GDPR?is currently viewed as the biggest change to data protection in 20 years, and not being legally compliant will end in substantial?fines. Depending on the level of a breach, fines can be up to ?20,000,000 or four per cent of the total annual global turnover based on the preceding financial year. And we?re all aware of the effects on PR for those organisations who have recently been in breach of the data protection provisions. So who will the GDPR impact? The regulations will apply to businesses who fall into two categories: controllers and processors. Similar to the UK Data Protection Act (DPA), controllers dictate how and why personal data is processed, and processors act on behalf of the controller?s e.g. an employer may be the controller (and possibly a processor as well) who uses an external payroll service provider (the processor). The GDPR will place specific legal obligations and liabilities on processors. For example, these businesses will need to maintain records of personal data and processing activities. More obligations will also be placed on controllers so they will need to ensure that contracts with processors comply with the new legislation and provide adequate rights e.g. to audit and indemnities. Whilst the principles of responsibility for handling personal data are similar to the DPA, there are some additional requirements that bosses need to be aware of to ensure they truly are legally compliant ??the most significant of which being individual company accountability. Take HR files for example. Managers need to be aware that the GDPR will apply to personal data held about employees and contractors. Any data that can be used to identify a person, whether that?s gender, culture, mental health, even IP addresses are all data that is considered to be personal. This broader definition of data also includes sensitive personal data such as genetic and biometric data that can be used to identify someone. Another significant development of the GDPR involves the issue of consent, specifically where it validates the use of personal data. Bosses need to ensure that they?re clear when seeking consent with detailed information explaining how they plan on using the data. It?s important to note that a person?s silence or inactivity will no longer be considered as valid consent ? this is crucial if you want to be legally compliant. As a business, that means obtaining physical approval to hold or process the individual?s data for stated reasons unless specific exceptions apply. To ensure that your business is legally compliant GDPR here?s our top five things to consider: 1) Appoint a data protection officer. Under the new legislation some businesses will be required to have one. This includes public authorities and those whose core activities require regular data monitoring or are processing special category data. 2) Is your privacy protected? Measures such as Privacy Impact Assessments (PIAs) are essential. As controllers, PIAs will assess where privacy risks exist and how to minimise them. 3) Are you ready for a data breach? It?s important that your business has appropriate training and systems in place that will manage a breach and comply with notification requirements set out by the GDPR. This includes a requirement to notify your local data protection authority within 72 hours of discovering a data breach. 4) Can you apply the right to be forgotten? Ensuring your business complies with the right to be forgotten if the data subject requests is vital. 5) Have a clear policy and train staff on holding and storing data. Businesses need to ensure that they comply with the more restrictive principles of not holding data longer than necessary and to not change the use of this data from the original purpose specified. Whilst it might seem as though you have plenty of time, the reality is that a lot has to be done between now and May 2018. Controllers and processors need to understand what personal data they hold and how it?s being used. Make sure your business is protecting privacy by design internally and externally and that contractual provisions are in place that will ensure compliance and that adequate indemnities exist.
Stephen Foster?is partner in the HR and?employment team at SAS Daniels
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
