Please enable JavaScript.

Coggle requires JavaScript to display documents.

Session 4 - The right of the DS to a lawful processing - Coggle Diagram

- - - - Right to Erasure (be forgotten)
        
        DC shall erase PD when asked by the DS when: PD no longer necessary; DS withdraws consent; objects to the processing; PD was unlawfully processed; complied with legal obligation...
      - Right to Object (oppose)
        
        Article 21 - Right for the DS to oppose the processing of his/ her data when the lawfulness of the processing relies on either check:
        
        the performance of a task of public interest or
        
        the legitimate interest of the controller
      - Right to Refuse
        
        Article 22 - Right not to be subject to a decision based solely on automated processing, including profiling
        
        Profiling = any form of automated processing of PD to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements - ex: profiling used to make a judge decision considering the likelihood of repeat offense
      - Right to Restriction of the processing
        
        Article 18 - Restriction applies when accuracy of the PD is contested by the DS; the processing is unlawful and the DS opposes the erasure; controller no longer needs the PD for the purposes of the processing
    - - Right to Information
        
        Privacy notice = doc addressed to the DS that explains how their PD will be processed as well as the DSR & other mandatory info
        
        Privacy notice (public, addressing DS) & Privacy policy = not necessarily the same (internal, addressing employees & other persons involved in processing PD)
        
        Article 13 = Info. to be provided where PD are collected from the DS (contact details of the controller; purposes of the processing for which the personal data; legitimate interests pursued)
        
        Article 14 = Info. to be provided where PD have not been obtained from the DS
        
        Article 12 = Transparent info, communication & modalities for the exercise of the rights of the DS
        
        => Processing to the DS in a concise, transparent, intelligible and easily accessible form, using clear & plain language
      - Right to Access
        
        Article 15 - DS should have the right to obtain confirmation from the DC as to whether or not PD concerning him or her are being processed
        
        Ex: Data Subject Access Request (DSAR) - Written request made by the DS for info. they are entitled to under the GDPR: 1. Must be free; 2. Must respond in 30 days from request; 3. Must provide data in electronic form whenever possible
    - - Right to Rectification
        
        Article 16 - DS shall have the right to obtain from the controller without undue delay the rectification of inaccurate PD concerning him or her: right to have incomplete PD completed, including by means of providing a supplementary statement
      - Right to Data Portability
        
        Article 20 - Right for a DS to receive the PD concerning them & have the right to transmit that data to another controller
- - - - Meet at least one of the GDPR grounds for data processing
        • Consent
        • Contractual necessity
        • Legal necessity
        • Legitimate interest
        
        Express Consent
        Because there is an imbalance in power between an employer & employee, there may not be express consent
      - Example of Activities w/ Data Processing
        
        Pay Employee Salary => Collect & process employee names & bank details => Processing is necessary to fulfill employment contract
        
        Pay Employee Taxes => Collect & pass employee data to the tax authorities => Processing is necessary to comply w/ a legal obligation
        
        Train or Monitor employees => Collect & pass employee data to the tax authorities => Processing is necessary for the legitimate interest of the employer
    - - Employees need to be given a privacy notice – just like consumers • Explain what data you collect & how you process it • Also outline the rights of the employee, including the DSAR (Data subject access request) • Given when the employee is hired – ask to read and ‘understand’ (not ‘agree’)
  - - - Processing is necessary for the legitimate interest of the employer
      - Keeping resume on file for future jobs
      - In case that the Candidate brings a lawsuit for discrimination (look at national laws on the statute of limitation for bringing a discrimination claim)
  - - - You can keep a former employee's PD
        • Pension related matters (legal obligation claims)
        • Legal claims (legitimate interest)
        • Delete all non-essential data
  - - - Employee monitoring
        
        Employers can monitor employees under certain principals to protect their businesses: email; internet/telephone use; CCTC; vehicle/fitness tracking; social media; background check
        
        Monitoring of employees must balance: • Necessity • Legitimacy • Proportionality • Transparency
        
        CCTV are biometric data • Fill out a DPIA • Must be included in the DSAR with faces of other employees blurred out