GDPR Data Subject Rights

• Personal data protection and management is an important topic to study

GDPR Data Subject's Rights

• Chapter III (Article 12-23) and Article 7 govern data subject's rights.
• Data subjects have been given 7 distinct rights over their data under the GDPR.
• The rights can be accessed and rectified.
• Data can be erased and forgotten.
• Subjects can object and withdraw consent.
• Processing can be restricted and data can be taken back.

Right of Access (Article 15)

• Individuals can obtain confirmation from the controller about whether their data has been processed.
• If it has, they are allowed access to their personal data and other information like its purpose, categories, etc.

Right to Rectification (Article 16)

• Data subjects have the right to correct inaccurate personal data without undue delay from the controller
• Data subjects can have incomplete personal data filled with by means of providing a supplementary statement, taking the purposes of the processing into account

Right to Erasure (Article 17)

• Data subjects shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay.
• This is also known as the right to be forgotten.

Right to Restriction of Processing (Article 18)

• The data subject can seek restriction of processing from the controller if:
• The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims
• The data subject has objected to processing pursuant to Article 21(1) pending verification of whether the controller's legitimate grounds override those of the data subject.

Right to Data Portability (Article 20)

• A data subject can receive their personal data provided to a controller in a structured, commonly used, machine-readable format.
• The data subject can transmit that data to another controller without hindrance from the initial controller.

Right to Object (Article 21)

• Data subjects can object to the processing of personal data concerning them based on their particular situation.
• Where personal data are processed for direct marketing, the data subject can object to processing for marketing, including profiling related to direct marketing
• Data subjects may exercise their right to object by automated means using technical specifications within the context of information society services, notwithstanding Directive 2002/58/EC
• Data subjects can object to the processing of personal data for scientific, historical research,or statistical purposes based on their situation, unless processing is necessary for public interest tasks

Right to Withdraw Consent (Article 7(3))

• Data subjects have the right to withdraw consent at any time.

GDPR Article 6(1): How to Handle Personal Data

• Data processing is lawful only with a legal basis.
• Data processing needs consent from the data subject for one or more specific purposes
• The data processing should be for the performance of a contract the data subject is party to. It also applies to steps prior to entering into the contract
• Processing should comply with a legal obligation the controller faces
• Processing should protect the vital interests of the data subject or a natural person
• Processing should be a task carried out in the public interest or be official authority vested in the controller
• Processing should pursue the legitimate interests of the controller or a third party, unless these interests are overridden by the interests, rights, and freedoms of the data subject

Conditions for Consent

• Based on Article 7, consent requires the controller to show that the data subject has consented to personal data processing
• If a data subject's consent is in writing also containing other matters; then the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily-accessible form, using clear and plain language
• The data subject is allowed to withdraw his or her consent at any time.

What is Consent under GDPR? (Article 4)

• Consent under GDPR must be freely given, specific, informed, unambiguous, and involve a clear affirmative action.
• Being specific means the person needs to be asked to consent to individual types of data processing
• Being informed means the person must be told what they are consenting to
• Unambiguous language must be clear and simple
• Clear affirmative action needs the person to expressly consent by doing or saying something
• Consent is not valid under the GDPR If you're missing even one of those five elements
• Express consent requires the person to understand the question and implications and make a genuine choice.
• Options to do this would be, filing a form, ticking a box on a website, or during face-to-face conversation

Principles About Cookies

• Cookies are tracking files submitted and/or read when visiting a website, reading an email, or installing/using a mobile application
• Technical cookies are installed to facilitate/enable electronic communication
• Technical cookies are needed in providing service on the Internet
• Technical cookies include certain audience measurement cookies, necessary for site operation
• Consent is not necessary with technical cookies.
• Tracking cookies are about advertising and user tracking behavior
• Tracking cookies include those for social networks and audience measurement (like Google Analytics)
• Consent is mandatory with the inclusion of tracking cookies.
• CNIL(Commission Nationale de l'Informatique et des Libertés) recommends maintaining two levels of information, including Cookies banner at step 1 and Cookie manager in step 2
• "Accept all/refuse all" and/or consent by purpose/type of cookie are part of the evolution of consent gathering practices
• No choice = no consent (the user can close the pop-up window and continue freely on the site)
• Consent can easily be withdrawn using a pop-up window that remains on the site.
• Consent is good for at most 6 months

Consent Through Cookies

• Pre-ticked boxes are not allowed under the GDPR, but may other countries outside the EU will still allow it

Consent of Minors

• Parental authorization is required to process a child's personal data based on consent.
• Threshold ages will vary between 13-16 in member countries.
• Check national laws to be sure.

GDPR Cases on Children's Data

• Swedish supervisory authority fined an unnamed Swedish school €18,630 for its trial run using facial recognition to monitor student's attendance in August 2019.
• There were 22 student that participated for a duration of 3 weeks.
• Parental consent was obtained but could not be refused.
• Some data was stored in computer hard drive locked in cabinet, while School didn't carry out DPIA.
• This was a Breach of Article 5 – purpose of limitation

Legitimate Interest(Example)

• A bank gives a loan, the client stops making payments and moves without notifying the change.
• The client has not consented to the disclosure, but it is legal, which allows the bank to pursues a legitmate interest, to recover the debt
• The bank hires a debt collection agency to find the client and seek payment by disclosing the client's personal data.
• The bank can only disclose accurate, up-to-date data and no more than is required by the collection agency.
• Legitimate interest must be proportional.

Legitimate Interests Assessment Form

• Includes purpose, necessity, and balancing tests

DPO – Data Protection Officer

• Article 37 -39 defines the Data Protection Officer
• They must be regular and systematic monitoring of data subjects on a large scale Regular = ongoing for a particular period, reoccurring at fixed times, constantly or periodically taking place. Systematic = occurring according to a system, pre-arranged, organized, carried out as part of strategy Large scale = number of data subjects NOT company size
• Could be either Public authority or could be required by an EU member state
• Public authority = publicly funded museums, state schools, or universities

Specifics of the Data Protection Officer

• The DPO can either be an Employee or contracted, must have a strong understanding of the organization itself, and cannot be a temporary position
• Minimum tenure is two years.
• Renewal will be a Maximum of five terms (10 years total)
• The DPO must maintain a constant independent position by reporting to highest management level.
• Support can be requested as needed to fulfill duties. DPO cannot be swayed by business interest and is not allowed to be the controller
• Head of marketing is not allowed to be the DPO
• The DPO cannot be dismissed unless they are not fulfilling their duties with prior consent of governing regulatory authority.

DPO Tasks (Article 39)

• Tasks include informing data subjects about their rights and raise awareness of the regulation, advise their institution about the application of the GDPR rules
• Other tasks include conducting prior checks of risks, maintaining a list of operations that the organization will undertake and aiding the institution be accountable to the governing agency
• Tasks also include answering any questions, handling complaints related to the processing of personal data and co-operating in the instance of an investigation

DPO's Administrative Responsibilities

• Must oversee Privacy policies/Privacy notices/Cookie policies
• Must maintain all record keeping by Standard record keeping if +250 employees, DPIA and LIA

Privacy

• A privacy notice explains to the DS processed as well as DSR and information
• A privacy notice (public, addressing data subject) and a privacy policy are not necessarily the same (internal, addressing employees and other persons involved in processing personal data)
• The GDPR obligations drive from reading Articles 12, 13 and 14

Privacy Policy and Privacy Notices

• Following Article 12, any information must be in concise, transparent, intelligible and easily accessible form, and using clear and plain language

PIA – Privacy Impact Assessment - DPIA – Data Privacy Impact Assessment

• Article 35 is mandatory for beliefs that processing personal data can involve a high risk to the rights and freedoms of data subjects
• Must look at nature, scope, context, purpose of processing in a case.
• Must be able to identify the risks related to processing of data to mitigate them

This includes:

• Systemic and extensive evaluations based on automated processing
• Processing of data in large special categories of data/criminal conviction
• Systematic monitoring of public areas by CCTV

What Happens with 9 Criterias listed by the European Data Protection Committee(EDPS)?

• When 2 of 9 criteria are met, an affect assessment must be conducted.
• Evaluation or grading, including profiling and prediction activities
• Automated decision making with legal or similar significant effect
• Systematic surveillance is enacted
• Sensitive data and combining of data
• Processing operations can prevent Data subject from exercising the rights, or use of services

DPIA – Harms

• Identify any harm or damage processing causes with respect to physical, emotional, or material
• Examples would be from the Inability to take rights & Loss of control over the use personal data
• Additional examples include: Discrimination,Theft/fraud, Financial loss, Physical abuse, damage etc..

DPIA - Mitigations

• The Decision not to take data and reduction time
• Staff is properly trained with new systems in place
• The new data is properly shared while always offering the Opt outs..

DPIA - and SA

• Data processing is still results and has a high risk, it must be consulted from ( SA)
• All documentation must be there for review ( 8 weeks to show with extention of 6)

This quiz covers the rights of data subjects under GDPR, including the right to access, rectification, and other key provisions. It explores data processing activities requiring a Data Protection Impact Assessment (DPIA). Test your knowledge of GDPR compliance.