Our Approach to Privacy Management - Adaptable, Scalable and
HIPAA, CCPA, GDPR, and beyond
Our approach to Privacy Management relies on the fundamentals and it is adaptable and scalable to meet any legal framework.
We start by conducting a privacy impact assessment and threat analysis of your organization’s personal information handling practices, including ongoing activities, new initiatives, and new technologies.
THEN develop and implement policies and procedures to protect personal information:
- Define the purposes of collection.
- Obtain valid and meaningful consent.
- Limit collection, use, and disclosure.
- Ensure information is correct, complete, and current.
- Ensure security measures are adequate to protect information.
- Develop or update a retention and destruction timetable.
- Develop and implement policies and procedures to respond to complaints, inquiries, and requests to access personal information.
- Develop, document, and implement breach and incident-management protocols.
- Document and implement risk assessments.
- Develop, document, and implement appropriate practices to be used by third-party service providers.
- Develop, document, and deliver appropriate privacy training for employees, contractors, and vendors.
GDPR Assessment
A short informal assessment of your GDPR-compliant practices
- Have you incorporated the 6 principles related to personal data processing in your business practices?
- Do you meet the lawfulness criteria of the processing rules?
- Do you have records of consent?
- Have you provided all the necessary information at the point of collection?
- In the case of a data breach, do you have policies and practices to notify both the supervisory authority AND the data subject?
- Have conducted data protection impact assessments (DPIAs) where necessary according to the screening rules?
- You have incorporated policies and/or practices to provide objective evidence of adherence in relation to:
- Right of access
- Rectification
- Erasure
- Restriction of processing
- Data portability
Data Protection Impact Assessment (DPIA)
The assessment contains at least the following:
- A systematic description of the processing operations and the purposes of the processing;
- An assessment of the necessity and proportionality of the processing operations in relation to the purposes;
- An assessment of the risks to the rights and freedoms of data subjects;
- The measures envisaged addressing the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data and to demonstrate compliance with the GDPR.
GDPR
Material Scope
The GDPR applies to the processing of personal data. Personal data is defined as any information relating to an identified or identifiable natural person and includes data such as an IP address, and email address, or a telephone number. Processing activities include, among others, the collection, use, and disclosure of the data. The GDPR provides additional protection to the processing of special categories of personal data. Such special categories include, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and genetic and biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Member States may introduce further conditions, including limitations, with regard to the processing of genetic and biometric data or data concerning health.
Territorial Scope
The GDPR applies to data controllers and data processors with an establishment in the EU, or with an establishment outside the EU that targets individuals in the EU by offering goods and services (irrespective of whether a payment is required) or that monitor the behavior of individuals in the EU (where that behavior takes place in the EU). Factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.
Data controllers and/or data processors not established in the EU, but whose activities fall within the scope of the GDPR, will generally (some exceptions apply) have to appoint a representative established in an EU member state. The representative is the point of contact for all Data Protection Authorities (DPAs) and individuals in the EU on all issues related to data processing.
Fundamental principles relating to data processing
Personal data must be processed in accordance with the principles of lawfulness, fairness, and transparency. In addition, such data must be collected for specified, explicit, and legitimate purposes and not further processed in an incompatible manner to those purposes (principle of purpose limitation).
A data controller or a data processor must also make sure to respect the principle of data minimization, meaning that personal data shall be adequate, relevant, and limited to what is necessary for relation to the purposes for which they were processed. Personal data must be accurate and, where necessary, kept up to date. In addition, the accountability principle is recognized as a fundamental principle. Finally, the principles of storage limitation and integrity and confidentiality have to be respected.
Therefore, personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed and must be processed in a manner that ensures appropriate security of the personal data.
Lawfulness of processing
Processing of personal data will only be lawful if, at least one of the conditions below is met:
• the data subject has provided consent to the processing,
• the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,
• the processing is necessary for compliance with a legal obligation to which the controller is subject,
• the processing is necessary to protect the vital interests of the data subject or of another natural person, or
• the processing is necessary for the performance of a task carried out in the public interest
• the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Specific and stricter requirements are defined concerning the processing of special categories of data.
Consent
The GDPR devotes several articles to clarify the notion of consent.
Consent must be freely given, specific, informed, and an unambiguous indication of the data subject's wishes which by a statement or by clear affirmative action, signifies agreement to processing.
The request for consent must be presented in a manner clearly distinguishable from other matters in an intelligible and easily accessible form, using clear and plain language.
The data subject must be able to easily withdraw his or her consent at any time and must be informed of this right in advance.
Specific requirements apply in relation to children's consent for information society services. If an individual below 16 years wishes to use information society services, consent must be obtained from the child's parent or the holder of parental responsibility of the child in question.
However, Member States may introduce domestic laws to lower this age to not less than 13 years
Individual Rights
The GDPR maintains, often reinforces, and further develops the rights of the individuals (information, access, rectification, objection, erasure restriction right to be forgotten right to data portability.
- The right to information requires data controllers to give individuals certain information about the processing of their personal data free of charge (exceptions apply — Article 14). This information must be provided in a concise, transparent, intelligible, and easily accessible form using clear and plain language. Data controllers can provide such information to individuals in combination with standardized icons to give an easily visible, meaningful overview of the processing.
- The right to be forgotten, also referred to as the right to erasure as it includes both the right to have the data erased and the right to delisting in certain circumstances. The individuals have the right to require data controllers to delete their data in certain circumstances, including where the information is no longer necessary for the purpose for which it was collected or where the individual withdraws their consent and there is no other legal grounds for processing their data.
- The right to restriction of processing applies in some specific circumstances including for example, for an interim period allowing the data controller to verify the accuracy of the personal data that is contested by the data subject, or when the controller no longer needs the personal data for the purposes of the processing but are required by the data subject for, for example, the establishment of legal claims.
- The right to data portability refers to the right of an individual to receive personal data that he/she has provided to the data controller in a structured, commonly used, and machine-readable format and to transmit that data to another data controller without hindrance. This right only applies to personal data that an individual has provided to the controller, where the processing is based on the individual's consent or for the performance of a contract and where the processing is carried out by automated means. The exercise of this new right to data portability shall be without prejudice to the exercise of the right to erasure or the right of access.