An introduction to the General Data Protection Regulation (GDPR)
Feedback form    |       Play Audio    |    Download content: /




Few introduction notes on GDPR

What is the GDPR?Click to read  

If you’re going to exploit IT services to launch and run your digital business, it is required from you – by law – to understand what the GDPR is about.

In the context of this model, we will share you with a couple of information you need to operate a digital business in Europe in compliance with GDPR.

What is the GDPR

A regulation of the EU Parliament and EU council on “the protection of natural persons with regards to the processing of personal data and the free movement of such data”

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504

 
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
Bear in mind…what is a regulation?Click to read  

According to EU Law, a regulation is a legal act from EU policy institutions to which all Member States should comply with (as in the case of GDPR). Not all types of EU legislations are as binding as regulations…

The higher the level, the more binding the legislative content

 
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
The GDPR in brief: scale and scopeClick to read  

1.[GDPR] lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
 
2.[GDPR] protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
Be cautiousClick to read  

GDPR whole focus of interest is upon EU citizens and their “right to be forgotten”.

• On one hand, GDPR represents a very robust and reliable systems of rights and “privileges” – if we look at it from the private citizen’s perspective.

 
• On the other, GDPR introduces a large set of obligations and duties, enforced by law, to which all organisations operating in EU should comply with – if we look at it from the business’ perspective.
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
PinpointsClick to read  

To better understand the regulation of general Data Protection – and how you can comply with it – we really need to give you first a couple of key guidelines and pillars that orientate the ratio of the regulation:

• Glossary of references and common terms used by the legislation

• Basic principles of Data Protection

• Privacy rights that fall under GDPR’s interests
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
The GDPR glossary article nº 4

Personal data Click to read  

Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Quoted from legislative text
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
ProcessingClick to read  

Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction*, erasure or destruction.
* The marking of stored personal data with the aim of limiting their processing in the future.

Quoted from legislative text

 
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
ProfilingClick to read  

Any information of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Quoted from legislative text
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
ControllerClick to read  

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor → A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Quoted from legislative text
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
ConsentClick to read  

Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Quoted from legislative text
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
Personal Data Breach Click to read  

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Quoted from legislative text
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
7 principles of Data Protection

7 principles of Data Protection article nº 5. Chapter 2Click to read  

Lawfulness, fairness and transparency of data processing

 

 don’t be shady

Purpose limitation

don’t gather more than what you need

Data minimisation  
Accuracy   don’t forget to update the data that you stored
Storage limitation   don’t store data for longer than necessary
Integrity and confidentiality   don’t forget to secure the data that you stored
Accountability   don’t forget to demonstrate compliance with all of the above

 
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
8 privacy rights

Citizens’ rights. Chapter 3Click to read  

Citizens’ rights 

1. Citizens have the right to be informed about the processing of their data form third parties
2. Citizens have the right to access their data
3. Citizens have the right to rectification of their data
4. Citizens have the right to be forgotten
5. Citizens have the right to restrict processing of their data
6. Citizens have the right to the portability of their data
7. Citizens have the right to object their data
8. Citizens have rights in relation to automated decision making and profiling
 
From Article no. 12 to 23 of legislative text.
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
The implication for organisations and businessesClick to read  

There are six cases (i.e. scenarios) in which organisations are allowed to process citizens’ data – upon full compliance with GDPR*:

*From Article no. 6  of legislative text

1. Unambiguous consent from the data’ subject
2. Conclusion of a contract – organisation’s right to a brief double-check of subject’s background
3. Full compliance with further legal obligations
4. To protect vital interests of data’ subject
5. To protect public interest
6. Whenever there is legitimate interest – upon non-conflict with fundamental rights and freedom of data’ subject.
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
Demonstrating compliance

TransparencyClick to read  

Transparency 

  •      Perform routine assessment and audit of “personal data” you process, and which other parties have access to them
  •      Disclose the ratio behind your processing – under which of the six scenarios you operate your processing?
  •      Operate in full alignment with Article no.12 – first citizens’ righ
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
SecurityClick to read  

Security 
 
  •      Embrace data protection at all stages of value generation process
  •      Make personal data as anonymous as possible
  •      Set up security mechanisms to prevent data breaches – who you’re sharing your PWs with?
  •      Validated data impact assessment – does your activity damages / threats personal data
  •      Test a notification system in case of data breach – recalling citizens’ right to be informed
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
AccountabilityClick to read  

Accountability
 
  •      If you have the opportunity, appoint a specialist that can take care of your compliance
     
  •      If any third party process data on your behalf, please considers signing a formal agreement
     
  •      Large organisation typically rely on the expertise of a Data Protection Officer, consider hiring one as soon as you enough resources…(€)
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section
Citizens Data Protection Rights’Click to read  

Citizens Data Protection’s rights

     Make sure to double check any time your full compliance with all of the citizens’ rights (go back to slide 16 for reference)

  •      Is it easy for data subjects to be informed about the processing?...
  •      Is it easy for data subject to access their data?...
  •      Is it easy for data subject to be forgotten?...
  •      Etc…
 

A final important disclaimer 

In the context of this training module, our objective is to guide readers through the very fundamentals of GDPR legislations – something that per se is very intricate and would require a whole separate context for in-depth considerations.

 

In the last couple slides, we provided for a very brief compliance checklist – this is not exhaustive by any mean! If you wish to know more about GDPR and what might be your duties / obligations, please consider getting in contact with consultants and professionals near you…
Back to course menuBack to index menu
Back to beginning of sectionBack to beginning of section



Test Yourself!



Description:

According to EU Law, a regulation is a legal act from EU policy institutions to which all Member States should comply with (as in the case of GDPR).

In its scale and scope:
1. [GDPR] lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
2. [GDPR] protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.

As such, GDPR whole focus of interest is upon EU citizens and their “right to be forgotten”.
• On one hand, GDPR represents a very robust and reliable systems of rights and “privileges” – if we look at it from the private citizen’s perspective.
• On the other, GDPR introduces a large set of obligations and duties, enforced by law, to which all organisations operating in EU should comply with – if we look at it from the business’ perspective.

To better understand the regulation of general Data Protection – and how you can comply with it – we will provide you a couple of key guidelines and pillars that orientate the ratio of the regulation:
• Glossary of references and common terms used by the legislation
• Basic principles of Data Protection
• Privacy rights that fall under GDPR’s interests

Keywords

Entrepreneurship, Digital Entrepreneurship, Digital Skills, GDPR, Security, Data, Privacy

Objectives:

If you’re going to exploit IT services to launch and run your digital business, it is required from you – by law – to understand what the GDPR is about.

In the context of this model, we will share you with a couple of information you need operate a digital business in Europe in compliance with GDPR.
Practical Tips

A final important disclaimer 

In the context of this training module, our objective is to guide readers through the very fundamentals of GDPR legislations – something that per se is very intricate and would require a whole separate context for in-depth considerations.

 

Throughout the last sections of this training module, we provided for a very brief compliance checklist – this is not exhaustive by any mean! If you wish to know more about GDPR and what might be your duties / obligations, please consider getting in contact with consultants and professionals near you…

Bibliography

 

GDPR legislative text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504


Partners

EQUAL Ireland Education and Related Services
IDP SAS DI GIANCARLO COSTANTINO
INSTITUT DE HAUTE FORMATION AUX POLITIQUES COMMUNAUTAIRES
IRISH RURAL LINK CO-OPERATIVE SOCIETY LIMITED
Husavik Academic Center