What is the GDPR?
The term GDPR stands for General Data Protection Regulations. The law is drawn up by the European Union to strengthen the data rights of EU residents. The objective was to complement the data protection law across all member states by making it identical.
The basic objective of law was to make it easier for the people …
1. Discover what information organizations collect about them
2. What those organizations use it for
3. Empowering people to prevent unnecessary data collection
4. Penalizing organizations for misuse of collected data
It also makes it easier and cheaper for the organizations to comply with data protection guidelines. It is also interesting to note that GDPR is regulation and not a directive, therefore, it applies automatically without turning it into the law.
Why was the GDPR drafted?
We all enjoy lots of free stuff from likes of Google, Facebook, Twitter etc. in exchange for a wide range of personal information – name, gender, geography, email address, mobile number, political learnings and many more. Confusing terms and conditions and passive opt-out boxes made it difficult for people to understand what exactly they were agreeing to give to these tech giants.
We all have seen the misuse of user data by Facebook’s Cambridge Analytica Scandal during 2016 US elections where a third party app saw millions of users’ profile data scrapped allegedly to influence the outcome of the elections.
Jurisdiction of Regulation
It applies to almost every organization that controls or processes personal data relating to people residing in EU. Even organizations that don’t have any base in EU will be bound by GDPR if they are processing, collecting or holding data of users based in EU. As per GDPR regulation, any organization involved in the collection or processing of data will be considered as the data controller or data processor.
The Data controllers and Processors?
The data collector could be an organization that is collecting data itself or might contract a third party to collect and process data. The data processor is the third party that collects and process the actual data based on the instruction from the data controller, therefore, its controller’s responsibility to make sure that the processor complies with data protection law. If processor breaches GDPR, the controller will be liable for financial penalties as per the regulations of GDPR.
The process and Consent under the GDPR?
As per regulation, the Controller must make sure that personal data is processed lawfully, transparently, and for a specific purpose. The user must understand: why their data is being processed and how it is being processed.
The consent needs to be active, affirmative action by the data subject, rather than the passive acceptance under current models that allows for pre-ticked boxes or opt-outs. It is the responsibility of data collector to keep a record of how and when an individual gave consent and that individual may withdraw their consent whenever he or she wishes to.
Personal Data under GDPR
Under the GDPR, the expanded definition of data now covers IP address, Economic, Cultural, Pseudonymised personal data (depends upon factor – how easy or hard it is to identify whose data it is) or health information of the individual apart from other parameters (As defined under the data protection act).
When can people access the stored data?
The regulation empowers People to access any information a company holds on them and can access their data at reasonable intervals. The controller needs to respond within a months’ time. The individual also gets right to ask …
1. Why data is being processed
2. How long it’s stored for
3. Who gets to see it
4. An individual can correct incomplete or incorrect data about them
It is the responsibility of controller to provide secure, direct access for people to review the data which controller has stored about the individual.
Comments
Post a Comment