Scope of General Data Protection Regulation (GDPR)

26th May 2018

Both organisations within the EU jurisdiction and those in external jurisdictions which supply goods or services to member citizens of EU. If those those organisations offer services, collect, share or use (process) ‘personal data’ of natural persons.

Personal Data

Application of DGPR to activities depends on whether personal data is processed. Personal data has to relate to an identified or identifiable individual either directly from the information in question or in combination with other information. ¹

Personal data could be anything that allows identification, a name, related number (ID, NI), location or less obvious IP address or cookie identifier.

Does not include

1. Information about a deceased person.
2. Information about companies or local authorities.
3. Truly anonymous data.

Cookies as Personal Data

Cookies can be used to identify a person and therefore should be treated as ‘personal data’.

The basic principle is simple enough,

1. tell people the cookies are there;
2. explain what the cookies are doing and why; and
3. get the person’s consent to store a cookie on their device.
4. explain how cookies can be controlled and deleted by the browser.

Cookies have to be explained both by name an purpose, whether they be session or more persistent.

Consent

Consent cannot be implied simply a user navigating a website. Consent to be valid must be freely given, specific and informed.² And requires an unambiguous indication by statement or affirmative action that signifies agreement to ‘processing’ related personal data.

Processing of Personal Data

1. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. accurate and, where necessary, kept up to date.
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

Lawfulness of Processing

Processing of personal data can only be lawful if at least one of the following applies

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
2. processing is necessary for the performance of a contract.
3. processing is necessary for compliance with a legal obligation.
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person.
5. processing is necessary for the performance of a task carried out in the public interest.
6. processing is necessary for the purposes of the legitimate interests.

Compliance

Right to Access Your Data

Penalties

Administrative fines of €20,000,000 or four per cent of a firm’s global turnover (whichever is greater) for serious offences and €10,000,000 and 2% for lesser breaches.³

Information Realty

So much for theory but, what is actually happening in the big data industry?

Facebook Mas exodus From Ireland

Facebook as outlined in this article is moving service agreements out of Ireland to the more lenient USA. A move which could potentially save billions if ever they fall fould og GDPR.

References

UK Controlling Authority is (ICO) Information Commissioner’s Office

Guide to the General Data Protection Regulation (GDPR)

Europe

European Commission: 7 steps for business

European Commission: Data Protection

European Commission: Rules for business and organisations

European Commission site: Cookie Statement

footnotes

ico