Editorial Director: Giusella Finocchiaro
Web Content Manager: Giulia Giapponesi

posted by Maria Chiara Meneghetti on aprile 15, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will be soon directly applicable on the entire European territory. Companies, public administrations and private citizens are in the final rush to comply with the dispositions of the new legislation.

In order to make it easier to understand a complex and articulated text such as the GDPR, we propose hereinafter a collection of simple factsheets, structured with a Q&A formula, that starting from known privacy concepts, give a first and brief guidance to the reading of the new legislation.

What does “personal data breach” mean?

The GDPR defines personal data breach as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”. There are many types of personal data breaches, which may include theft or accidental erasure of data from a database, as well as malware attacks which block access to IT systems or blackouts which make data temporarily unavailable.

In brief, we can say that a personal data breach is a specific type of security incident in cases when personal data are involved. While all personal data breaches are security incidents, not all security incidents can necessarily be described as data breaches.

What action must the controller take in cases of personal data breach?

Articles 33 and 34 of the GDPR regulate the procedures the controller must activate in cases of personal data breach, which are to notify the supervisory authority of the breach (in Italy the Garante per la protezione dei dati personali) and to communicate the breach to the data subject.

Both procedures aim at informing the authority or the data subject that a breach has occurred in order to allow them to take all necessary protection measures.

What action must the processor take in cases of personal data breach?

Although obligations of notification and communication must be fulfilled by the data controller, art. 33 establishes that, once aware of the breach the data processor must inform the data controller without undue delay.

After a violation has taken place and in order for any intervention to be carried out as effectively and promptly as possible, also when taking into consideration the dimension of the contexts in which the data is being processed and the number of people who may be involved, it would be useful for the data controller to arrange an incident response plan. This plan should set out the different steps and organisational procedures which need to be adopted to deal with possible violations and the structure or response team to whom the event will be referred.

When must notification to the supervisory authority be carried out?

Art. 33 of the GDPR provides that the data controller must notify a personal data breach without undue delay to the supervisory authority and where feasible within 72 hours. When notification is not made within 72 hours it must be accompanied by the reason for the delay.

It is not necessary to send notification when the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Therefore, the data controller is responsible for analysing the potential risks caused to data subjects by data breaches and for assessing whether the risks are sufficiently high as to warrant triggering the obligation to notify the supervisory authority. It should be noted that the presence of a “simple” risk is enough to oblige the data controller to notify the authority.

When must communication be given to the data subject?

Art. 34 of the GDPR provides that when the data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller shall communicate the personal data breach to the data subject without undue delay.

Differently from notification given to the supervisory authority, communication to the data subject must only be given when the breach presents “high risk”. In any case, it is the duty of the data controller to evaluate the level of risk.

The article continues by listing the following circumstances under which, despite the potential high risks, communication to the data subject is not required if: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach (e.g. encryption); 
(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise; 
(c) it would involve disproportionate effort (in such a case, there shall instead be a public communication or similar measure (whereby the data subjects are informed in an equally effective manner).

In what form should the communication be made?

To comply with the obligation of communication provided for by the GDPR it is not sufficient only to inform the data subject. Essentially, the appropriateness of a communication depends not only on its contents, but also on the manner in which it is formulated. In order to fulfil their informative function, communications must be written in plain and easily understandable language. Direct communications to the data subjects are preferable (e.g. e-mail, SMS or direct messages). The information should be communicated in a clear and transparent manner, thus avoiding conveying the message in excessively general and misleading formats (such as generic updates or newsletters).

How should the assessment of the risk resulting from a data breach be carried out?

The assessment of the risks resulting from a data breach is a fundamental step because it allows the data controller not only to identify adequate measures to contain or eliminate the breach, but also to weigh up the necessity to activate the notification and communication procedures (which are triggered only above certain risk thresholds).

The assessment is similar to that which the data controller needs to carry out in relation to the Data Protection Impact Assessment, but unlike the latter it must be more personalised, with regard to the concrete circumstances of the breach.

Among the factors the data controller needs to take into consideration in his/her assessment, can be mentioned: the type of breach (confidentiality, accessibility or integrity breach?) the nature of the data involved (e.g. health data, ID documents or credit card numbers); how easy it would be to identify the data subjects (this varies according to the type of data, identification or non-identification data, and the methods used for their storage, e.g. pseudonymisation techniques or cryptography); the seriousness of the consequences on individuals (this differs depending on whether the data were mistakenly sent to a trusted party or were stolen by an unknown third party); any particular characteristics and the number of individuals involved (e.g. whether vulnerable data subjects such as children or elderly people, for example, are involved; whether it was a collective or individual breach) and the particular characteristics of the data controller (e.g. based on the activity processing environment).

 

 

 

posted by admin on marzo 31, 2018

GDPR Regulation EU 2016/679, Privacy

Commenti disabilitati

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which start from already well-known privacy concepts and give a brief guide to the new legislation.

Who is the Data Protection Officer?

The Data Protection Officer, more commonly known as the DPO, is appointed by the controller or processor and mainly plays a dual role: firstly, he/she is entrusted with the duty of monitoring and overseeing compliance with the GDPR within the organisation of the person who has appointed him/her; secondly, he/she acts as a point of contact between the organisation and GDPR authorities and interfaces with data subjects.

When should a DPO be appointed?

The appointment of the DPO is mandatory (Art. 37) when: a) the processing is carried out by a public authority or body (except judicial authorities); b) the core activities of the controller or processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale; or c) the core activities of the controller or processor consist of processing on a large scale of sensitive data (e.g. data relating to health, genetic data, biometric data, data relating to criminal offences or data relating to minors). However, Union or Member state law can provide for further cases of mandatory appointment.

Apart from these cases, the appointment of a DPO is discretionary but still strongly recommended, given the importance of the role in assisting and supporting compliance with the GDPR.

What skills are required to be appointed as DPO?

The DPO must have significant specialist knowledge commensurate with the sensitivity, complexity and amount of data processed by an organisation. In particular, he/she must have full command of national and European data protection laws and practices and be thoroughly knowledgeable of the GDPR as well as of the business sector and the controller’s organisation.

Lastly, he/she must have a significant degree of familiarity with the processing operations carried out, as well as the IT systems and data security and data protection needs of the controller.

What tasks does the DPO have?

Beside the roles of internal coordination and external contact point, the DPO will take charge of the ongoing (awareness-raising and) training of the controller’s or processor’s staff in the field of data protection, monitor compliance with the GDPR and play an advisory role, giving advice upon request on data protection impact assessments (DPIAs) and monitor their performance. This task list is by no means complete and the controller or processor may decide to assign further tasks to the DPO, such as for example the task of maintaining the record of processing activities.

Can the role of DPO be allocated to an employee of the controller/processor?

The controller or processor can either decide to appoint an internal member of staff of their own organisation as DPO (a new or existing staff member) or to contract the role externally (by means of outsourcing or a service contract). In both cases, the controller or processor must ensure that the DPO is in the position to be able to perform his/her duties and tasks in an independent manner and that any such tasks and duties do not give rise to a conflict of interest. For this reason, the controller and processor must ensure that the DPO does not receive any instructions and that he/she will not be dismissed or penalised for performing his/her tasks.

Can the DPO have his/her own team?

The controller or processor must provide all resources necessary for the DPO to be able to carry out his/her tasks, such as sufficient time, adequate financial resources, infrastructure (premises, facilities, equipment) and staff. The DPO can also have his/her own team to help him/her in performing his/her tasks. In such cases, the internal structure of the team and the tasks and responsibilities of each of its members should be clearly drawn up and there should be a designated lead contact.

Who is responsible for non-compliance with the GDPR ?

The DPO is not personally responsible for non-compliance with the GDPR during processing. Only the controller and the processor are responsible for any non-compliance with the Regulation when performing processing.

Is the controller/processor required to publish and communicate the DPO’s appointment?

The appointment of the DPO must be published and communicated both inside and outside the organisation of the controller or the processor. In particular, contact details of the DPO, such as for example a postal address, a dedicated telephone number, and/or a dedicated e-mail address (and possibly a dedicated contact form) should be published on the controller’s or processor’s website. The same contact details will be communicated to the relevant supervisory authority and to data subjects with the privacy notice (see, the first FAQ on privacy policies “link”).

Focus: the “large scale” concept

The GDPR does not define what large scale processing is. Working Party Art. 29, offers some criteria in order to clarify the concept in its Guidelines on DPOs of 5th April 2017 . When determining whether the processing is carried out on a large scale, the following factors can be considered:

• The number of data subjects concerned-either as a specific number or as a proportion of the relevant population;

• The volume of data and/or the range of different data items being processed;

• The duration, or permanence, of the data processing activity;

• The geographical extent of the processing activity.

Examples of large-scale processing include:

• processing of patient data in the regular course of business by a hospital;

• processing of travel data of individuals using a city’s public transport system (e.g. tracking via

travel cards);

• processing of customer data in the regular course of business by an insurance company or a bank.

 

 

 

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which start from already well-known privacy concepts and give a brief guide to the new legislation.

What is meant by consent to the processing of personal data?

According to the new definition in the GDPR, consent of the data subject means “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (art. 4, par. 1, n. 11). Analysis of the definition shows that consent represents an indication of will, expressed in affirmative and unambiguous terms. Therefore, it can only be a statement or a positive action on the part of the data subject and not, conversely, merely passive conduct, such as hypothetical silent consent, for example. Moreover, in the same way as the Italian privacy Code, the GDPR requires consent not only to be unambiguous but also: free (given in the absence of constrictions); specific (one for each processing purpose) and informed (the data subject must receive an appropriate privacy notice on the processing of his/her personal data).

Who must ask for consent for the processing of personal data?

The data controller or, if specifically instructed, the data processor must have the consent of the data subject when they want to process his/her data. The GDPR places the actual burden of proof on the data controller. Art. 7, par. 1 specifies that the data controller shall be able to demonstrate that the data subject has consented to the processing of his/her personal data.

When is consent for personal data necessary?

Consent by the data subject is one of the many legal bases provided by the GDPR alternately, to legitimise the processing of personal data carried out by the controller. This means that consent must be obtained whenever one of the alternative legal bases listed in art. 6 of the GDPR cannot be used. These are essentially “equivalent circumstances” to consent, in the presence of which personal data may be processed even without consent from the data subject.

What are the equivalent circumstances to consent by the data subject?

In addition to consent, art. 6 of the GDPR lists five different legal bases which mainly take up the alternatives already provided for by the Italian privacy Code. Processing will be lawful even in the absence of consent if: a) it is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract; b) it is necessary for compliance with a legal obligation to which the controller is subject; c) it is necessary in order to protect the vital interests of the data subject or of another natural person; d) it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

In the last case, it will be the duty and responsibility of the controller to balance his/her legitimate interest with the rights of data subjects and justify that his/her interest overrides the interests of the various data subjects.

What might the legitimate interests of the controller be?

Recitals 47, 48 and 49 of the GDPR list examples of activities that might be considered the legitimate interests of a data controller and which override those of data subjects.

Among these is fraud prevention and direct marketing (which occurs when the controller uses the contact data the data subject has given him/her in the context of the sale of a product or a service without asking for the data subject’s consent and provided that the data subject, adequately informed, had not refused it). The processing of data for internal administrative purposes or in order to assure the security of networks and information may also be considered to be covered by legitimate interest.

Are there particular conditions for the processing of “sensitive” data (so called special categories of data)?

For the processing of special categories of data (sensitive data), the general rule is that of explicit consent (explicit consent is also applied when the data controller wants to adopt automatic decision-making processes, including profiling, which have legal consequences for data subjects).

In this case, the GDPR also provides a series of “equivalent circumstances” which waive the need to collect consent (art. 9). Some of these are particularly innovative, among which when processing is necessary for: the purposes of complying with obligations of labour law, social security and social care; the purposes of preventive or occupational medicine; for reasons of public interest in the field of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

What is new with regard to child’s consent?

The GDPR inserts an ad hoc provision for child’s consent, which however only refers to the offer of information society services.

Considering the wide variety of content and digital services to which children have access thanks to the use of the Internet, the GDPR wishes to strengthen the protection of children from the dangers of the Internet. Therefore, Art. 8 specifies that consent given by a child for the processing of his/her personal data in the context of a service offered by an information society, is only lawful when the child is at least 16 years old (Member States may provide by law for a lower age provided that it is not below13 years).

Where the child is below the age of 16, processing will be lawful only if and to the extent that consent is given or authorised by the parents or holder of parental responsibility over the child.

What are the conditions for the collection of consent?

In light of the definition of consent (a free, specific, informed and unambiguous indication of will), the GDPR specifies the conditions controllers must fulfill in order to guarantee the collection of legitimate consent.

Consent can be given with a written or an oral statement.

When consent is given in writing, in the context of a declaration which also includes other matters, consent to data processing must be presented in a manner which is clearly distinguishable from the other matters.

The formulation of consent must be in an intelligible and easily accessible form, using clear and plain language.

Moreover, the data controller must take into consideration that consent given by the data subject can be withdrawn at any time as easily as it was given.

How to create a GDPR compliant consent form?

To briefly summarise: in order to create a GDPR compliant consent form:

1) this must be a clear and unambiguous act: it can be collected in writing including by electronic means, or with an oral statement;

1.1) this implies that consent is not constituted by: silence, inactivity or pre-ticked boxes.

1.2) on the contrary, consent can be obtained through: specific boxes to tick (not pre-ticked) when visiting an Internet website; choosing technical settings for information society services or another statement or conduct which clearly indicates the data subject’s acceptance of the proposed processing of his/her personal data.

2) must be formulated in clear, plain and intelligible language;

3) there must be separate consents for each processing purpose (marketing and profiling are distinct purposes);

4) when a child is involved: the age of the child must be verified or parental consent must be asked for;

5) for special categories of personal data, consent must be explicit;

6) data controllers must take appropriate measures to demonstrate that the data subject has consented to processing of his/her personal data and also to inform the data subject of his/her right to withdraw his/her consent at any time and that it is as easy to withdraw as to give consent.

 

 

The privacy regulation (Regulation (EU) 2016/679) will shortly be directly applicable across Europe, which means that businesses, public administrations and private citizens will all be rushing to make sure they comply with the provisions of the new regulation. To make it easier to understand such a complex and highly structured text as the GDPR, we provide a set of simple factsheets here with a Q&A formula, which starting from already well-known privacy concepts, give a brief first guide to the new regulation.

What is a privacy notice?
A factsheet known as a privacy notice refers to that set of information which must be provided to data subjects (namely natural persons whose data are processed) to allow them to understand who is collecting their personal data, what will be done with them, how, by whom and who they will be shared with.

Who is responsible for providing the privacy notice?
The privacy notice must be provided by the data controller or the data processor, when specifically instructed to do so by the data controller.

What are the contents of a privacy notice?
The GDPR provides a thorough description of the contents of the privacy notice in art. 13, par. 1 and art. 14, par. 1.

Some of these contents were already provided for in the Italian Privacy Code, among which are for example the indication of: a) contact data of the data controller and of any data processor when used; b) the purposes of processing (e.g. entering into contracts, marketing, profiling, etc.); c) whether the provision of personal data is mandatory or not and the consequences (should such mandatory data not be provided); d) the rights of data subjects.

Besides this information, the GDPR provides further relevant information in the privacy notice which the controller is required to provide to data subjects in order to proceed with processing their data, such as: a) contact data for the Data Protection Officer when appointed; b) the legal basis for the processing (e.g. consent, public interest, performance of contracts and so on) and in cases where this constitutes legitimate interest for the controller, specify its contents; c) whether the data will be transferred to countries outside the EU and which instrument the transfer will be carried out with (e.g. adequacy decision; BCR, standard contractual clauses); d) the period of time for which the data will be stored or the criteria used to determine it; e) the existence of automated decision-making (including profiling) and the logic it is based on.

When must the privacy notice be given?
The privacy notice must be provided to data subjects at the moment in which their data are collected, therefore before the start of any kind of processing. The GDPR only exempts data controllers from the obligation of providing privacy notices in cases in which data subjects already have all the information at their disposal (art. 13, par. 4).

Conversely, however, in cases where the data have not been obtained from the data subject, data controllers must provide data subjects with the above listed information (in addition specifying the source of the data) within a month of collecting them or at any rate from the moment of their communication (to a third party or to the data subjects themselves).The GDPR also provides for certain circumstances for exemption in this situation (art. 14, par. 5) which refer to those cases in which: a) data subjects are already in possession of all relevant information; b) the provision of such information would prove impossible or would involve excessive effort; c) the collection or disclosure is laid down by law; d) the data must remain confidential subject to an obligation of professional secrecy. It is the duty and therefore, the responsibility of the data controller to assess whether there is one of the above-listed circumstances.
In addition data subjects must be provided with a new privacy notice should the data controller decide to process the collected data for different purposes from those originally communicated.

How must the privacy notice be provided?
In this case too the GDPR gives a clearer definition of the procedure for formulating and providing the privacy notice.
The privacy notice is generally provided in writing or by other means, which can also be electronic (where appropriate). Only in cases when the data subject requires it, may the privacy notice be provided orally.
With regard to its formulation, the GDPR specifies that the privacy notice must be: concise, transparent, intelligible and easily accessible. Essentially, it must be formulated in clear and plain language, in particular when the information is specifically addressed to a child (art. 12, par. 1).
In addition, with the precise aim of guaranteeing the highest level of transparency and to make it easily legible, the GDPR clearly explains that the information may be provided in combination with standardised icons to give an intuitive and easily understandable overview of the processing procedure.

  • Recent comments

  • Popular posts

    • None found