CIPP/E GDPR Terms

Right to data portability

Requires controllers to provide personal data to the data subject in a commonly used format and to transfer that data to another controller if the data subject so requests

Exceptions to transferring personal data outside the EU without adequate protections

- Explicit consent - For the performance of a contract - Important reasons of public interest - Establishment, exercise or defense of legal claims - To protect vital interests where the data subject is physically or legally incapable of giving consent - Made from a register that is intended to provide information to the public

Data protection principles

- Lawfulness, fairness and transparency - Purpose limitation - Data minimisation - Accuracy - Storage limitation - Integrity and confidentiality - Accountability

Processors' records of processing to keep

- contain contact information for the processor(s) and controller(s) - the categories of processing carried out for each controller - information on cross-border transfers if applicable - a general description of the implemented technical and organizational security measures

Processors' duties to controllers

- process data only as instructed by controllers; - use appropriate technical and organizational measures to comply with the GDPR - delete or return data to the controller once processing is complete - submit to specific conditions for engaging other processors

Information provided to data subjects when their information is collected

- that the controller intends to transfer personal data to a third country or international organization - that such transfer is pursuant to an adequacy decision by the Commission - reference to the appropriate or suitable safeguards and the means for the data subject to obtain them

Disclosures a controller must make before collecting personal data

- the identity of the controller - the purposes for processing - any recipients of personal data - how long the data will be stored - the right to withdraw consent at any time, - the right to request access, rectification or restriction of processing - the right to lodge a complaint with a supervisory authority

Factors in determining data protection adequacy for cross-border transfer

- the specific processing activities - access to justice - international human rights norms - the general and sectoral law of the country - legislation concerning public security, defense and national security - public order - criminal law

Affirmative actions signaling consent

- ticking a box on a website - choosing technical settings for information society services - another statement or conduct that clearly indicates assent to the processing

Top 10 operational impacts of GDPR

1. Data Security and Breach Notification Standards 2. The Mandatory DPO 3. Data Subject Consent 4. Cross-border Data Transfers 5. Profiling and the Right To Object 6. The New Rights To Be Forgotten and to Data Portability 7. Clarifying Duties and Responsibilities of Controllers and Processors 8. 'Pseudonymization' of Personal Data 9. Codes of Conduct and Certifications 10. Complex Administrative Procedures and Hefty Fines

GDPR's new requirements for consent

1. the right to withdraw consent at any time and it shall be as easy to withdraw consent as to give it 2. consent is not freely given if there is a clear imbalance of power 3. consent must be specific to each data processing operation

Explicit consent

All situations where individuals are presented with a proposal to agree or disagree to a particular use or disclosure of their personal information and they respond actively to the question, orally or in writing

Binding Corporate Rules

Allow companies to make intra-organizational transfers of personal data across borders in compliance with EU Data Protection Law

Right to be forgotten

Allows individuals to request the deletion of personal data, and, where the controller has publicized the data, to require other controllers to also comply with the request

Profiling examples

Analyzing or predicting aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements

Data protection by design and by default

Controllers should design products with privacy in mind, rather than tacking it on as an afterthought, and that privacy-protective settings should be the default in any product

Special categories of data

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like

Direct identifiers

Data that can be used to identify a person without additional information or with cross-linking through other information that is in the public domain

How consent must be given

Freely given, specific, informed and unambiguous by a statement or by a clear affirmative action.

Data Subject Consent

The GDPR requires the data subject to signal agreement by "a statement or a clear affirmative action."

How photographs qualify as biometric data

When they are processed through a specific technical means allowing the unique identification or authentication of a natural person

Personal data breach

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed

Personal data

any information relating to an identified or identifiable natural person ('data subject')

Profiling

involves (a) automated processing of personal data; and (b) using that personal data to evaluate certain personal aspects relating to a natural person

Pseudonymization

the separation of data from direct identifiers so that linkage to an identity is not possible without additional information that is held separately

Joint controllers

when two or more controllers jointly determine the purposes and means of processing