book

Data Protection and Compliance, 2nd Edition

Name: Data Protection and Compliance, 2nd Edition
ISBN: 9781780175263

by Stewart Room, Michelle Maher, Niall O'Brien, Adam Panagiotopoulos, Shervin Nahid, Richard Hall, Tughan Thuraisingam, James Drury-Smith, Simon Davis, Mark Hendry, Jamie Taylor, Ben Johnson

November 2021

Intermediate to advanced

416 pages

13h 11m

English

BCS, The Chartered Institute for IT

Read now

Unlock full access

Front Cover
Half-Title Page
BCS, THE CHARTERED INSTITUTE FOR IT
Title Page
Copyright Page
Contents
List of figures and tables
Contributors
Copyright notices
Abbreviations

Preface
PART I THE BIG PICTURE
1. INTRODUCTION TO DATA PROTECTION
What is data protection?Does data protection mean privacy?What is privacy?Are there exceptions to the right to privacy?What else should be protected?Protecting fundamental rights and freedoms (‘human rights’)Protecting the free movement of personal data (data flows, transfers and shares)The protected activitiesProtecting processingProtecting personal data undergoing processingSpecial category data (or ‘sensitive personal data’)Thematic priorities of data protection, trends and hot topics – supporting a risk-based approachAdTech and cookiesAdvanced technology and data processing techniquesAdvanced surveillanceArtificial intelligenceAutomated facial recognitionConnected vehiclesChildrenCybersecurityData subject rights – timetable breachesDemocracyHR problemsInternational transfersPrivacy and electronic communications (‘ePrivacy’)ProfilingVirtual voice assistantsCore lawThe UK Data Protection Act and its relationship to the GDPR and other EU lawThe Data Protection ConventionRegulatory guidance and decisionsCourt judgmentsRelated lawData protection penalties and litigationThe regulatory bear marketSummary
2. INTRODUCTION TO THE GDPR
Brexit: the impacts for data protection and the impacts for this bookThe land mass in Europe to which the GDPR appliesRecitals and articles of the GDPRJurisdiction of the GDPRNationality and location of peopleA.3.1 – processing in the context of EU establishmentsA.3.2 – targeting people in the EUMaterial scope of the GDPRThe building blocks of the GDPRThe actorsCompliance framework – the standards of protectionData protection principlesLawful bases of processingNecessityConsent for processingCompliance framework – controlsAppropriate technical and organisational measuresAppropriate safeguardsPrescribed controlsAnonymisation and pseudonymisationAccountabilityAssessing appropriateness of controlsCritical outcomes to be achievedTransparencyClarity of the lawful basis of processingControlCompensatory mechanisms to remedy non-complianceRegulator’s enforcement powersData subjects’ enforcement powersWhere the GDPR does not apply – exceptions and restrictionsDomestic processingRestrictions and the UK DPABrexit – the UK, Frozen and EU GDPRUK GDPRFrozen GDPRBrexit – international transfers of dataSummary
3. INTRODUCTION TO EPRIVACY
Regulating the electronic communications sectorThe relationship between data protection and ePrivacyThe actors and protected partiesConfidentiality of communicationsExceptions to confidentialityConsent for storing or accessing information in terminal equipmentConsent, transparency and the use of cookie notices and consent toolsTypes of cookiesCookies, behavioural advertising and real-time biddingCookies and legal riskDirect marketingThe position under PECRPostal direct marketingOpt-out, as a matter of lawFinancial penalties for direct marketing contraventionsProcessing of traffic data, location data and value added servicesSecurity and personal data breach notificationPersonal data breachesExpanded rules for breach notificationsInterplay with the breach notification rules in the GDPRCalling line ID and directories of subscribersLaw reform underwaySummary
4. INTRODUCTION TO OPERATIONAL DATA PROTECTION
Operational adequacy schemes – implementing data protection (operationalisation)Focus on operational adequacy schemesThe three layers of an organisationImplementing data protection in the people layerGovernance structuresSteering committeeRecruitment and onboardingEducation and trainingAccess rights and privilegesMonitoringWorker disciplineFlowing requirements to data processorsImplementing data protection in the paper layerData Protection by Design and Default (DPbDD, or PbD)Governance structuresRecords of processing activitiesRisk registers and assessment tools and methodologiesLegitimate interests assessmentsTransfer assessmentsTransparency noticesContracts and similar documentsPolicies, procedures and controls frameworksRecords of significant eventsProgramme and project plansTechnology architectureAssurance recordsOther mechanisms for assuranceImplementing data protection in the technology and data layerPrivacy Enhancing TechnologiesRegulatory sandboxes‘The Journey to Code’Risk management – implementing measures to assess risks to rights and freedoms and the appropriateness of controlsThe adequacy testThe impact of the ‘consensus of professional opinion’ – what are the risks and what should be done about them?Risk management – dealing with adverse scrutinyGlobalisation – implementing data protection on an international stageInternational transfers – adequacy, appropriate safeguards and derogationsMeaning of ‘adequacy’ for the purposes of international transfersAdequacy of the UKAppropriate safeguardsDerogationsWider operational challenges of international activitiesImpacts for micro, small and medium-sized enterprisesSize of enterprise and size of riskFinancial resources, cost and riskSecurity and connection to wider legal and operational frameworksSummary
PART II CORE LAW
5. THE PRINCIPLES OF DATA PROTECTION
A constant presence in data protection lawThe duty of compliance (accountability)Lawfulness, fairness and transparency – the first principleLawfulnessFairnessTransparencyPurpose limitation – the second principleExpanded purposes – archiving in the public interestExpanded purposes – scientific and historical researchExpanded purposes – statisticsCompatibilityData minimisation – the third principleAccuracy – the fourth principleStorage limitation – the fifth principleIntegrity and confidentiality (including security) – the sixth principleAccountability – the seventh principleLawfulness of processing of personal data (Article 6)Categorising the lawful bases of processingConsentContractLegal obligationVital interestsPublic taskLegitimate interestsLawfulness of processing – special category personal data and criminal convictions and offencesThe ban on processing special category personal data – enhanced sensitivity, risks and legal requirementSummary
6. THE RIGHTS OF DATA SUBJECTS
Informing and empowering the protected partyTransparency and information rightsGeneral obligation of transparency – GDPR A.Obtaining transparency – GDPR A.13 andThe right of access to information – A.Personal data breaches – ArticleRights over data processingRight to rectification – A.Right to erasure, or ‘the right to be forgotten’ – A.Right to restriction of processing – A.Right to data portability – A.Right to object – A.Right not to be subject to automated decision making, including profiling – A.Remedies and rights of redressSummary
PART III OPERATING INTERNATIONALLY
7. NATIONAL SUPERVISION WITHIN AN INTERNATIONAL FRAMEWORK
National regulatory systems and divergencesGDPR solution for international processingEstablishment of supervisory authoritiesGeneral conditions for members of supervisory authoritiesIndependenceInterferenceSupervisory authority competenceMember competenceTasksMonitoringPromotion and awarenessAdvice and administrationRights, complaints and enforcementPowersLead supervisory authoritiesCross-border processingCooperation and mutual assistanceChoosing a lead supervisory authorityAppointing an EU RepresentativeSummary
8. TRANSFERRING DATA BETWEEN THE GDPR LAND MASS AND THIRD COUNTRIES
Why regulate international transfers?What is a transfer?General principles for transfersTransfers on the basis of an adequacy decisionElements considered in assessing adequacyAdequacy decisions issuedUK adequacyPartial adequacy decisionsOngoing monitoring of adequacy decisionsTransfers subject to appropriate safeguardsStandard contractual clausesDerogations for specific situationsRelying on the derogations in practiceCompelling legitimate interestsLitigation on international data transfersSchrems I – Safe Harbor decision declared invalidSchrems II – Privacy Shield declared invalid and SCCs declared valid subject to certain conditionsNavigating international data transfersEDPB’s six-step recommendationsSupplementary measuresA practical approach to international transfersGetting to know your ‘special characteristics’Understanding the ‘zone of precedent’Knowing your ‘adverse scrutineers’Achieving operational adequacyUpscaling protectionsConsidering options for deregulatory effectsSummary
9. DATA PROTECTION BEYOND THE GDPR LAND MASS
Multi-jurisdictional frameworks protecting rights and freedoms including data protectionThe Universal Declaration of Human RightsThe OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal DataAPEC Privacy FrameworkNational laws beyond the GDPR land massNotable new legislationComparative review between the GDPR and key international lawsUnited StatesCaliforniaVirginiaBrazilIndiaChinaData localisationExamples of localisation lawsCoping strategies for organisations operating globallyExamples of coping mechanismsSummary
PART IV DELIVERY
10. MECHANISMS TO SUPPORT OPERATIONAL COMPLIANCE
Mechanisms within the GDPRTechnical and organisational measuresOrganisational measuresTechnical measuresCodes of conduct and certification mechanismsRisk assessmentsData protection policiesAn overarching data protection policyPolicies covering specific GDPR obligationsProceduresReflecting operational realitiesRecords of processing activities – a baseline for accountabilityMinimum content of ROPAsWider benefits of ROPAsData Protection by Design and DefaultA formula for complianceDesignDefaultData protection impact assessmentLikely to result in a high riskMinimum features of a DPIAData protection officerRequirement to appoint a DPOTasks of the DPOPosition of the DPOContractsArticle 28 processor contractsJoint controller contractsSummary
11. PROGRAMMATIC APPROACHES FOR DELIVERING DATA PROTECTION BY DESIGN AND DEFAULT
The origins of Data Protection by Design and DefaultData Protection by Design and Default in the GDPRThe design elementThe default elementThe need for DPbDD – compelling events that trigger data protection transformationEmbarking upon a transformation journey to achieve DPbDDA vision statement – laying the foundations for DPbDDDifference between data protection programmes and projectsThe beginning of work – building a business caseThe beginning of work – developing the briefManaging the workInitiating the workThe workplans and workstreamsGovernance frameworks required by DPbDD for accountability purposesRoles and responsibilities – who will do what?Management structures and reporting linesSetting a target operating modelSummary
12. BEING ACCOUNTABLE FOR RECORDS OF PROCESSING, LEGITIMATE INTERESTS AND RISK MANAGEMENT
Accountability for our decisions, actions and behavioursAccountability as a core principle of data protectionDemonstrating accountability – an ongoing obligation, not a moment-in-time issueEnd-to-end accountability – from idea to realityAccountability in practiceRecords of processing activitiesROPAs – continuing obligationsUnderstanding dataProducing the ROPA on requestBenefits of extended records of processing – going beyond A.Developing records of processing – discovery and analysisTechnology-assisted data discoveryROPAs and Data Protection by Design and DefaultGated development – upskillingOrganisation typeA combination of all the aboveExemptionsBeing accountable for legitimate interestsBeing accountable for the balancing exerciseConsiderations within legitimate interestsLegitimate interests and the right to object to direct marketingLegitimate interests and data subject rightsBeing accountable for risk managementBeing accountable for ATOMRisk of failure baked into designBeing accountable for the 4-TsBeing accountable for embedding data protection risk management into change methodologiesBeing accountable for recognised controlsBeing accountable for assuranceBeing accountable for adverse scrutinyBeing accountable for an accumulation of evidenceProduction of evidence under pressure and scenario testingSummary
13. ‘THE JOURNEY TO CODE’
The Journey to Code – working towards achieving compliance within technology and data themselvesThe Journey has commencedThe nature of the problemEmail exampleMalicious technology and codeA technology reference architecture for The Journey to CodeThe Core Privacy Technology Value ChainPrivacy management technologyThe rise of privacy management technologiesArguments for the use of privacy management technologyDrawbacks associated with privacy management technologyData intelligence technologyNative and third-party data intelligence technologyThird-party integrated data intelligence technologyPrinciples and rights technologyProducers of technology and data processing systemsA regulatory gapSolutions to the regulatory gapThe risk of a litigation culture emergingWhat comes next on The Journey to Code?‘Your mission, should you choose to accept it’Summary
PART V ADVERSE SCRUTINY
14. HOW TO PREPARE FOR THE RISKS OF CHALLENGE AND ‘ADVERSE SCRUTINY’
Challenge and scrutiny are inevitableChallenge and scrutiny designed into regulatory lawAdverse scrutinyThe supervisory authorityThe data subjectA legal duty to understand the risks of challenge and scrutinyThe continuum of challenge and scrutinyWhy a continuum?Examples of internal challengers and scrutineersMoral spectrumExamples of external challengers and scrutineersModelling challenge and scrutiny risksSituations in the GDPR calling for risk assessmentsRisk scenarios and context-specific risk modellingThe special characteristics and how they relate to modellingModelling – challenge and scrutiny as reactive eventsTiers of visibility – catalysts of challenge and scrutinyModelling the domino effect of challenge and scrutinyOther interests to be considered when modelling challenge and scrutiny risksThe relative impacts of challengers and scrutineersThe impacts of data subject challenge and scrutinyPrivacy activistsThe impacts of data protection regulatorsOutcomes versus structures and artefactsExamples of structures and artefactsRoot cause analysis for operational failureConfidence testing and sentiment analysisSummary
15. COMPLAINTS, RIGHTS REQUESTS, REGULATORY INVESTIGATIONS AND LITIGATION
Awareness levels driving scrutiny and challengeAccountabilityAccounting for readiness to deal with challenge and scrutinyDealing with complaintsPoint of contactManaging complaints and concerns received direct from data subjectsManaging complaints escalated to a supervisory authorityHow to respondDealing with regulatory investigations (investigatory powers)Information NoticesAssessment NoticesInvestigations and prosecutions of criminal offencesExercise of data subject rightsEscalation of problems – rights requests leading to adversityTimingExtensionsManifestly unfounded or excessive requestsCompliance ordersLitigationSubject access and litigationData protection and litigationCompensation and liabilityMass claimsSummary
16. REGULATORY ACTION
The impacts of national laws and other contingencies on GDPR enforcement powersWhen can regulatory powers be used?The investigatory phase of regulatory actionPowers in ArticleWarnings of potential infringements – action to prevent things going wrongReprimandsEnforcement NoticesWithdrawal of certificationFinancial penaltiesDetermination of penaltiesMitigating factorsReputational impactAppeals against regulatory actionPreparing for the risk of regulatory actionPreparation through understanding the true extent of regulator powers – privilege exampleDisposition – the stance and style to adopt when faced with regulatory actionSummary
17. HANDLING PERSONAL DATA BREACHES
The legal obligation to be secureRelationship to ePrivacyRelationship to cybersecurityThe protections to be achieved under GDPR A.5.1.fProtections to be achieved under GDPR A.Security of the full data processing environmentProcessing data for security purposes as a legitimate interestAccountability for securityOperational securityExpanded requirements for security found outside the GDPRThe state of the artCosts of implementationThe nature, scope, context and purpose of processingThe risks of varying likelihood and severityRequired outcomesAppropriateness – what risks will the law tolerate?Personal data breaches, breach notification and communicationsPhilosophies within breach notification and communications – transparency and its effectsPersonal data breach definitionBreach of securityIncident detection and responseTypes of personal data breaches – risks to rights and freedomsTimetables for notification and communicationsRisks to rights and freedoms and the carve-out for encrypted dataInterests of law enforcementA.34 communications and disproportionate effortContents of notifications and communicationsOrdering A.34 communicationsBreach logsSummary
Glossary
Index
Back Cover

Content preview from Data Protection and Compliance, 2nd Edition

ABBREVIATIONS

AAIP Agencia de Acceso a la Información Pública, the Argentinian regulator

AFR automated facial recognition

AG Attorney General

AI artificial intelligence

ANDP National Data Protection Authority (Brazil)

APEC Asia-Pacific Economic Cooperation

APPI Act on the Protection of Personal Information (Japan)

APT advanced persistent threat

ATOM appropriate technical and organisational measures (GDPR A.5, 24, 25, 28, 32, 34)

BCR binding corporate rules (GDPR A.47)

BYOD bring your own device

CCPA California Consumer Privacy Act (USA)

CDPA [Virginia] Consumer Data Protection Act (USA)

CERT computer emergency response team

CJEU Court of Justice of the European Union

COPPA Children’s Online Privacy Protection Act (USA)

CPR Civil Procedure ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

EU General Data Protection Regulation (GDPR) – An implementation and compliance guide, fourth edition

Publisher Resources

ISBN: 9781780175263

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Data Protection and Compliance, 2nd Edition

by Stewart Room, Michelle Maher, Niall O'Brien, Adam Panagiotopoulos, Shervin Nahid, Richard Hall, Tughan Thuraisingam, James Drury-Smith, Simon Davis, Mark Hendry, Jamie Taylor, Ben Johnson

ABBREVIATIONS

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.