Short Reads

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

Stibbe - Will data controllers be required to maintain records

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

26.04.2018 EU law

Only 4 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will data controllers be required to maintain ​r​ecords of ​processing activities in all cases?

The GDPR requires each controller to keep a record of processing activities under its responsibility, and each processor to keep a record of the processing activities that it has carried out on behalf of a controller​​. However, these obligations do not apply if the controller or the processor is an enterprise or an organization employing fewer than 250 persons, unless the processing it carries out:

- is likely to result in a risk to the rights and freedoms of data subjects and is not occasional, or

- includes sensitive​ data, i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (Article 9​ of the GDPR), ​or data relating to criminal convictions and offences (Article 10​ of the GDPR).

​The rationale for these exceptions is that ​small and medium-sized enterprises and organizations that do not carry out risky processing should be exempt from the requirement to keep a record of its processing activities.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

20.09.2022 EU law
Launch of Metaverse blog series

Articles - Stibbe launches a new blog series focusing on the legal challenges of the Metaverse. In our upcoming blog posts, we will discuss the legal challenges of NFTs, crypto-assets, Metaverse platforms, crypto exchanges, DAO, and many more.

Read more

28.07.2022 NL law
Zuiver commercieel belang ook gerechtvaardigd belang: Raad van State laat zich er niet over uit

Short Reads - Op 27 juli 2022 heeft de Raad van State bevestigd dat de Autoriteit Persoonsgegevens onterecht een boete van € 575.000 aan VoetbalTV heeft opgelegd. De hoop bestond dat de Afdeling antwoord zou geven op de vraag of de AP terecht of onterecht meent dat een zuiver commercieel belang géén gerechtvaardigd belang kan zijn in de zin van de Algemene Verordening Gegevensbescherming. Het antwoord op deze vraag blijft echter uit.  

Read more

28.07.2022 NL law
Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

Short Reads - On 27 July 2022, the Council of State confirmed that the Dutch Data Protection Authority wrongly imposed a €575,000 fine on VoetbalTV. But the Council did not answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation.

Read more