GDPR

GDPR is a European regulation on personal data protection that came into effect on 25 May 2018.  

The way organisations handle customer data has been regulated for years. GDPR brought this bang up to date as a lot has changed since the ’90s. We now access and process data in many ways.  

Organisations need to ensure that they have robust measures in place and as above, they need to ensure all staff are fully trained. They also need to appoint a Data Controller who must be notified of all instances that constitute a data breach.  

GDPR is regulated by the Information Commissioner’s Office.  

The Information Commissioner’s Office    

The Information Commissioner’s Office (ICO) is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.  

Part of its role is to improve information rights practices by gathering and dealing with concerns raised by members of the public. It is also responsible for overseeing the May 2018 implementation of the new General Data Protection Regulation (GDPR) in the UK.  

There are 7 Principles to the GDPR:    

The Lawful Basis for Processing  

There are 6 lawful purposes contained within the GDPR for processing personal information, and at least 1 of these must apply when processing someone’s data.  

The 6 lawful bases are:   

1. Consent: the individual has given clear consent for you to process their personal data for a specific purpose   

2. Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract   

3. Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations)   

4. Vital interests: the processing is necessary to protect the vital interests of another data subject or living person, e.g. to save their life  

5. Public task: the processing is necessary for you to perform a task in the public interest or to exercise an official duty   

6. Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data that overrides those legitimate interests (this cannot apply if you are a public authority processing data to perform your official tasks)  

Rights of Individuals   

The GDPR also sets out 8 rights that individuals have, which are:   

1. The right to be informed   
2. The right to access   
3. The right to rectification   
4. The right to erasure  
5. The right to restrict processing   
6. The right to data portability   
7. The right to object   
8. Rights concerning automated decision-making and profiling   

Individuals can see what data organisations hold on them at any time by applying for a subject access request (SAR).  

Breaches in GDPR  

When an organisation breaches GDPR it can be faced with one of the following consequences based on the severity of its actions.  

Personal data breaches can include:    

• access by an unauthorised third party.  
• deliberate or accidental action (or inaction) by a controller or processor.  
• sending personal data to an incorrect recipient.  
• computing devices containing personal data being lost or stolen.  
• alteration of personal data without permission  
• loss of availability of personal data.  

The EU GDPR (General Data Protection Regulation) sets a maximum fine of €20 million (about £18 million) or 4% of annual global turnover – whichever is greater – for infringements.  

(After the Brexit transition period ends on 31 December 2020, the UK GDPR and DPA (Data Protection Act) 2018 will mandate a maximum fine of £17.5 million or 4% of annual global turnover.)    

However, not all GDPR infringements lead to data protection fines. Supervisory authorities such as the UK’s ICO (Information Commissioner’s Office) can take a range of other actions, including:    

• Issuing warnings and reprimands.  
• Imposing a temporary or permanent ban on data processing.  
• Ordering the rectification, restriction, or removal of data; and    
• Suspending data transfers to third parties.  

A breach or even the allegation of a large breach of GDPR can harm an organisation. A breach can damage an organisation’s reputation and brand and, depending on the size of the fine, a breach could see the organisation go out of business.  

There are also negative repercussions for the customer whose data has been compromised. It is therefore vital that employees understand their responsibilities under the GPDR.  

All of the above information was taken from the official government website. You can Read up on everything you need to know about GDPR here – https://ico.org.uk/for-organisations/guide-to-data-protection/    

Your GDPR Responsibility  

Your organisation will put policies and procedures in place that set out how you collect, store, record, use and share customer data. Read your policies and procedures to ensure you follow them. Here are some common employee responsibilities under GDPR:  

• Lock your computer screen when away from your desk  
• Keep hard copies of customer data locked away when not in use  
• Make sure personal data is correctly destroyed  
• Keep a “clear desk” free of unnecessary paperwork and documents  
• Password protect electronic documents and label them correctly