Articles

GDPR: Embedding privacy is not an empty word

GDPR: Embedding privacy is not an empty word

GDPR: Embedding privacy is not an empty word

29.04.2016

The GDPR requires personal data processing entities to implement appropriate technical and organisational measures at the time when the means for processing are determined and at the time of the actual processing.

Privacy becomes a core part of every business from the very beginning and throughout the data processing cycle.

In this regard, the GDPR expressly requires compliance with two types of principles: data protection by design and data protection by default.

The former type means incorporating privacy into the architecture of the products (manufacturing/production) and service processes (offering, after-sales, maintenance, etc.) by, for example, minimizing the processing of personal data from the beginning to the end of a process. For instance, if the purpose for application developers can be achieved using aggregated data, accessing raw data should be avoided. It also means that organizations should ensure that the relevant expertise is available at the earliest possible stage, and not only later on to resolve any privacy issues that have arisen.

The latter type of principle means that organizations must implement mechanisms to ensure that, by default, only the minimum and necessary personal data for each specific purpose is processed, and the data are not disclosed more than necessary.

For instance, default settings of social media applications should ask users to review, edit, and decide on information generated by their device before they are published on social media platforms, while information that has been published should, by default, not become public or be indexed by search engines.

How these principles will be enforced is not clear yet. However, it is clear that the DPAs will require from the organizations concerned that they provide records and documentation demonstrating their compliance therewith, subject to penalty.

Organizations are indeed encouraged to certify their data processing with a supervisory authority or an approved certification body. A certificate of a data processing, once granted, is valid for up to 3 years (renewable) and is recorded in a public register so that data subjects can quickly assess the level of data protection provided by these organizations. More details on this will follow before the GDPR enters into force.

To read more about this series of articles (and the articles that were published previously), please click here.

 

Team

Related news

02.04.2020 NL law
Stibbe in Amsterdam answers questions from consumers, small business foundations and NGOs about the coronavirus

Inside Stibbe - In a special Q&A (in Dutch), lawyers from our Amsterdam office share their legal expertise and strive to provide answers to questions put to us by consumers, self-employed persons, enterprises large and small, foundations and NGOs as a result of the corona crisis.

Read more

18.03.2020 EU law
Stibbe: COVID-19

Short Reads - In view of the developments concerning the coronavirus, we hereby inform you of our business operations and the measures we take to ensure the continuity of our services to you.

Read more

12.03.2020 EU law
Stibbe sets up corona team

Inside Stibbe - The coronavirus (COVID-19) may have legal consequences for your business. We have set up a team of specialists who can provide insight into the legal implications of the virus.

Read more

10.03.2020 NL law
De AVG staat niet in de weg aan de verwerking van persoonsgegevens door een toezichthouder tijdens een bedrijfsbezoek

Short Reads - Bedrijven die met toezicht worden geconfronteerd, zijn gehouden op verzoek van een toezichthouder in beginsel alle informatie te verstrekken. Met de komst van de Algemene verordening gegevensbescherming (AVG) is in de praktijk de vraag opgekomen of een toezichthouder bevoegd is om persoonsgegevens die onderdeel uitmaken van de gevraagde informatie te verwerken.

Read more

This website uses cookies. Some of these cookies are essential for the technical functioning of our website and you cannot disable these cookies if you want to read our website. We also use functional cookies to ensure the website functions properly and analytical cookies to personalise content and to analyse our traffic. You can either accept or refuse these functional and analytical cookies.

Privacy – en cookieverklaring