The View from Where I Sit

Tag: GDPR

  • Storage Limitation vs Purpose Limitation in GDPR

    Under GDPR, the storage limitation principle mandates that personal data should only be retained as long as necessary for its intended purpose, while the purpose limitation principle requires that data be collected for specific, legitimate purposes and not further processed in a way that is incompatible with those purposes.


    Storage Limitation Principle
    The storage limitation principle is outlined in Article 5(1)(e) of the GDPR. It states that personal data must be kept in a form that allows identification of data subjects for no longer than necessary for the purposes for which the data is processed. Here are the key points:


    Retention Periods: Organizations must define and document how long they will retain personal data based on its intended purpose. Once the purpose is fulfilled, the data should be deleted or anonymized.


    Regular Reviews: It is essential to conduct periodic reviews of stored data to ensure compliance with retention policies and to delete any data that is no longer necessary.


    Legal Obligations: In some cases, data may need to be retained for longer periods due to legal obligations, such as tax or accounting laws.


    Purpose Limitation Principle
    The purpose limitation principle, also found in Article 5(1)(b) of the GDPR, requires that personal data be collected for specified, explicit, and legitimate purposes. Key aspects include:


    Specified Purposes: Organizations must clearly define the purposes for which personal data is collected at the time of collection. This helps ensure transparency and accountability.


    Incompatibility of Further Processing: Data collected for one purpose cannot be used for another purpose that is incompatible with the original intent. For example, if data is collected for marketing, it cannot be used for recruitment without a valid legal basis.


    Function Creep Prevention: Organizations should regularly review their data processing activities to prevent “function creep,” where data is used for purposes beyond those originally specified.

    Best Practices for Compliance
    Develop Retention Policies: Organizations should create clear data retention policies that specify how long different types of data will be kept and the conditions for deletion.


    Conduct Data Audits:     Regular audits of data holdings can help identify unnecessary data and ensure compliance with both storage and purpose limitation principles.


    Educate Staff: Training staff on GDPR compliance and the importance of these principles can help mitigate risks associated with data retention and processing.

    By adhering to these principles, organizations can protect individuals’ privacy and ensure compliance with GDPR regulations.

  • The 7 Principles of GDPR

    1. Lawfulness, Fairness, and Transparency- Personal data must, be processed lawfully, fairly, and in a transparent manner.
    2. Purpose Limitation- Collected for specified, explicit, and legitimate purposes.
    3. Data Minimization- Adequate, relevant, and limited to what is necessary.
    4. Accuracy– Kept accurate and up to date
    5. Storage Limitation- Personal data kept in an identifiable form for no longer than necessary.
    6. Integrity and Confidentiality- Ensuring security of personal data against unauthorised processing and loss.
    7. Accountability– Demonstrate compliance with the other principles.

  • General Data Protection Rights

    The General Data Protection Regulation (GDPR) establishes strict rules for the processing of personal data, ensuring individuals’ privacy rights and imposing obligations on organizations that handle such data.


    Overview of GDPR
    The GDPR, which came into effect on May 25, 2018, aims to harmonize data privacy laws across Europe and protect the personal data of EU citizens. It applies to any organization that processes personal data of individuals within the EU, regardless of where the organization is based.

    Key Principles of GDPR

    1. Lawfulness, Fairness, and Transparency: Personal data must be processed lawfully, fairly, and in a transparent manner concerning the data subject.
    2. Purpose Limitation: Data should be collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes.
    3. Data Minimization: Only the data necessary for the intended purpose should be collected and processed.
    4. Accuracy: Personal data must be accurate and kept up to date; inaccurate data should be rectified or erased without delay.
    5. Storage Limitation: Data should be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which the data is processed.
    6. Integrity and Confidentiality: Personal data must be processed securely to protect against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

    Rights of Individuals

    Under GDPR, individuals have several rights regarding their personal data, including:

    • Right to Access: Individuals can request access to their personal data and obtain information about how it is processed.
    • Right to Rectification: Individuals can request correction of inaccurate personal data.
    • Right to Erasure: Also known as the “right to be forgotten,” individuals can request the deletion of their personal data under certain conditions.
    • Right to Restrict Processing: Individuals can request the restriction of processing their personal data in specific situations.
    • Right to Data Portability: Individuals can request their personal data in a structured, commonly used, and machine-readable format and transfer it to another controller.
    • Right to Object: Individuals can object to the processing of their personal data in certain circumstances, including for direct marketing purposes.


    Compliance Obligations for Organizations
    Organizations must implement appropriate technical and organizational measures to ensure compliance with GDPR. This includes:
    Conducting Data Protection Impact Assessments (DPIAs) when necessary.
    Appointing a Data Protection Officer (DPO) if required.
    Notifying authorities and affected individuals in the event of a data breach.
    Maintaining records of processing activities.


    Conclusion
    GDPR represents a significant shift in data protection laws, emphasizing the importance of individual privacy rights and imposing strict obligations on organizations. For more detailed information, you can refer to the official GDPR text here and the UK-specific guidance from the Information Commissioner’s Office here.