Summary
Samenvatting GDPR regulation and law cluster 4 en 5
- Course
- Institution
A comprehensive summary with examples of cluster 4 and 5 of the course regulation and law at tilburg university.
[Show more]
Seller
Follow
robinvanheesch1
Reviews received
Content preview
Samenvatting regulation and law final exam.Readings week 4
3. Key principles of European data protection law.
Article 5 of the general data protection regulation (GDPR) sets out the principles governing the
processing of personnel data. These principles cover:
- Lawfulness, fairness, and transparency.
- Purpose limitation.
- Data minimization.
- Data accuracy.
- Storage limitation.
- Integrity and confidentiality.
Any exemptions from and restrictions to these key principles may be provided for at EU level or national
level; they must be provided for by law, purse a legitimate aim and be necessary and proportionate
measures in a democratic society. All three conditions must be fulfilled!
3.1 The lawfulness, fairness, and transparency of processing principles.
3.1.1 Lawfulness of processing.
EU and CoE data protection laws require personnel data to be processed lawfully. Lawful processing
requires the consent of the data subject or another legitimate ground provided in the data protection
legislation. Article 6(1) of the GDPR includes five lawful grounds for processing, in addition to consent.
3.1.2. Fairness of processing.
In addition to lawful processing, EU and CoE data protection laws require personal data to be processed
fairly. The principle of fair processing governs primarily the relationship between the controller and the
data subject.
Controllers should notify data subjects and the general public that they will process data in a lawful and
transparent manner and must also be able to demonstrate the compliance of processing operations with
the GDPR. Processing operations must not be performed in secret and data subjects should be aware of
potential risks. Furthermore, controllers, so far a s possible, must act in a way which promptly complies
with the wishes of the data subject, especially where his or her consent forms the legal basis or the data
processing.
In relation to internet services, the features of data processing systems must make it possible for data
subjects to really understand what is happening with their data in any case, the principle of fairness goes
beyond transparency obligations, and could also be linked to processing personal data in an ethical
manner.
3.1.3 Transparency of processing.
EU and CoE data protection laws require personnel data processing to be done ‘in a transparent manner
in relation to the data subject’. This principle establishes an obligation for the controller to take any
appropriate measure in order to keep the data subjects (users, customers of clients) informed about how
,their data are being used. Transparency may refer to the information given to the individual before the
processing starts, the information that should be readily accessible to data subjects during the
processing, but also to the information given to data subjects following a request of access to their own
data.
Processing operations must be explained to the data subjects in an easily accessible way which ensures
that they understand what will happen tot heir data. this means that the specific purpose of processing
personal data must be known by the data subject at the time of the collection of personal data.
CoE law also specifies that certain essential information has to be compulsory provided in a proactive
manner by the controller to the data subjects.
Pursuant to the right of access, a data subject has the right to be told by a controller at his/her request if
his/er data are being processed, and, if so, which data are subject to such processing. Additionally,
pursuant to the right of information, the persons who’s data are processed, must be informed by
controllers or processors pro-actively about the purposes, length, means of processing, among other
details, in principle before the processing activity starts. In certain situations, derogations are allowed
from the obligations to inform data subjects about data processing.
3.2 The principles of purpose limitations
The principle of purpose limitations is one of the fundamental principles of European data protection
law. It is strongly connected with transparency, predictability and user control. If the purpose of
processing is sufficiently and clear, individuals know what to expect and transparency and legal certainty
are enhanced at the same time, clear delineation of the purpose is important to ensure data subjects to
effectively exercise their rights, such as the right to object to processing.
The principles require that any processing of personal data must be done for a specific, well-defined
purpose and only for additional purposes that are compatible with the original purpose.
When considering the scope and limits of a particular purpose, modernized convention 108 and the
general data protection regulation rely on the concepts of compatibility: the use of data for compatible
purposes is allowed on the grounds of the initial legal basis. Further processing of the data may not,
therefore, be done in a way that is unexpected, inappropriate or objectionable for the data subject.
To assess whether the further processing is to be considered compatible, the controller should take the
following into account (among other things):
- Any link between those purposes and the purposes of the intended further processing;
- The context in which the personal data have been collected in particular concerning the
reasonable expectations of data subjects based on their relationship with the controller on its
further use.
- The nature of the personal data.
- The consequences of the intended further processing for data subjects.
- The existence of appropriate safeguards in both the original and intended further processing
operations.
Further processing for archiving purposes in the public interest, scientific or historical research purposes
or statistical purposes is a priori considered compatible with the initial purpose. When undertaking
, further processing, the data subject should be informed of the purposes, as well as of his or her rights,
such as the right to object.
3.3 The data minimization principle.
The categories of data chosen for processing must be necessary in order to achieve the declared overall
aim of the processing operations, and a controller should strictly limit collection of data to such info as is
directly relevant for the specific purposes pursued by the processing. Furthermore, by making use of
special privacy-enhancing technology, it is sometimes possible to avoid using personal data at all, or to
use measures to reduce the ability to attribute data to a data subject, which results in a privacy friendly
solution.
Article 5(1) of modernized convention 108 contains a proportionality requirement for processing
personal data in relation to the legitimate purpose pursued. There must be a fair balance between all
interests concerned at all stages of the processing. This means that personal data which is adequate and
relevant but would entail a disproportional interference in the fundamental rights and freedoms at stake
should be considered as excessive.
3.4 The data accuracy principle.
A controller holding personal information shall not use that information without taking steps to ensure
with reasonable certainty that the data are accurate and up to date. The obligation to ensure accuracy of
data must be seen in context of the purpose of data processing.
There may also be cases where updating stored data is legally prohibited, because the purpose of storing
data is principally to document events as a historical ‘snap-shot’. On the other hand, there are situations
where it is absolute necessity to update and regularly check the accuracy of data, due to potentials
damage which might be caused to the data subject if data were to remain inaccurate.
3.5 The storage limitation principle.
Art. 5 of the GDPR require personal data to be ‘kept in a form which permits identification of data
subjects for no longer than is necessary for the purposes for which the data are processed’. The data
must therefore be erased or anonymized when those purposes have been served. To this end, time limits
should be established by the controller for ensure or for periodic review. To make sure that the data are
kept for no longer than is necessary.
The time limitation for storing personal data only applies to data kept in a form which permits
identification of data subjects. Lawful storage of data which are no longer needed could, therefore, be
achieved by anonymizing data.
Modernized convention 108 also permits exceptions to the principle of storage limitation, on the
condition that they are provided by law, respect to the essence of fundamental rights and freedoms, and
are necessary and proportion for pursuing a limited number of legitimate aims.
5.6 The data security principle.
The principle of data security requires that appropriate technical or organizational measures are
implemented when processing personal data to protect the data against accidental, unauthorized or
unlawful access, us, modification, disclosure, loss, destruction, or damage.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller robinvanheesch1. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $6.96. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
72042 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now