SLIDE 3 How GDPR will affect LSBU?
- Accountability – documentation / evidence
- Stronger Rights for Individuals
– Right to be forgotten – Portability – Profiling
- Key changes on Access rights
– Timing – one month; prohibition on charging – Includes information about international transfers, logic of auto-decision making
- Liability and compensation
– Data subject can make claims to controller or processor – Could pursue whichever has ‘deeper pockets’ – Compensation for financial and non financial loss – Processor can avoid liability if it has complied with its GDPR obligations and controller instructions – If both controller and processor responsible for damage- jointly liable; can seek to recover from each other
- Data Security / Data breaches
– Mandatory breach reporting within 72hr unless unlikely to result in risk to individuals; notification to individuals when likely to result in high risk – Anonymisation and pseudonymisation
- Penalties- €10/20MM, no reduced scale for public
authorities
- Data Protection Officer – defined duties
- Privacy notices – clear, plain, expanded
- Lawfulness of processing- more restrictive
application. – Consent- Alumni, marketing, legacy data – Legitimate interest – no longer for public authorities – Performance of contract – must be necessary – Legal obligations (e.g. HESA, HEFCE) – Public interest – may cover limited data sharing e.g. voluntary cooperation with police investigation – Vital interests
- Privacy by design / Impact Assessments
- Data minimisation – limited to what is necessary (‘not
excessive’ removed), built into the concept of privacy by design
- New obligations on controllers AND
processors
– Controller must impose specific duties on processors in contracts and be clearer about processing (info similar to that included within EU Model Clause Appendix) – Care required in determining whether processor or controller – joint liability risk
2
