Articles

GDPR: Embedding privacy is not an empty word

GDPR: Embedding privacy is not an empty word

GDPR: Embedding privacy is not an empty word

29.04.2016

The GDPR requires personal data processing entities to implement appropriate technical and organisational measures at the time when the means for processing are determined and at the time of the actual processing.

Privacy becomes a core part of every business from the very beginning and throughout the data processing cycle.

In this regard, the GDPR expressly requires compliance with two types of principles: data protection by design and data protection by default.

The former type means incorporating privacy into the architecture of the products (manufacturing/production) and service processes (offering, after-sales, maintenance, etc.) by, for example, minimizing the processing of personal data from the beginning to the end of a process. For instance, if the purpose for application developers can be achieved using aggregated data, accessing raw data should be avoided. It also means that organizations should ensure that the relevant expertise is available at the earliest possible stage, and not only later on to resolve any privacy issues that have arisen.

The latter type of principle means that organizations must implement mechanisms to ensure that, by default, only the minimum and necessary personal data for each specific purpose is processed, and the data are not disclosed more than necessary.

For instance, default settings of social media applications should ask users to review, edit, and decide on information generated by their device before they are published on social media platforms, while information that has been published should, by default, not become public or be indexed by search engines.

How these principles will be enforced is not clear yet. However, it is clear that the DPAs will require from the organizations concerned that they provide records and documentation demonstrating their compliance therewith, subject to penalty.

Organizations are indeed encouraged to certify their data processing with a supervisory authority or an approved certification body. A certificate of a data processing, once granted, is valid for up to 3 years (renewable) and is recorded in a public register so that data subjects can quickly assess the level of data protection provided by these organizations. More details on this will follow before the GDPR enters into force.

To read more about this series of articles (and the articles that were published previously), please click here.

 

Team

Related news

02.10.2019 EU law
Seminar: Data protection implications of (a no-deal) Brexit

Seminar - On October 2nd at 4 pm, we organize a seminar where we will discus the implications of a (no-deal) Brexit on data protection.  These issues affect all businesses interacting between UK and EEA (including EU) and which send or receive data to and from UK. We will highlight the main challenges both in the case of a hard Brexit on 31 October 2019 and in other scenarios. We will also offer guidelines to help your organisation mitigate the respective risks.

Read more

19.08.2019 EU law
Enable “likes” and bear joint-controllership

Articles - The Court of Justice of the European Union recently ruled, in Case C-40/14 Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV,  that a website operator that features “Like” social-media plugin from Facebook likely qualifies as joint-controller with Facebook for its website visitors’ personal data collection and transmission to Facebook.

Read more

28.08.2019 NL law
Masterclass: e-signature and electronic identifiers

Masterclass - Stibbe is organising a Masterclass on 26 September 2019 in Amsterdam on the subject of e-signature and electronic identifiers. This Masterclass will cover the legal framework and focus especially on the numerous possibilities for applying the various electronic signatures in different situations. In addition, we explain the regulations governing electronic identifiers, and the mandatory European recognition they receive.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring