It is vital to understand the definitions contained within the European Union General Data Protection Regulation (EU GDPR) in order to comply with the provisions; this is true for any document with legal effect. While it is tempting to assume the meaning of a word or phrase, it would be unwise to guess at it. Therefore, I have created this blog post to identify and define within the meaning of this Reg certain key words and phrases. This posting may prove useful as you read my other blogs related to the EU GDPR.
Consent: explicit agreement by the Data Subject; must be: freely given, specific, informed, and unambiguous (clear and plain language) by a statement or clear affirmative action signifying agreement to the processing of personal data; consent can be withdrawn at any time; however, the withdrawal doesn’t affect the lawfulness of data processing based on consent before its withdrawal; it must be as easy to withdraw as it is to give consent; data collected, stored, and processed strictly for direct marketing purposes must be clearly and separately called-out from other information contained in a request for consent
Data Controller: the natural or legal person, public authority, agency, or other body, which determines the purposes and means of the processing of personal data; the Data Controller remains liable for non-compliance, regardless of whether the Data Processor or other third-party subcontractor actually processes the data; this is done to ensure that the Data Controller remains vigilant in the security of the data from which it benefits and derives business and cannot cavalierly eschew responsibility by outsourcing
Data Minimization: collecting, storing, and using only data that is: adequate, relevant, and limited to what is necessary to the purpose for which it was collected; data cannot be kept for longer than necessary in a form which identifies the Data Subject, UNLESS it is for archiving and research purposes (storage limitation)
Data Processing Considerations: nature, scope, context, purpose, risks, and severity of consequences
Data Processor: the natural or legal person, public authority, agency, or other body, which processes personal data on behalf of the Data Controller; the Data Controller and Data Processor may be employed by the same or different entities; the Data Processor cannot subcontract the data processing to a third-party without the Data Controller’s agreement; the Data Controller and Data Processor both remain liable for non-compliance
Data Subject: identified or identifiable natural person
Jointly & Severally Liable: liability which attaches to more than one entity or individual; each one is liable for the full amount and consequences of a judgment, with the potential for charge-back between those held liable (for example, if a judgment is made against the Data Controller and Data Processor, the EC may collect 100% from one or the other; then the paying entity/individual has a claim against the other non-paying entity/individual for 50% reimbursement)
Personal Data: any data relating to an identified or identifiable natural person (Data Subject); this is a much broader interpretation of what constitutes personal data, compared to that of Directive 95/46/EC Regulation
Profiling: any form of automated processing of personal data to analyze or predict aspects concerning that natural person (Data Subject); this provision can have a profound impact on direct market data gathering, which is a key element in the value proposition of Big Data & Analytics; separate attention must be called to this purpose when explicit consent is being sought from the Data Subject
Pseudonymization: personal data that can no longer be attributed to a specific Data Subject without the use of additional information; the additional information must be stored separately and subject to technical and organizational measures to ensure the continued privacy of the Data Subject
Right of Erasure: Data Subjects have the right to request that their data be erased; exceptions apply, including retaining data required to fulfill contractual obligations with the Data Subject, archiving, research, or if data retention is in the public good; this provision represents an enhanced right for the Data Subject, compared to the prior Directive and the concept of “the Right to be Forgotten”; alternatively, the Data Subject can also request a data restriction, instead of a data erasure
Supervisory Authority (SA): an independent public authority, which is established by a Member State; the SA interacts with the Data Protection Officer (DPO), Data Controller, or Data Processor in order to ensure that proper procedures are followed in securing the personal data of Data Subjects; the SA has the authority to offer opinions and guidance, monitor those entities within its jurisdiction, and to render rulings; it is advisable to begin and maintain an early and close working relationship with the SA
