Editorial Director: Giusella Finocchiaro
Web Content Manager: Giulia Giapponesi

posted by Maria Chiara Meneghetti on giugno 1, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will be soon directly applicable on the entire European territory. Companies, public administrations and private citizens are in the final rush to comply with the dispositions of the new legislation.

What does “transfer of personal data” mean?

The GDPR does not give a precise definition of what “transfer” means. Reading the dispositions that regulate transfers of personal data (Arts. 44-50 of the GDPR), it can be inferred that by “transfer” the GDPR indicates a movement of personal data from a controller or processor of personal data inside the EU, to a controller or processor outside the EU.

The GDPR broadens the scope of application of the regulation. Firstly, it also includes those cases when personal data is transferred to an international organisation. Secondly, the GDPR requires the rules on transfer to be applied not only to “direct” data transfers from a European to a non-European country, but also to successive transfers, namely when the subject who the data have initially been transferred to, subsequently transfers them to other subjects.

What is the procedure a controller or a processor must follow when he/she wishes to transfer personal data?

The data controller or data processor may carry out a transfer of personal data, only when they fulfil one of the conditions provided for in articles 45-49 of the GDPR.

What “mechanisms” may be used?

The ”mechanisms” listed in articles 45-49, which controllers and processors may use to transfer personal data, partially cover the list of conditions already provided for by the Italian Privacy Code or produced by Working Party Art. 29. By way of example, a transfer will be legitimate in cases in which; the third country personal data are being transferred to has obtained an adequacy decision from the European Commission; it is conditional upon appropriate safeguards, such as the use of standard contractual clauses (SCCs) between sender and receiver, or, for intra-group transfers, the adoption of binding corporate rules (BCRs) by the group of enterprises; the sender fulfils one of the derogations set out in art. 49 of the GDPR (e.g. he/she has collected the data subject’s consent).

What changes with the GDPR?

On the one hand, the GDPR has made available new “instruments” for data transfers and on the other it lays out the different conditions according to a scale of importance: the adequacy decision becomes the pillar of the new system; controllers or processors will only have to adopt one of the other alternatives offered by the GDPR in its absence.

In the context of appropriate safeguards, binding corporate rules take on their own importance and are regulated in detail in art. 47 of the GDPR, which lists their minimum content. Art. 46, on the other hand, makes changes to the list of the legal grounds which can be used for a transfer, backing up SCCs and BCRs with: the adoption of a “legally binding and enforceable instrument between public authorities or bodies”; signing an approved code of conduct or subscribing to certification mechanism. Moreover, SCCs, which were formerly only valid when adopted by the European Commission, may henceforth also be adopted by a National Control Authority (provided they are then approved by the European Commission or submitted to the consistency mechanism referred to in art. 63 of the GDPR).

Finally, art. 49 specifies the other possible “derogations for specific situations”, which the sender can use in the absence of both an adequacy decision and an appropriate safeguard.

Are already adopted adequacy decisions still valid?

The GDPR specifies that the adequacy decisions adopted on the basis of directive 95/46/CE remain valid until they are modified, substituted or revoked by a European Commission decision, for example, following a periodic four year review required for all adequacy decisions. Therefore, all adequacy decisions adopted up to the present time remain valid for the moment.

Already adopted adequacy decisions may be consulted HERE.

What SCCs can currently be used?

With regard to standard contractual clauses, the European Commission has so far issued model clauses for data transfers from data controllers in the EU to data controllers established outside the EU and it has also issued one set of contractual clauses for data transfers from controllers in the EU to processors established outside the EU, which can be found HERE.

In addition, a model SCC for the transfer of data from a processor established in the EU to another processor established in a third country is currently under preparation.

 

 

 

posted by Maria Chiara Meneghetti on aprile 23, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will be soon directly applicable on the entire European territory. Companies, public administrations and private citizens are in the final rush to comply with the dispositions of the new legislation. In order to make it easier to understand a complex and articulated text such as the GDPR, we propose hereinafter a collection of simple factsheets, structured with a Q&A formula, that starting from known privacy concepts, give a first and brief guidance to the reading of the new legislation.

What are the rights of the data subject?

The data subject, namely the natural person whose personal data are processed, has a number of rights, which he/she can exercise with the data controller at any time and which allow him/her to keep control of the data provided and their use.

These rights, many of which were already provided for by the Italian privacy Code, are for instance: the right of access (which gives data subjects the right to obtain confirmation of whether the controller is processing their personal data), the right of rectification (on the basis of which data subjects are entitled to require a controller to rectify any errors in their personal data without undue delay); the right to object to processing (on the basis of which data subjects have the right to object to continued data processing under specific circumstances).

What changes with the GDPR?

The GDPR expands the list of rights by adding to it: the right to erasure (the right to be forgotten); the right to restriction of processing and the right to data portability.

From the data controller’s point of view, he/she remains responsible for facilitating data subjects’ exercise of their rights (by adopting all appropriate technical and organisational measures) and for answering their requests (with the possible collaboration of the data processor).

In particular, for all rights the GDPR sets the deadline for answering data subjects’ requests at one month, which can be extended up to 3 months, in consideration of the complexity and number of requests submitted. At any rate, the data controller must also give a written answer to the data subject in cases of denial within one month of the request. The answer, usually given in written form, must be concise, transparent and written in plain and clear language.

What is the right to erasure (the right to be forgotten)?

The right to be forgotten states that data subjects have the right to require data controllers to erase the personal data they hold.

However, the right to be forgotten cannot be exercised in every circumstance, but only when one of the specific conditions listed in art. 17 of the GDPR occurs. The conditions are those in which:

1) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

2) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing

3) he/she objects to the processing and there are no overriding legitimate grounds for the processing

4) the personal data have been unlawfully processed;

5) the personal data have to be erased for compliance with a legal obligation (in Union or Member State law to which the controller is subject);

6) the personal data have been collected in relation to the offer of information society services, when the data subject was still a child (therefore he/she was not fully aware of the risks deriving from the processing of his/her data).

In addition, with the obligation to comply with the data subject’s request for erasure, in one of the above mentioned situations, the data controller must fulfil another obligation. In digital environments, the circulation and spread of information have a significantly wider scope compared to their circulation in the physical world. For this reason the GDPR has provided that where the controller has made the personal data public (e.g. on a website), he/she shall (take reasonable steps to) inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

The only limits to the right to be forgotten are considered in cases where the right of the data subject to obtain the erasure of his/her personal data are overridden by higher interests. For instance to the extent that data processing is necessary for exercising the right of freedom of expression and information or for compliance with a legal obligation, or it is necessary for the performance of a task carried out in the public interest. The right to be forgotten may also be denied in cases where the storage of data is necessary for the establishment, exercise or defence of legal claims.

What is the right to restriction of processing?

The exercise by the data subject of this right, in fact allows him/her to “restrict” the processing of his/her data in some situations and provides him/her with an alternative to requiring data to be erased, namely, the data subject requests the temporary suspension of processing.

The right to obtain a restriction of processing can be exercised when:

1) the data subject disputes the accuracy of his/her personal data and so requests restriction of their utilisation for a period in which the data controller will be able to verify their accuracy;

2) the processing is unlawful, but the data subject objects to erasure of the personal data and requests restriction of their use instead;

3) the controller no longer has need for the personal data for the purposes of processing, but the data subject requires them to establish, exercise or defend legal claims;

4) the data subject has objected to processing and the restriction of processing is implemented pending verification of whether the legitimate grounds of the controller override those of the data subject.

What is the right to data portability?

The right to data portability is a right with a double content. Firstly, it consists in the right of the data subject to receive the data in a structured, commonly used and machine-readable form. There is no express indication of the type of format to be used, but it is evident that the objective is that of assuring that the data are provided in an “interoperable” format, which allows easy re-use across a variety of devices and services.

In addition, the right to data portability represents the right to transmit (but also to obtain the direct transmission of) those data to another data controller (“when technically feasible”), without the “original” controller being able to hinder this. In other words data controllers must provide the conditions for data subjects to be able to easily and without hindrance transfer their personal data from one IT system to another.

The right to data portability cannot be exercised unconditionally either, but only when the personal data fulfil a number of conditions. In particular they must be:

1) personal data provided to a controller clearly referring to the data subject (obviously anonymous data are excluded);

2) processed based on the data subject’s previous consent or for the performance of a contract, to which the data subject is party;

3) processed by automated means;

4) provided to a controller by the data subject. This condition needs to be interpreted broadly, so that the right is not limited to the data knowingly and actively provided by the data subject (e.g. data collected from a subscription form), but also covers data provided by the use of a service or device (e.g. location data, traffic data or the data subject’s search history).

It is vital to point out that, in contrast, the right to data portability cannot be exercised on so-called derived or inferred data, namely the product of analysis carried out by the data controller based on the data provided by the data subject. These are data “created” by the data controller, which he/she keeps (e.g. the outcome of a data subject’s health assessment or a profile created in the context of risk management (e.g. to assign a credit score) or of complying with anti-money laundering (or other financial crime) legislation.

 

 

posted by Maria Chiara Meneghetti on aprile 15, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will be soon directly applicable on the entire European territory. Companies, public administrations and private citizens are in the final rush to comply with the dispositions of the new legislation.

In order to make it easier to understand a complex and articulated text such as the GDPR, we propose hereinafter a collection of simple factsheets, structured with a Q&A formula, that starting from known privacy concepts, give a first and brief guidance to the reading of the new legislation.

What does “personal data breach” mean?

The GDPR defines personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. There are many types of personal data breaches, which may include theft or accidental erasure of data from a database, as well as malware attacks which block access to IT systems or blackouts which make data temporarily unavailable.

In brief, we can say that a personal data breach is a specific type of security incident in cases when personal data are involved. While all personal data breaches are security incidents, not all security incidents can necessarily be described as data breaches.

What action must the controller take in cases of personal data breach?

Articles 33 and 34 of the GDPR regulate the procedures the controller must activate in cases of personal data breach, which are to notify the supervisory authority of the breach (in Italy the Garante per la protezione dei dati personali) and to communicate the breach to the data subject.

Both procedures aim at informing the authority or the data subject that a breach has occurred in order to allow them to take all necessary protection measures.

What action must the processor take in cases of personal data breach?

Although obligations of notification and communication must be fulfilled by the data controller, art. 33 establishes that, once aware of the breach the data processor must inform the data controller without undue delay.

After a violation has taken place and in order for any intervention to be carried out as effectively and promptly as possible, also when taking into consideration the dimension of the contexts in which the data is being processed and the number of people who may be involved, it would be useful for the data controller to arrange an incident response plan. This plan should set out the different steps and organisational procedures which need to be adopted to deal with possible violations and the structure or response team to whom the event will be referred.

When must notification to the supervisory authority be carried out?

Art. 33 of the GDPR provides that the data controller must notify a personal data breach without undue delay to the supervisory authority and where feasible within 72 hours. When notification is not made within 72 hours it must be accompanied by the reason for the delay.

It is not necessary to send notification when the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Therefore, the data controller is responsible for analysing the potential risks caused to data subjects by data breaches and for assessing whether the risks are sufficiently high as to warrant triggering the obligation to notify the supervisory authority. It should be noted that the presence of a “simple” risk is enough to oblige the data controller to notify the authority.

When must communication be given to the data subject?

Art. 34 of the GDPR provides that when the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall communicate the personal data breach to the data subject without undue delay.

Differently from notification given to the supervisory authority, communication to the data subject must only be given when the breach presents “high risk”. In any case, it is the duty of the data controller to evaluate the level of risk.

The article continues by listing the following circumstances under which, despite the potential high risks, communication to the data subject is not required if: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach (e.g. encryption); 
(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise; 
(c) it would involve disproportionate effort (in such a case, there shall instead be a public communication or similar measure (whereby the data subjects are informed in an equally effective manner).

In what form should the communication be made?

To comply with the obligation of communication provided for by the GDPR it is not sufficient only to inform the data subject. Essentially, the appropriateness of a communication depends not only on its contents, but also on the manner in which it is formulated. In order to fulfil their informative function, communications must be written in plain and easily understandable language. Direct communications to the data subjects are preferable (e.g. e-mail, SMS or direct messages). The information should be communicated in a clear and transparent manner, thus avoiding conveying the message in excessively general and misleading formats (such as generic updates or newsletters).

How should the assessment of the risk resulting from a data breach be carried out?

The assessment of the risks resulting from a data breach is a fundamental step because it allows the data controller not only to identify adequate measures to contain or eliminate the breach, but also to weigh up the necessity to activate the notification and communication procedures (which are triggered only above certain risk thresholds).

The assessment is similar to that which the data controller needs to carry out in relation to the Data Protection Impact Assessment, but unlike the latter it must be more personalised, with regard to the concrete circumstances of the breach.

Among the factors the data controller needs to take into consideration in his/her assessment, can be mentioned: the type of breach (confidentiality, accessibility or integrity breach?) the nature of the data involved (e.g. health data, ID documents or credit card numbers); how easy it would be to identify the data subjects (this varies according to the type of data, identification or non-identification data, and the methods used for their storage, e.g. pseudonymisation techniques or cryptography); the seriousness of the consequences on individuals (this differs depending on whether the data were mistakenly sent to a trusted party or were stolen by an unknown third party); any particular characteristics and the number of individuals involved (e.g. whether vulnerable data subjects such as children or elderly people, for example, are involved; whether it was a collective or individual breach) and the particular characteristics of the data controller (e.g. based on the activity processing environment).

 

 

 

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which start from already well-known privacy concepts and give a brief guide to the new legislation.

What is meant by consent to the processing of personal data?

According to the new definition in the GDPR, consent of the data subject means “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (art. 4, par. 1, n. 11). Analysis of the definition shows that consent represents an indication of will, expressed in affirmative and unambiguous terms. Therefore, it can only be a statement or a positive action on the part of the data subject and not, conversely, merely passive conduct, such as hypothetical silent consent, for example. Moreover, in the same way as the Italian privacy Code, the GDPR requires consent not only to be unambiguous but also: free (given in the absence of constrictions); specific (one for each processing purpose) and informed (the data subject must receive an appropriate privacy notice on the processing of his/her personal data).

Who must ask for consent for the processing of personal data?

The data controller or, if specifically instructed, the data processor must have the consent of the data subject when they want to process his/her data. The GDPR places the actual burden of proof on the data controller. Art. 7, par. 1 specifies that the data controller shall be able to demonstrate that the data subject has consented to the processing of his/her personal data.

When is consent for personal data necessary?

Consent by the data subject is one of the many legal bases provided by the GDPR alternately, to legitimise the processing of personal data carried out by the controller. This means that consent must be obtained whenever one of the alternative legal bases listed in art. 6 of the GDPR cannot be used. These are essentially “equivalent circumstances” to consent, in the presence of which personal data may be processed even without consent from the data subject.

What are the equivalent circumstances to consent by the data subject?

In addition to consent, art. 6 of the GDPR lists five different legal bases which mainly take up the alternatives already provided for by the Italian privacy Code. Processing will be lawful even in the absence of consent if: a) it is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract; b) it is necessary for compliance with a legal obligation to which the controller is subject; c) it is necessary in order to protect the vital interests of the data subject or of another natural person; d) it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

In the last case, it will be the duty and responsibility of the controller to balance his/her legitimate interest with the rights of data subjects and justify that his/her interest overrides the interests of the various data subjects.

What might the legitimate interests of the controller be?

Recitals 47, 48 and 49 of the GDPR list examples of activities that might be considered the legitimate interests of a data controller and which override those of data subjects.

Among these is fraud prevention and direct marketing (which occurs when the controller uses the contact data the data subject has given him/her in the context of the sale of a product or a service without asking for the data subject’s consent and provided that the data subject, adequately informed, had not refused it). The processing of data for internal administrative purposes or in order to assure the security of networks and information may also be considered to be covered by legitimate interest.

Are there particular conditions for the processing of “sensitive” data (so called special categories of data)?

For the processing of special categories of data (sensitive data), the general rule is that of explicit consent (explicit consent is also applied when the data controller wants to adopt automatic decision-making processes, including profiling, which have legal consequences for data subjects).

In this case, the GDPR also provides a series of “equivalent circumstances” which waive the need to collect consent (art. 9). Some of these are particularly innovative, among which when processing is necessary for: the purposes of complying with obligations of labour law, social security and social care; the purposes of preventive or occupational medicine; for reasons of public interest in the field of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

What is new with regard to child’s consent?

The GDPR inserts an ad hoc provision for child’s consent, which however only refers to the offer of information society services.

Considering the wide variety of content and digital services to which children have access thanks to the use of the Internet, the GDPR wishes to strengthen the protection of children from the dangers of the Internet. Therefore, Art. 8 specifies that consent given by a child for the processing of his/her personal data in the context of a service offered by an information society, is only lawful when the child is at least 16 years old (Member States may provide by law for a lower age provided that it is not below13 years).

Where the child is below the age of 16, processing will be lawful only if and to the extent that consent is given or authorised by the parents or holder of parental responsibility over the child.

What are the conditions for the collection of consent?

In light of the definition of consent (a free, specific, informed and unambiguous indication of will), the GDPR specifies the conditions controllers must fulfill in order to guarantee the collection of legitimate consent.

Consent can be given with a written or an oral statement.

When consent is given in writing, in the context of a declaration which also includes other matters, consent to data processing must be presented in a manner which is clearly distinguishable from the other matters.

The formulation of consent must be in an intelligible and easily accessible form, using clear and plain language.

Moreover, the data controller must take into consideration that consent given by the data subject can be withdrawn at any time as easily as it was given.

How to create a GDPR compliant consent form?

To briefly summarise: in order to create a GDPR compliant consent form:

1) this must be a clear and unambiguous act: it can be collected in writing including by electronic means, or with an oral statement;

1.1) this implies that consent is not constituted by: silence, inactivity or pre-ticked boxes.

1.2) on the contrary, consent can be obtained through: specific boxes to tick (not pre-ticked) when visiting an Internet website; choosing technical settings for information society services or another statement or conduct which clearly indicates the data subject’s acceptance of the proposed processing of his/her personal data.

2) must be formulated in clear, plain and intelligible language;

3) there must be separate consents for each processing purpose (marketing and profiling are distinct purposes);

4) when a child is involved: the age of the child must be verified or parental consent must be asked for;

5) for special categories of personal data, consent must be explicit;

6) data controllers must take appropriate measures to demonstrate that the data subject has consented to processing of his/her personal data and also to inform the data subject of his/her right to withdraw his/her consent at any time and that it is as easy to withdraw as to give consent.

 

 

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which starting from already well-known privacy concepts, give a brief first guide to the new regulation.

What is a privacy notice?
A factsheet known as a privacy notice refers to that set of information which must be provided to data subjects (namely natural persons whose data are processed) to allow them to understand who is collecting their personal data, what will be done with them, how, by whom and who they will be shared with.

Who is responsible for providing the privacy notice?
The privacy notice must be provided by the data controller or the data processor, when specifically instructed to do so by the data controller.

What are the contents of a privacy notice?
The GDPR provides a thorough description of the contents of the privacy notice in art. 13, par. 1 and art. 14, par. 1.

Some of these contents were already provided for in the Italian Privacy Code, among which are for example the indication of: a) contact data of the data controller and of any data processor when used; b) the purposes of processing (e.g. entering into contracts, marketing, profiling, etc.); c) whether the provision of personal data is mandatory or not and the consequences (should such mandatory data not be provided); d) the rights of data subjects.

Besides this information, the GDPR provides further relevant information in the privacy notice which the controller is required to provide to data subjects in order to proceed with processing their data, such as: a) contact data for the Data Protection Officer when appointed; b) the legal basis for the processing (e.g. consent, public interest, performance of contracts and so on) and in cases where this constitutes legitimate interest for the controller, specify its contents; c) whether the data will be transferred to countries outside the EU and which instrument the transfer will be carried out with (e.g. adequacy decision; BCR, standard contractual clauses); d) the period of time for which the data will be stored or the criteria used to determine it; e) the existence of automated decision-making (including profiling) and the logic it is based on.

When must the privacy notice be given?
The privacy notice must be provided to data subjects at the moment in which their data are collected, therefore before the start of any kind of processing. The GDPR only exempts data controllers from the obligation of providing privacy notices in cases in which data subjects already have all the information at their disposal (art. 13, par. 4).

Conversely, however, in cases where the data have not been obtained from the data subject, data controllers must provide data subjects with the above listed information (in addition specifying the source of the data) within a month of collecting them or at any rate from the moment of their communication (to a third party or to the data subjects themselves).The GDPR also provides for certain circumstances for exemption in this situation (art. 14, par. 5) which refer to those cases in which: a) data subjects are already in possession of all relevant information; b) the provision of such information would prove impossible or would involve excessive effort; c) the collection or disclosure is laid down by law; d) the data must remain confidential subject to an obligation of professional secrecy. It is the duty and therefore, the responsibility of the data controller to assess whether there is one of the above-listed circumstances.
In addition data subjects must be provided with a new privacy notice should the data controller decide to process the collected data for different purposes from those originally communicated.

How must the privacy notice be provided?
In this case too the GDPR gives a clearer definition of the procedure for formulating and providing the privacy notice.
The privacy notice is generally provided in writing or by other means, which can also be electronic (where appropriate). Only in cases when the data subject requires it, may the privacy notice be provided orally.
With regard to its formulation, the GDPR specifies that the privacy notice must be: concise, transparent, intelligible and easily accessible. Essentially, it must be formulated in clear and plain language, in particular when the information is specifically addressed to a child (art. 12, par. 1).
In addition, with the precise aim of guaranteeing the highest level of transparency and to make it easily legible, the GDPR clearly explains that the information may be provided in combination with standardised icons to give an intuitive and easily understandable overview of the processing procedure.

  • Recent comments

  • Popular posts

    • None found