GDPR – What is it? Step by step
GDPR is Regulation (EU) 2016/697 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/64/EC. This legal act introduces provisions that will apply from May 25, 2018. The GDPR is intended to unify personal data protection regulations across the European Union. Most of the regulations enshrined in this regulation have long existed, in one way or another, in the Polish personal data protection system. However, the novelties introduced by GDPR include a number of significant issues, the most important of which are outlined in the following study.
Basics of personal data processing according to GDPR
Processing is lawful only if at least one of the following conditions is met:
- The data subject has consented to the processing of his or her personal data for one or more specific purposes.
- Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract.
- Processing is necessary to comply with a legal obligation incumbent on the controller.
- Processing is necessary to protect the vital interests of the data subject or another natural person (example: hospitals).
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
Where processing for a purpose other than that for which the personal data were collected is not based on the consent of the data subject or on Union or Member State law, the controller shall take into account the relationship between the purposes for which the personal data were collected and the purposes of the intended further processing; the context in which the personal data were collected; the nature of the personal data; the possible consequences of the intended further processing for the data subjects; and the existence of appropriate safeguards, including possible encryption or pseudonymisation.
Consent to the processing of personal data
Consent to the processing of personal data must be express and include the required form of expression such as "a declaration of intent" or "a clear affirmative action".
(The rest of the article can be found below the form)
If processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data. If the data subject consents in a written declaration that also covers other matters, the request for consent must be presented in a way that is clearly distinguishable from the other matters, in an intelligible and easily accessible form. The data subject has the right to withdraw consent at any time, and withdrawing consent must be as easy as giving it.
Legal basis for processing special categories of data
As a general rule, the processing of sensitive personal data (including biometric data and genetic data) is prohibited. The above restriction does not apply if one of the following conditions is met:
- The data subject has given explicit consent to the processing of such personal data for one or more specific purposes.
- Processing is necessary for the performance of obligations and the exercise of specific rights by the controller or the data subject in the field of labor law, social security and social protection.
- Processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent.
- Processing is carried out within the framework of legitimate activities carried out with appropriate safeguards by a foundation, association or other non-profit entity with political, ideological, religious or trade union objectives, provided that the processing relates solely to members or former members of that entity or persons maintaining regular contact with it in connection with its objectives and that the personal data are not disclosed outside that entity without the consent of the data subjects.
- The processing relates to personal data that has been manifestly made public by the data subject.
- Processing is necessary for the establishment, exercise or defence of legal claims or in the exercise of justice by courts.
- Processing is necessary for reasons of important public interest, based on Union or Member State law, which is proportionate to the aim pursued, respects the essence of the right to data protection and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject.
- Processing is necessary for the purposes of preventive healthcare or occupational medicine, for assessing an employee's fitness for work, for medical diagnosis, for the provision of healthcare or social security, for treatment or for the management of healthcare or social security systems and services.
- Processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices.
- Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Information and access to personal data according to GDPR
If personal data are collected from the data subject, the controller shall provide all of the following information when collecting personal data: his/her identity and contact details; the purposes of personal data processing and the legal basis for processing; information on the recipients of personal data; other information on the intention to transfer personal data to a third country or an international organisation.
In addition to the above information, when collecting personal data, the controller shall provide the data subject with the following other information necessary to ensure fair and transparent processing:
- The period for which the personal data will be stored or, if this is not possible, the criteria for determining that period.
- Information on the right to request from the controller access to personal data relating to the data subject, their rectification, erasure or restriction of processing or the right to object to processing, as well as the right to data portability.
- Where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), information on the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- Information on the right to lodge a complaint with the supervisory authority.
- Information whether the provision of personal data is a statutory or contractual requirement or a condition for entering into a contract, as well as whether the data subject is obliged to provide the data and what the possible consequences are of failure to provide the data.
- Information on automated decision-making, including profiling, as well as the significance and envisaged consequences of such processing for the data subject.
Information shall be provided in writing or by other means, including electronically, where appropriate. If the data subject so requests, information may be provided orally, provided that the data subject's identity can be confirmed by other means.
Obligation to respect the rights of data subjects
The data subject should, in particular, be provided with:
- The right to access data.
- The right to rectify data.
- The right to delete data.
- The right to restrict data processing.
- The right to object.
- The right not to be subject to a decision based solely on automated processing.
Default protection
The GDPR introduces the requirement to incorporate personal data protection by design and to set personal data protection by default in products and services. These mechanisms assume that privacy settings in devices, products, and services should be geared towards maximum user protection. Personal data protection policies and implemented measures should ensure that data protection is incorporated by design and that protection by default mechanisms are in place.
Obligation to record processing activities
The new regulations introduce an obligation for data controllers to maintain a register of processing activities. This obligation applies to:
- An entrepreneur or entity employing more than 250 people.
- An entrepreneur or entity employing fewer than 250 people, if
- the processing it carries out may result in a risk to the rights or freedoms of data subjects,
- the processing is not occasional,
- includes special categories of personal data referred to in Article 9(1) of the GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, as well as data concerning health, sex life or sexual orientation) and data referred to in Article 10 of the GDPR (data on offences and criminal convictions).
Personal data protection violations
The GDPR requires the controller to immediately report any personal data breach to the supervisory authority (GIODO in Poland). The controller must do so promptly, but no later than 72 hours after discovering the breach. If the controller misses this deadline, the notification must include an explanation of the reasons for the delay.
The application must at least:
- Describe the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects and the categories and approximate number of personal data entries affected by the breach.
- Include the name and contact details of the data protection officer or another contact point from which more information can be obtained.
- Describe the possible consequences of a personal data breach.
- Describe the measures taken or proposed by the controller to address the personal data breach, including, where appropriate, measures to minimise its possible adverse effects.
A notification should not be made if the breach is "unlikely to result in a risk of infringement of the rights or freedoms of natural persons" - and therefore the controller will bear the burden of assessment and the associated responsibility (assessment of the likelihood of a risk of infringement of rights or freedoms).
Please also remember that the controller is also obliged to document any personal data breaches within its internal documentation.
Obligation to implement appropriate technical and organizational measures
Taking into account the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure and to be able to demonstrate processing in accordance with this Regulation. These measures shall be reviewed and updated as necessary.
The Controller implements appropriate technical and organizational measures to ensure that, by default, only the personal data necessary to achieve each specific processing purpose is processed. This obligation applies to the amount of personal data collected, the scope of their processing, their storage period, and their accessibility. In particular, these measures ensure that, by default, personal data are not shared with an indefinite number of individuals without the intervention of the individual.
The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of violation of the rights and freedoms of natural persons, including, among others, where appropriate:
- Pseudonymization and encryption of personal data.
- The ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services.
- The ability to quickly restore the availability and access to personal data in the event of a physical or technical incident.
- Regularly testing, measuring and assessing the effectiveness of technical and organisational measures to ensure the security of processing.
The data controller fulfils this obligation by:
- Personal data protection compliance audits.
- IT system tests.
- Controlled attempts to break through security.
- On-site visits.
Estimating the risks associated with personal data processing
The first stage of risk assessment involves defining each risk threatening the entity processing personal data by specifying these risks, together with an indication of risks leading to physical harm or property or non-property damage.
The second stage concerns risk measurement and analysis, which involves estimating the probability of occurrence of defined risks and determining the value of probable losses (consequences). Consequences may include: physical harm, property damage, or non-property damage to individuals, such as loss of control over their own personal data or restriction of rights, discrimination, identity theft or fraud, financial loss, unauthorized reversal of pseudonymization, damage to reputation, breach of confidentiality of personal data protected by professional secrecy, or any other significant economic or social harm.
The third stage concerns risk management and involves modifying risks that exceed an acceptable threshold (risk reduction). Examples of risk management methods include: removing the source of the risk, taking or suspending the risk to capitalize on an opportunity, and sharing the impact of the risk with other parties.
Where a data protection impact assessment indicates that, in the absence of safeguards, security measures and risk mitigation mechanisms, processing would result in a high risk to the rights and freedoms of natural persons and the controller is of the opinion that the risk cannot be mitigated by reasonable measures in terms of available technology and implementation costs, then the supervisory authority must be consulted prior to processing activities.
Appointment of a data protection officer
The regulation does not use the term "information security administrator" known from the Personal Data Protection Act (UODO) – "information security administrator – ABI," but rather the term "data protection officer." The appointment of an internal data protection officer is mandatory in the following cases:
- Processing is carried out by a public authority or body, with the exception of courts when exercising their judicial powers.
- The core activities of the controller or processor consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale, or
- The core activities of the controller or processor consist in the processing on a large scale of special categories of personal data referred to in Article 9(1) of the GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, as well as data concerning health, sex life or sexual orientation) and personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.
Profiling
Profiling refers to situations in which online sales websites collect information about consumer preferences, based on which they "predict" their future choices (offering them items that correlate with their preferences). The GDPR defines profiling as "any form of automated processing of personal data involving the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements."
Profiling is also covered by a provision that expresses the data controller’s obligation to inform the data subject about the fact of profiling and its consequences.
Where automated processing or profiling results in making a decision in an individual case and, in addition, the processing in question will produce legal effects for the data subject or will significantly affect him or her in a similar manner, the data controller will have to obtain explicit consent for such processing.
Where the processing in question is based on the need to enter into or perform a contract or on explicit consent, the controller must implement appropriate measures to safeguard the rights, freedoms and legitimate interests of the data subject.
It can therefore be assumed that if the controller profiles data solely for statistical or development purposes or solely for internal needs and this does not involve any decision-making process in relation to the person whose data is profiled, it is also not obliged to inform about this activity or obtain consent in this respect.
Biometric data
The GDPR introduces a definition of "biometric data", which should be of interest to employers planning to implement technologically advanced solutions related to, for example, monitoring and regulating employee access to workplace facilities, as the GDPR establishes a general ban on the processing of such data.
Biometric data should be understood as personal data "resulting from specific technical processing, relating to the physical, physiological or behavioural characteristics of a natural person and enabling or confirming the unique identification of that person, such as facial images or fingerprint data".
Entrusting the processing of personal data
The Controller may only conclude personal data processing agreements with entities that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing will meet the requirements of this Regulation and protect the rights of data subjects.
The processor shall not use the services of another processor without the controller's prior specific or general written consent. In the case of general written consent, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
Internal documents
The GDPR imposes the obligation to create and maintain a number of internal documents: proof of consent to the processing of personal data, information clauses on the processing of personal data, a register of processing activities, and data processing regulations.
The new regulations also require personal data controllers to adopt internal policies and implement appropriate technical and organizational measures. However, the GDPR does not specify the exact form of these policies, nor does it require them to be documented.
Sanctions
The GDPR provides for severe sanctions for violations of the new regulations. Depending on the type of violation, these can range from €10.000.000 to €20.000.000 or from 2% to 4% of the total annual global turnover from the previous financial year, whichever is higher.
Summary
This study is not intended to be exhaustive, but merely highlights the scope, innovative nature, and inherent risks. Those interested in this topic are encouraged to contact our law firm or read the following publications, which were among the first on the Polish market to be helpful in developing this study.
- Anna Dmochowska, Marcin Zadrożny: EU Personal Data Protection Reform. Analysis of Changes. CH Beck Publishing House 2016.
- Grzegorz Sibiga, Katarzyna Syska: General Data Protection Regulation. A handy collection of personal data protection regulations, summaries, diagrams, and templates for registering processing activities. CH Beck Publishing House 2017.
The material was prepared and made available courtesy of our partner law firm, Answer.
You can read more about the new rules on the website: http://answer.com.pl/pomozemy-przygotowac-ci-sie-rodo/.
If you need assistance in adapting your company to new regulations, we will be happy to send you an offer for comprehensive IT and organizational support.
Summary
The above article covers the following topics:
- protection of personal data in the light of the GDPR,
- legal basis enabling the processing of personal data,
- the obligations of the data controller and the rights of natural persons arising from the regulation,
- data security principles, recording processing activities and responding to breaches,
- the obligation to appoint a data protection officer depending on the scale and nature of data processing,
- use of personal data in profiling,
- principles of biometric data processing,
- the controller's cooperation with data processors,
- obligations related to record keeping,
- financial penalties provided for in the GDPR.
