Understanding the GDPR: General Data Protection Regulation

There is a slight bit of confusion when it comes to just who falls under the protective auspices of the GDPR measure. The term “natural person” appears frequently throughout the text, and while this indeed refers to EU citizens, it actually extends further to those merely residing in the EU. To wit, a natural person in EU nomenclature is any human possessing “legal personality”. That’s a very law-like definition that essentially boils down to a person who acts on their own behalf rather than in the interests of a business entity (sometimes known as a “legal entity”) or a government entity (or “public entity”).

To simplify matters, all humans native to or residing inside the EU with data to protect are blanketed under the term “data subject”. The rights of these data subjects to control and even extensively delete their private data is at the heart of the GDPR.

The GDPR defines personal data quite simply: Information (“data”) that can be used to identify a natural person (“data subject”). This seems self-evident on its surface, and indeed, certain identity-related elements fall naturally within this definition, such as name, ID number, home address, and more. But in the current era of sophisticated online data tracking technology, the amount of transmittable, personally identifiable data has ballooned (at least in the EU’s opinion), and with it, the number of privacy touch points potentially available to corporate and government bodies.

This massive list includes, but is not limited to, online identifiers such as IP addresses, social media accounts, email addresses, accounts numbers, browser cookies, and more. Constituent to this are direct identifiers and indirect identifiers, both of which establish the data subject’s identity by degrees. For instance, a direct identifier is a name, ID number, home address, and so on. Indirect identifiers include date of birth, location, or even title, and while they don’t pinpoint data subjects directly, they can nevertheless unmask a person’s identity when used in concert.

In short, sensitive personal data is more or less a subset of personal data. However, as the name implies, sensitive personal data is information that is not as objectively verified as standard personal data. For instance, a data subject’s home address or date of birth can be independently and objectively verified. Under the GDPR, this is personal data, but it’s not “sensitive”. Another way to think of sensitive data is as “privileged” information, i.e. data that must be communicated by the subject themselves.

Some examples of sensitive personal data include:

• Racial or ethnic origin
• Religious beliefs
• Genetic data
• Trade union membership
• Biometric data
• Health data
• Sexual orientation
• Data pertaining to the subject’s sex life

The GDPR’s aim is not to restrict the processing of personal data altogether, only to eliminate those instances where data might be processed without the full and clear consent of the data subject. In any respect, the GDPR dictates that data must be processed transparently and equitably at all times. This sounds simples on the surface, but unfortunately for the controllers handling personal data, there are a number of requisites in the GDPR that reveal the attendant difficulty involved.

At least one of the following requisites must be met for lawfully processing personal data:

• Direct consent from the data subject
• Execution of an agreed-upon contract or as a preliminary step thereof
• Legal compliance on the controller’s behalf
• Protection of the subject’s vital interests or those of another person
• Tasks performed in the public interest or as an extension of the controller’s official authority
• Tasks performed in the controller’s legitimate interests or that of a third party unless superseded by the rights and natural protections of the subject, especially children

While not exceedingly divergent from the above, the standards for lawfully processing sensitive personal data are nonetheless more tightly confined to at least one of the following (some of which are duplicated from personal data):

• Explicit consent of the subject
• Necessary for obligations to employment, social protection and social security laws, and collective agreements
• Protection of subject’s interests when subject is incapable of consent, whether physically or legally
• Processing of data belonging to members or former members of and by a not-for-profit entity with a political, philosophical, religious, or trade union affiliation; strictly prohibited from divulging said data to third parties
• Data made public by subject
• Necessary for legal claims
• Tasks performed in the public interest
• Administering preventative or occupational medicine, assessing subject’s working capacity, medical diagnosis, health or social care
• Public health as a public interest, including protection against cross-border health threats or to guarantee quality healthcare, medicine, or medical devices
• For purposes of data storage, inquiry, and statistics

According to GDPR lingo, a controller is the entity–natural person, legal entity, public agency, authority, or similar–that makes the decision on why personal data is being processed. They specify whose data will be collected, which categories of data to include, the length of time needed to store the data, and more. Not only that, but a controller determines if the data subject needs to be alerted that their personal data is about to be processed or if the subject’s consent is needed prior.

In that same vein, controllers are most often with whom data subjects will directly come in contact. As the public “face” of the data processing endeavor, controllers are the ones responsible for ensuring tight controls on how the subject’s information is managed. Aside from protecting the trust and privacy of the subject, the controller must ensure compliance with the GDPR at every turn.

But just as the data subject need not be an EU citizen, neither must the controller be based in the EU. Controllers can originate anywhere across the globe; so long as they engage in the processing of data for natural persons currently in the EU, they are bound by GDPR guidelines. The best examples of this come by way of social media giants such as Facebook and Twitter; search engines like Yahoo!, Bing, and Google; or retail outlets like Amazon, eBay, and more. Despite being headquartered within the US, these companies must regardless fulfill the requirements of the GDPR or risk non-compliance.

To make matters slightly more complicated, controllers not originating within the EU must designate a representative from inside the EU to help process data in a way that satisfies the GDPR. The representative accomplishes this by coordinating with that nation’s governmental body in charge of overseeing GDPR compliance, also known as the supervisory authority. It’s more or less a checks and balance system to prevent non-EU nations from roguish data processing.

While controllers oversee the whys and whats of personal data processing, processors are the entities designated by the controller to perform the processing itself. The processor may be a natural person, a legal entity, public agency, authority, or similar, and as with controllers, they may also originate outside the EU. No matter the location or the type of entity, the bottom line remains the same: as long as the processor is managing personal data belonging to a natural person within an EU member state, GDPR still applies.

Rather than micromanaging every processing-related task, controllers may choose to rely on the processor’s systems and data security. However, controllers are the ones ultimately responsible for making sure this happens.

Each member of the EU is required by GDPR to arrange a supervisory authority whose chief duty involves monitoring whether the regulation is being faithfully applied. The GDPR states in no uncertain terms that the regulation must be enforced consistently within every EU member state. To make this a reality, supervisory authorities are mandated to cooperate with one another when it comes to the free flow of data. Member nations are allowed to arrange for multiple supervisory authorities, but one must be chosen as a representative before the European Data Protection Board (EDPB). The same supervisory authority is also required to guarantee that the other supervisory authorities are following GDPR.

A Data Protection Officer (DPO) is required under GDPR rules to manage and implement an organization’s data protection policies. This applies to any entity that archives extreme levels of personal data. And it doesn’t necessarily apply only to customers or users; any organization with a significant data burden even for its own employees is obligated to elect a DPO. The definition of who constitutes a data subject are far-reaching in the GDPR.
Each DPO will be in charge of educating its parent entity from top to bottom in the requirements for satisfying the regulation. He or she also conducts training for staff members who are directly involved in processing personal data, routinely audit the organization’s data security, and recommend fixes accordingly. In addition, DPOs also liaison with supervisory authorities and enforce the entity’s compliance not only with the GDPR, but with member state laws as well.

Data subjects may interact with DPOs as their main point of contact, too. As the public “face” of the data processing operation, DPOs carry a host of responsibilities, all with the goal of remaining as open, transparent, and subject-focused as possible. These include:

• Inform subjects for which purposes their data is being processed
• Provide access to their data
• Explain the safeguards enacted by the company to secure their data
• Disclose the involvement of third parties
• Disclose the duration that their data will be archived
• Respect the subject’s right to have their data deleted
• Fulfill all data requests from subjects with timeliness and/or inside of one month from receiving the request

Take, for instance, a security firm that utilizes closed-circuit TV to surveil and monitor either communal areas or private businesses. Because their core activities constitute a public task, this firm would need to elect a DPO. The same is true for any processor that engages in minimal data retrieval or processing such as call centers. By contrast, entities that provide ancillary support, including payroll and IT support, need not install a DPO.

Exactly who can serve as DPO is left largely to the entity’s discretion. The DPO may be “in-house” or external, and they may perform other tasks for the company as well. However, they may do so with the proviso that their work for the company and their work as DPO does not create a conflict of interest.

While the role of DPO will look different from company to company, there are a few qualifications that the DPO must meet as outlined in the GDPR. These include:

• Expertise in data protection law, both national and European
• In-depth knowledge of the GDPR
• Comprehensive understanding of the organization’s data processing structure
• Ethics and integrity
• Free to carry out their tasks independently

We tend to think of “data breach” in rigid terms connoting the theft of confidential information from within the confines of an otherwise guarded data security system. With the GDPR, however, a data breach does not begin or end at theft but instead is defined much more broadly. It can include accidental or illegal destruction, loss, change, unauthorized access to or disclosure of personal data whether processed or archived. Once a breach occurs, controllers must notify the supervisory authority without “undue delay” or inside of 72 hours. This deadline holds true whether the breach was discovered by the processor or by the controller, although it is the controller’s responsibility, not the processor’s, for notifying the supervisory authority.

Controllers must then notify the data subject that their data has been compromised, otherwise known as an individual notification. Despite the thoroughness of the GDPR’s overall coda, it does not mandate individual notifications if certain conditions have been met. These include:
Regarding that last condition, the entity or controller is still required to alert data subjects through public means.

The right to erasure is EU parlance for the right to be forgotten, or the right for a data subject to have their personal data comprehensively deleted. A data subject may invoke their right to erasure under four primary scenarios:

• The initial purpose for archiving the personal data no longer applies
• The subject removes their consent
• The subject requests erasure in the event of non-compliance with GDPR guidelines or breach of data security
• Legal reasons

Data minimization is one of the more important Privacy by Design/Default principles mandated by the GDPR, and as the name suggests, it’s all about minimizing the amount of data that is collected, processed, and archived. Controllers are duty-bound to gather only as much personal data as is needed to perform the required task and reserve said data exclusively for the task in question, i.e. no migrating personal data from Task A over to Task B unless the data subject has consented.

Keeping with similar principles laid out elsewhere in the GDPR, data minimization requires controllers to limit the processing of a subject’s personal data according to certain stipulations. More specifically, this means only data that is relevant, adequate, and necessary to the purpose for which it was originally collected. Anything beyond this violates the GDPR and opens the entity to fines.

Privacy by design/default may be at the heart of the GDPR as a whole, but part-and-parcel therein is the right of data subjects to contest the processing of inaccurate or incomplete data. They may do so by requesting that the controller in question rectify their associated data, whether correcting false information, filling in missing data, or amending data with a clarifying statement. Controllers must respond to such requests in a timely manner or no later than one month from receipt. 

The consequences for failing to comply with the GDPR vary depending upon the transgression and can be divided between administrative fines and fines for breaches, whether a data breach or breach of consent, privacy, and the like. For failure to comply with administrative or preparedness standards, entities may be fined the greater of 2% annual global turnover or 10 million euros. Fines for breaches are double at 4% of annual turnover and 20 million euros, whichever is greater.

Without a doubt, the GDPR poses many new risks and challenges for data processing entities across the world who traffic in the personal data of EU residents. Perhaps even scarier is that the stress on collection, processing, and record keeping systems won’t be entirely calculable until after the regulation has actually gone into effect, leaving controllers and processors doing their best to tread water, so to speak, and avoid fines for non-compliance. The trade-off for successfully implementing the regulation, however, is worth it. Users’ personal data will be much less prone to abuse, translating to renewed confidence and trust on the part of data subjects, and greater engagement between all parties involved.

Dan Sincavage is a Co-Founder of Tenfold and currently serves as the Chief Strategy Officer. Dan oversees the Tenfold sales organization, manages strategic partner relationships and works with key enterprise accounts to ensure their success with the Tenfold platform.