the legitimate interests pursued by the business or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual which require protection of personal data, in particular where the individual is a child (an example is when a business decides to provide workers compensation insurance to its employees; it is in the interests of both the individuals and the business for this benefit to be provided and the risk of using personal data to do so is very low)  .

There is no significance to the order of these legal grounds; one ground is not preferable to another one.  However, consent, contract and legitimate interests are the most common legal grounds used, and they will be explained in the next several blogs. 

All the legal grounds except consent are subject to the requirement that the processing be “necessary” for a particular purpose or in order to do a particular thing.  “Necessary” means the processing of personal data must be essential for the purpose pursued by the business.  Is there another way of achieving the objective?  If there isn’t another way or if there is another way but it would require disproportionate effort, then processing is necessary.  If there are multiple ways of achieving the objective, then the least intrusive means of processing the personal data is necessary.

This blog is the 17th in a series of blogs that describe and explain the GDPR.  If you don’t want to wait until the next blog to learn more about the GDPR, take a look at GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.

Next blog:  How to get consent from individuals to process their data?

After a Summer break, I’m back continuing our bite sized break down of the GDPR.  Why?    I often hear “I don’t know where to start” as a reason why small or medium sized enterprises (SMEs) haven’t put the GDPR into practice yet.  Like so many things in life, if it can be broken down into bite size pieces, then it’s not so overwhelming.  Another platitude that might be helpful in this situation is “start at the beginning.”

If you are a business that processes personal data, you need to have a legal basis to process personal data.  So, the first bite sized piece, or the first topic to start with, is whether you have a legal basis to process personal data.  What is a legal basis to process will be discussed is my next blog.  The GDPR can be broken down into seven other bite sized pieces or topics:

• As mentioned in my previous blogs, the GDPR expands individual rights and creates new individual rights.  It is important for SMEs to understand what these rights are and how to respond if an individual exercises one of them.
• If you use a third-party to process personal data for you or you are the third-party that is processing personal data, the GDPR specifies what requirements need to be in the contract with the third-party.
• The GDPR requires a personal data breach likely to result in risk to the rights and freedoms of individuals to be reported to the appropriate supervisory authority within 72 hours and to the individual without undue delay.
• In order to determine what technical and organizational security measures to have in place, you need to assess the risks presented by the processing, especially from the perspective of a data breach.
• If you engage in processing that is likely to result in high risk to rights and freedoms of individuals (high risk processing), then you must prior to the processing assess the impact of the high risk processing.
• If you employ less than 250 persons, then you do not need to maintain a record of processing unless the processing:
  • Is high risk processing or
  • Is not occasional or
  • Includes special categories of data (e.g. racial or ethnic origin, political opinion, religious beliefs, health data)
• If you transfer personal data outside the EU to non-EU countries, then the transfer must be subject to appropriate safeguards (e.g. Standard Data Protection Clauses).

I’ve already explained individual rights.  I am going to explain in more detail what the rest of these topics means in subsequent blogs. 

This blog is the 16^th in a series of blogs that explains, in bite size pieces, what needs to be done to put the GDPR into practice and how GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, can help SMEs implement the GDPR and demonstrate their implementation. 

Each of the “bite sized pieces” is one of the eight topics in GDPRsimple.

Next blog:  What is a “legal basis to process personal data”?

There are some procedural and some substantive commonalities between the rights to access, rectification, erasure, restriction, portability and object. 

Let’s discuss the similarities among all six rights first:

• The controller must ascertain the identity of the individual making the request.  If the controller does not have the information to determine the identity of the individual making the request, then the controller must inform the individual, and the individual must provide the information.  If the individual does not provide the information, then the controller is not required to process the request. 
• The controller must provide information on the action taken on a request to the individual within one month of receipt of the request.  That period of time may be extended by two months where necessary if the request is complex or numerous.  Within one month of receipt of the request, the individual must be informed of any extension and the reasons for the extension. 
• Where the individual makes the request electronically, the information must be provided electronically, unless the individual requests otherwise.
• If the controller does not take action on the individual’s request, the controller must notify the individual within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with the supervisory authority and of seeking a judicial remedy.
• All actions in response to these requests must be provided free of charge.  A reasonable fee may be charged where requests from an individual are manifestly unfounded or excessive.

Similarities among the rights to rectification, erasure and restriction are:

• Where the controller has disclosed personal data to recipients, the controller must communicate any rectification or erasure of personal data or restriction of personal data to these recipients. This communication does not have to take place if it proves impossible or involves disproportionate effort. 
• If the individual requests whether his or her personal data has been disclosed to such recipients, the controller must inform the individual about these recipients.

Similarities among the rights of access and to portability:

• The right to obtain a copy of personal data undergoing processing does not apply if it adversely affects the rights and freedoms of others.
• The right to receive personal data concerning the individual which the individual provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller do not apply if they adversely affect the rights and freedoms of others.

This blog is the fourteenth in a series of blogs that describes and explains the eight individual rights set forth in the GDPR.  If you don’t want to wait until the next blog to learn more about the GDPR and the individual rights in the GDPR, take a look at GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.

Next blog:  Has any guidance been issued on the individual rights?