1. Data protection reform:
GDPR for the Advice sector
22 August 2017
Shauna Dunlop
NI Regional Manager
Paula McGahey
Lead Policy Officer

2. General Data Protection Regulation 25th May 2018

3. New challenges such as…
Technological developments

4. Consistent data protection framework
Requires a…
Consistent data protection framework

5. Enhanced rights for individuals
Together with…
Enhanced rights for individuals

6. Greater accountability & transparency
Leading to…
Greater accountability & transparency

7. “While we should all be assured that data is well protected in the UK, change is needed. The technology, and society has changed.” “The Data Protection Bill will allow the UK to continue to set the gold standard on data protection.” Matt Hancock MP Minister of State for Digital DCMS Statement of Intent August 2017

8. ?
What’s in it for us?

9. Doing good Accountability Putting citizens first Transparency Being responsible Equality Making voices heard Good governance Empowerment

10. GDPR Overview

11. What information is protected?
Personal data
Sensitive personal data/
Special categories

12. Who must comply?
Data controllers
Data processors

13. The Principles

15. A
is for…
Accountability

16. The Accountability Principle
The controller shall be responsible for, and be able to demonstrate compliance

17. Accountability & Governance
Records of processing activities
Data protection by design and by default
Data protection impact assessments
Data protection officer
Codes of conduct and certification

18. Privacy notices

19. Children
Privacy notices for children must be written in a clear, plain way
Consent from parent or guardian if you offer an ‘information society service’

20. Lawful processing

21. Legal bases (personal data)
Consent
Performance of a contract with the data subject
Legal obligation
Vital interests of a data subject or another person
Performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Legitimate interests

22. What is Consent? DPA PECR
…any freely-given, specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.
Article 2(h) Directive EC/95/46
The [recipient] has previously notified the [caller or sender] that he consents for the time being to such communications being sent by, or at the instigation of, the [caller or sender]
Regulations 19,21&22 PECR 2003

23. How will it change… GDPR
…any freely-given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Article 4(11) GDPR

24. GDPR Consent at a glance
Higher standard Genuine choice & control Positive opt-in Clear and specific Easy to withdraw Evidence of consent

25. Enhanced rights for individuals

26. Individuals' rights The right to be informed The right of access The right to rectification The right to erasure The right to restrict processing The right to data portability The right to object Rights related to automated decision-making and profiling
Individuals' rights The right to be informed The right of access The right to rectification The right to erasure The right to restrict processing The right to data portability The right to object Rights related to automated decision-making and profiling

27. Breach reporting Mandatory reporting Within 72 hours
Notify individuals concerned

28. Administrative fines Lower Tier Higher Tier €10,000,000 €20,000,000 OR
2% turnover
€20,000,000 OR
4% turnover

29. Are we ready for the new world of data protection?

31. Self assessment toolkit www. ico. org
Self assessment toolkit

32. ICO Guidance: GDPR Overview Steps Privacy Notice CoP ICO Next Steps: Contracts and liability Consent Article 29 WG Guidance: Data portability Lead supervisory authorities Data protection officers Article 29 WG Next steps: Consent Transparency Profiling High risk processing Certification Administrative fines Breach notification Data transfers

33. Case studies

34. Questions?

35.
www. ico.org.uk/for-organisations/data-protection-reform/