Currently, the UK has the Data Protection Act 1998 in force. This, however, will be superseded by the new GDPR regulations, with bigger fines for non-compliance and giving people greater say over what information is retained by companies and what they do with that data. It’s also designed to unify data protection regulations across the EU.
But aren’t we leaving the EU?
We are, but because the GDPR comes into force before we shut the door and return the keys, they will still apply even after we’ve left. That means you must comply, whether you’re a Remainer or a Brexiteer.
What do I have to do under GDPR?
Firstly, make sure everyone in your organisation is aware of the changes, especially key decision-makers and those directly responsible for collating and managing data.
Make sure you have a record of the kind of data you hold, where you got that data from, and who you share it with. That may mean an information ‘audit’ that also checks on your processing activities and how you log the use of data stored. Suppose you have inaccurate data that has been shared with other organisations. In that case, you must tell them about the inaccuracies so that data can be corrected downstream and within your own organisation.
You will need to review your privacy notices and plan any changes that may need to be added. Under the new regulations, you must:
- tell people who you are and how you intend to use their data,
- demonstrate that you have a lawful basis for processing their data,
- explain how long you will hold that information, and
- Inform individuals that they can complain to the ICO if they are unhappy with how you handle their data. Check the ICO’s Privacy notices code of practice for more information.
Individuals’ rights under GDPR
Most importantly, you must ensure that your procedures ensure the rights of individuals whose data you hold. The new GDPR means that individuals have:
- the right to be informed what data is being held about them;
- the right to access that information;
- the right to ensure any mistakes are rectified and corrected;
- the right to have information that is not relevant erased;
- the right to restrict the way the data is processed;
- the right to object to having their data held; and
- the right not to be subject to automated decision-making, including profiling.
An additional right is a right to data portability, which only applies to personal data provided by an individual, where processing is based on the individual’s consent for the performance of a contract, and when automated methods carry out the processing.
These procedures are key to compliance with the new regulations, so it’s vital that you check you’re up to date before 28 May 2018.
Access to data under GDPR
One of the most important procedure changes is allowing access to data. Compliance is now restricted to a month rather than 40 days, and you cannot charge (in most cases) for complying with a request. If you refuse a request for data access, you must provide a valid reason.
You must also identify the lawful basis for your data processing activity and update your privacy notice to explain it clearly.
Protection for Children under GDPR
For the first time, the new GDPR rules include special protection of children’s personal data, particularly for social networking. If data is to be collected on children under the age of 16, then parental or guardian consent must be sought first.
Data breaches – what to do if your data is hacked
Hacking is a huge issue, and personal data protection is key. Some organisations are already required to notify the ICO and other bodies (such as the Police) if there is a data breach. The new legislation introduces a duty of care on all organisations and even individuals to report data breaches to the ICO if there is a possibility it could result in personal information leading to financial or personal damage, discrimination, or damage to reputation. It’s time for all companies to take cyber security seriously, especially regarding the personal details of customers, clients, or even patients.
If you’re unsure as to how the new regulations may affect your business, talk to an expert. They will be able to review your current policies and procedures and recommend where you can make changes to ensure you comply with the new regulations. Remember, you only have until 28 May 2018 to prepare for GDPR, so acting now is important.
Speak to data specialist Karen Cole today.
Note: This is not legal advice; it provides information of general interest about current legal issues.