1. Public Sector Organisations - are you GDPR ready?
Data Protection Practitioners’ Conference 2018
#DPPC2018

2. Are we a public authority?
Public authority is not defined in the GDPR. It will be defined in the Data Protection Act 2018 (when passed)
It is likely that if you are a public authority as defined under the Freedom of Information Act 2000 or Freedom of Information (Scotland) Act 2002), you will be a public authority for the purposes of the GDPR
Data Protection Practitioners’ Conference 2018
#DPPC2018

3. What lawful bases should we use?
Consent: the individual has given clear consent for you to process their personal data for a specific purpose
Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract
Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations)
Vital interests: the processing is necessary to protect someone’s life
Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law
Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests
Data Protection Practitioners’ Conference 2018
#DPPC2018

4. What lawful bases should we use?
The six lawful bases for processing are broadly similar to the old conditions for processing, although there are some differences
You need to review your existing processing, identify the most appropriate lawful basis, and check that it applies
Once you have identified your lawful basis, you must document it and update your privacy notice to explain it
Documenting your lawful basis will help you comply with the GDPR’s ‘accountability’ requirements
Data Protection Practitioners’ Conference 2018
#DPPC2018

5. Public task? #DPPC2018 Data Protection Practitioners’ Conference 2018
One of the differences between the old conditions for processing and new lawful bases is that public authorities now need to consider the new ‘public task’ basis for most processing
The ‘public task’ basis can apply where the processing is necessary for you to perform a task in the public interest or in the exercise of your official authority (for example a public body’s tasks, functions or powers)
There must be a clear basis in law for the relevant task or function
It is most relevant to public authorities, but it can apply to any organisation that exercises official authority or carries out tasks in the public interest
Data Protection Practitioners’ Conference 2018
#DPPC2018

6. Consent or legitimate interest?
In many circumstances consent may not be the most appropriate lawful basis. You should always choose the lawful basis that most closely reflects the true nature of your relationship with the individual and the purpose of the processing. If consent is difficult, this is often because another lawful basis is more appropriate, so you should consider the alternatives
If you are a public authority, you cannot rely on legitimate interests for any processing you do to perform your tasks as a public authority
However, if you have other legitimate purposes outside the scope of your tasks as a public authority, you can consider legitimate interests where appropriate
You need to review your existing processing, identify the most appropriate lawful basis, and check that it applies. More information can be found in our lawful basis section of our Guide to GDPR
Data Protection Practitioners’ Conference 2018
#DPPC2018

7. Consent or legitimate interest?
For example:
Universities and museums are likely to be classified as public authorities, so the ‘public task’ basis is likely to apply to much of their processing
But where they are processing personal data separate from their tasks as a public authority, then they may instead wish to consider whether either the lawful basis of consent or that of legitimate interests is appropriate
These bases could apply, for example, where they are processing personal data for alumni relations or for fundraising purposes
There are other lawful bases which could also be relevant. For more information see the lawful basis section of our Guide to GDPR
Data Protection Practitioners’ Conference 2018
#DPPC2018

8. Do we need to appoint a DPO?
Public authorities must appoint a DPO (except for courts acting in their judicial capacity)
You will need to provide the ICO with the contact details of your DPO when you pay your fee
Data Protection Practitioners’ Conference 2018
#DPPC2018

9. Can organisations share a DPO?
Yes, you may appoint a single DPO to act for a group of public authorities, taking into account their size and structure
However, you must ensure that the DPO is still able to perform their tasks effectively and is easily accessible
Data Protection Practitioners’ Conference 2018
#DPPC2018

10. Special categories of personal data
“Special Category Data” under the GDPR is broadly similar to the concept of “Sensitive Personal Data” under the DPA 1998
It is personal data which is more sensitive, and so needs more protection
The special categories have been expanded to include genetic data and biometric data where it is processed to uniquely identify an individual
Data Protection Practitioners’ Conference 2018
#DPPC2018

11. Special categories of personal data
Race or ethnicity
Political opinions
Religious or philosophical beliefs
Trade union membership
Physical or mental health
Sexual life or orientation
Genetic or biometric
Data Protection Practitioners’ Conference 2018
#DPPC2018

12. Special categories of personal data
Under GDPR if you are processing special category data you must have a lawful basis for processing under Article 6 (as you would for other personal data) but you must also satisfy a condition under Article 9:
Explicit consent
Employment law
Vital interests of anyone
Not-for-profit TU/religious/ political/philosophical groups
Already in public domain
Legal proceedings/advice
Substantial public interest
Medical purposes
Public Health
Archiving in public interest, scientific/historical research purposes or statistical purposes
Data Protection Practitioners’ Conference 2018
#DPPC2018

13. Criminal offence data #DPPC2018
The GDPR rules for special category data do not apply to information about criminal allegations, proceedings or convictions
Instead, there are separate safeguards for personal data relating to criminal convictions and offences, or related security measures, set out in Article 10
To process such data, you must have both a legal basis under Article 6 and either legal authority or official authority for the processing under Article 10
Article 10 also specifies that you can only keep a comprehensive register of criminal convictions if you are doing so under the control of official authority
Data Protection Practitioners’ Conference 2018
#DPPC2018

14. Data sharing agreements under GDPR
If you have an existing data sharing agreement, and this agreement complies with the Data Protection Act 1998, it is likely you can still share data under the GDPR. You should still review any existing agreements to ensure that any data sharing is fair and transparent and complies with the requirements of GDPR
A data protection impact assessment (DPIA) may need to be carried out for any new or revised data sharing, especially if you are using new technologies and the processing is likely to result in a high risk to the rights and freedoms of individuals
You should also be aware that GDPR contains explicit provisions about documenting processing activities, including maintaining records on data sharing. There is a limited exemption for small and medium-sized organisations
Data Protection Practitioners’ Conference 2018
#DPPC2018

15. What rights will exist under GDPR?
Be informed
Access
Rectification
Erasure
Restrict processing
Data portability
Object
ADM/Profiling
Data Protection Practitioners’ Conference 2018
#DPPC2018

16. Right to be informed #DPPC2018
Individuals have the right to receive privacy information such as:
How their data will be processed
Who it will be shared with
What their rights are with respect to it
The information you supply must be:
Concise, transparent, intelligible and easily accessible
Written in clear and plain language, particularly if addressed to a child AND
Provided free of charge
Data Protection Practitioners’ Conference 2018
#DPPC2018

17. Right of access #DPPC2018 Individuals have the right to:
Have confirmation that their data is being processed
Be aware of and verify the lawfulness of the processing
Request access to their personal data
You must:
Take reasonable steps to verify the identity of the requestor
Comply with such requests within 1 calendar month
Provide data free of charge
Data Protection Practitioners’ Conference 2018
#DPPC2018

18. Right of access
You may charge a reasonable fee or refuse to respond when a request is manifestly unfounded or excessive, particularly if it is repetitive
Where you refuse a request, you must explain why to the individual, informing them of their right to complain to the ICO and to a judicial remedy without undue delay and at the latest within one month
The fee must be based on the administrative costs of providing the information
If a request is made electronically, you should provide the information in a commonly used electronic format
It would be considered best practice, where possible, to provide remote access to a secure self-service system which would provide individuals with direct access to his or her information
Where you process a large quantity of information, the GDPR permits you to ask the individual to specify the information that the request relates to
Data Protection Practitioners’ Conference 2018
#DPPC2018

19. Right to rectification
Individuals have the right to:
Their personal data being accurate
Request inaccurate data be corrected and incomplete data completed
You must:
Correct inaccurate matters of fact and confirm rectification
Inform recipients of incorrect data of the rectification
Inform the data subject if you are not amending the record and why
Data Protection Practitioners’ Conference 2018
#DPPC2018

20. Right to erasure
Individuals have the right to erasure if:
Personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
Individuals withdraw consent
Their data has been unlawfully processed
There is legal obligation to erase
The data was added to social media when the individual was a child
You must:
Comply with the request unless you have a legal obligation to continue processing the data
Take steps to inform any other processors of the data subject’s request for erasure if personal data has been made public
Data Protection Practitioners’ Conference 2018
#DPPC2018

21. Right to restrict processing
Individuals can request:
Restriction of processing until an accuracy claim is verified
Retention of unlawfully processed data
Retention of data for exercise or defence of legal claims
You must:
Take steps to ensure the restriction as requested
Inform the data subject if data processing will recommence and why
Data Protection Practitioners’ Conference 2018
#DPPC2018

22. Right to data portability
Individuals have the right to:
Receive their personal data in a structured, commonly used and machine readable format.
Transmit their data to another controller without hindrance.
This right only applies if:
The individual has provided you with their personal data
The data is processed by consent or a contract AND
Processing is carried out by automated means
This right does not apply when the data processing is necessary for the performance of a task carried out in the public interest or in the exercise of your official authority. However, it may be good practice to provide for portability regardless
Data Protection Practitioners’ Conference 2018
#DPPC2018

23. Right to object
Individuals have the right to object to:
Processing for direct marketing
Processing if done in the public interest or for your legitimate interests, including profiling
You must:
Comply immediately if you are direct marketing! No exemptions!
For public and legitimate interests, comply unless you can demonstrate legitimate ground for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims
Data Protection Practitioners’ Conference 2018
#DPPC2018

24. Rights in relation to ADM including profiling
Under Article 22, individuals have the right not to be subject to a decision when:
It is based solely on automated processing, including profiling AND
It produces a legal or similarly significant effect on the individual
You must identify whether any of your processing falls under Article 22 and, if so, make sure that you:
Give individuals information about the processing
Introduce simple ways to request human intervention or challenge a decision
Carry out regular checks to make sure that your system works as intended
Data Protection Practitioners’ Conference 2018
#DPPC2018

25. What rights will exist under GDPR?
Your obligation to uphold these individual rights may vary depending on the lawful basis you are relying on
For example, individuals’ rights to erasure and data portability do not apply where you are processing on the basis of ‘public task’ but individuals will have a right to object
Please see the Individual Rights section of our Guide to the GDPR for further information
Data Protection Practitioners’ Conference 2018
#DPPC2018

26. Accountability under GDPR
The GDPR’s accountability principle (Article 5(2)) requires you to be able to demonstrate how you comply with the data protection principles
This can be demonstrated by having effective policies and procedures in place such as:
Processing data in a transparent manner
Maintaining records of processing
Appointing a DPO
Carrying out DPIAs
Data Protection Practitioners’ Conference 2018
#DPPC2018

27. Transparency under GDPR
The first principle of the GDPR requires you to process data in a transparent manner in relation to the data subject (Article 5(1)(a))
The GDPR emphasises the need for transparency over how you use personal data. This can be achieved by providing individuals with privacy information (typically through a privacy notice) such as how their data will be processed, who it will be shared with and what their rights are with respect to it (Article 13 and 14)
If individuals know this information from the outset, they will be able to make informed decisions in relation to their personal data
Any information you supply relating to the processing of personal data should be easily accessible, easy to understand and written in clear and plain language
Data Protection Practitioners’ Conference 2018
#DPPC2018

28. Security under GDPR #DPPC2018
Personal data must be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).”
You are required to implement appropriate technical, organisational and security measures to ensure and be able to demonstrate that processing is performed in accordance with the GDPR. This may include:
Staff training
Internal audits
Pseudonymisation and encryption
A process for regularly testing, assessing and evaluating measures
Breach Management
Data Protection Practitioners’ Conference 2018
#DPPC2018

29. Breach reporting #DPPC2018 Notify ICO:
Not later than 72 hours (Can add detail later)
Where likely to result in a risk to rights and freedoms of individuals
Notify data subject:
Without undue delay
Where likely to result in a high risk to rights and freedoms of individuals
Data Protection Practitioners’ Conference 2018
#DPPC2018

30. Subscribe to our e-newsletter at www.ico.org.uk
Keep in touch
Subscribe to our e-newsletter at
or find us on…
/iconews
@iconews
Data Protection Practitioners’ Conference 2018
#DPPC2018