"Legal tips and compliance requirements" - Anastasia Botsi, ICT Legal

www.ictlegalconsulting.com© 2018 ICT Legal Consulting – All rights reserved
Legal tips and
Compliance
Requirements
ICTLC - ICT Legal Consulting
PresentsAnastasia Botsi – Associate
anastasia.botsi@ictlegalconsulting.com

The Firm – Global Presence
2
ICT Legal Consulting is an
international law firm founded in
2011 with offices in Amsterdam,
Milan, Bologna, and Rome.
In each of these countries we have established
partnerships with more than one law firm. Depending on
the assignment, we contact the professionals who are
most capable of meeting clients’ specific needs.
We are present in nineteen other countries:
Australia, Austria, Belgium, Brazil, China,
France, Germany, Greece, Hungary, Mexico,
Poland, Portugal, Romania, Russia, Slovakia,
Spain, Turkey, United Kingdom and USA.
Disclaimer: The presentation was made for the purpose of synthetising the principles for the public webinar of Cyberwatching.eu, for any further in depth analysis please refer to
the Regulation (EU) 2016/175.

www.ictlegalconsulting.com© 2018 ICT Legal Consulting – All rights reserved 3
The Expertise
Anastasia Botsi – Associate , LL.B.
Anastasia joined ICT Legal Consulting in 2018 and is now an Associate of the firm. Professionally certified
DPO by the European Center of Cybersecurity and Privacy, and a sponsored researcher of the Dutch
Science Foundation, to analyse the legislative management of cybersecurity risks and trained in European
Law.
She provides legal advice to multinational companies and start-ups on privacy and personal data protection,
with special reference to GDPR compliance. In addition, she participates in several H2020 European Projects on
privacy and cybersecurity. She speaks fluent English, and Greek.

The General Data Protection Regulation
Personal Data: Any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or
to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
Data Controller: the company or public authority / agency which, determines the purposes (the why) and the means (the what and how) of the processing
(Art. 4 (7) GDPR)
Data Processor: the company or public authority / agency, which processes personal data on behalf of the controller, per instructions of the controller
(Art. 4 (8) GDPR)
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means,
such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Accountability: The controller shall be responsible for, and be able to demonstrate compliance with the GDPR (Art. 5 (2) and Art. 24 GDPR)
Special Categories of Personal Data
ü Data concerning health means personal data relating to the physical or mental health of a natural person, including the provision of health care
services, which reveal information about his or her health status;
ü Genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about
the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in
question;
ü Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of
a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
101 Terminology
4

The General Data Protection Regulation
Regulation EU 2016/679 on the Protection of Natural Persons with Regard to the Processing of
Personal Data
Ø adopted on 14 April 2016, became enforceable in all European Member States on 25 May 2018
Ø aims to bring a single standard for data protection among all member states in the EU
Ø Broader territorial reach, when compared to previous framework (Directive 95/46/EC)
üCriterion 1: The GDPR applies where processing takes place “in the context of the activities of an establishment of
a controller or processor in the Union, regardless of whether the processing takes place in the Union or not.”
üCriterion 2: The GDPR applies to controllers or processors not established in the Union, where the processing
activities relate to:
üthe offering of goods or services to data subjects in the Union; OR
üthe monitoring of the behavior of data subjects in the Union.
5

Legal Tips for
Businesses
ØAccountability
ØSecurity Measures

Accountability under the GDPR means..
Data Controllers responsibility when processing personal data is:
Ø To ensure, and to be able to demonstrate, compliance with the GDPR – implementing appropriate:
o Technical measures
o Organisational measures (i.e. data protection policies, complying with approved codes of
conduct or certification mechanisms)
[Art. 24 GDPR; Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood
and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and
organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the Regulation.
Those measures shall be reviewed and updated where necessary.]
7

ØMaintaining a Record of Processing Activities (Art. 30 GDPR)
ØRequired for organization with less than 250 employees when:
Ø the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects,
Øthe processing is not occasional, or
Øthe processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal
convictions and offences referred to in Article 10
Ø That record shall contain:
Øthe name and contact details of the controller and the data protection officer;
Øthe purposes of the processing;
Øa description of the categories of data subjects and of the categories of personal data;
Øthe categories of recipients to whom the personal data have been or will be disclosed including recipients in third
countries or international organisations;
Øwhere applicable, transfers of personal data to a third country or an international organisation, including the
identification of that third country or international organisation andthe documentation of suitable safeguards;
Øwhere possible, the envisaged time limits for erasure of the different categories of data;
Øwhere possible, a general description of the technical and organisational security measures referred to in Article 32(1).
Accountability under the GDPR means..
8

Main Obligations of a Data Controller
• Providing Information to Data Subjects regarding: (Art. 13 and 14
GDPR)
ü Identity and contact details of data controller and (where
needed) the Data Protection Officer
ü The purposes of processing their personal data
ü The recipients of the personal data
ü The legal basis of the processing
• Choosing the correct legal basis for the processing activities:
(Art. 6 GDPR)
ü Consent: clearly distinguishable, intelligible and easy to
access, in clear and plain language (Art.9 GDPR);
ü Performance of contract;
ü Legal obligation;
ü Legitimate interest;
ü Vital interest of a data subject, or;
ü Public interest.
9

Main Obligations of a Data Controller
• Ensuring that data subjects are informed about their rights
and how to freely exercise them:
ü Right of access (Art. 15 GDPR)
ü Right to rectification (Art. 16 GDPR)
ü Right to erasure (Art. 17 GDPR)
ü Right to restrict the processing (Art. 18 GDPR)
ü Right to data portability (Art. 20 GDPR)
ü Right to object to processing (Art. 21 GDPR)
10

A risk-based
approach under the
GDPR..
Before the GDPR
Ø Legislators accepted standard security measures
(checklist of security measures)
Data Security since the GDPR
Ø Enhanced obligations both for controllers and
processors
o Assessing processing activities and finding
relevant organisational and technical measures
Ø There is no list of possible types of security measures,
a RISK- BASED APPROACH is needed
Ø A challenge for SMEs, since there is less resources 11

Security of processing
Taking into account the state of the art, the costs of implementation and the nature, scope, context
and purposes of processing as well as the risk of varying likelihood and severity for the rights and
freedoms of natural persons, the controller and the processor shall implement appropriate technical
and organisational measures to ensure a level of security appropriate to the risk,
including inter alia as appropriate:
Ø the pseudonymisation and encryption of personal data;
Ø the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing
systems and services;
Ø the ability to restore the availability and access to personal data in a timely manner in the event of a
physical or technical incident;
Ø a process for regularly testing, assessing and evaluating the effectiveness of technical and
organisational measures for ensuring the security of the processing.
[Art. 32 GDPR]
12

Principle of Transparency
ü Data must be processed lawfully, fairly and
transparently
ü Information relating to the proccessing of personal data
should be concise, easily accessible,
understandable, with the use clear and plain
language
Want to know what to include in your information notice to your data
subjects? Check articles 13 and 14 GDPR.
13

Principle of Data Protection by Design
and by Default
“Think privacy – Design privacy”
The controller shall :
Ø Both, at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as
pseudonymisation, which are designed to implement data-protection principles, such as data
minimization (Art. 25(1) GDPR)
Ø Implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are
processed. That obligation applies to the amount of personal data collected, the extent of
their processing, the period of their storage and their accessibility. In particular, such
measures shall ensure that by default personal data are not made accessible without the
individual's intervention to an indefinite number of natural persons (Art. 25(2) GDPR).
14

Accounta-
bility
Data
protection
by design &
by default
Data
protection
impact
assessment
Information
to the data
subject
Legitimate
basis
Rights of
the data
subject
Security Measures
Data Breach Management
Simplified Approach to the
Data Protection
Compliance
Framework
15

How can this approach be
implemented?
ü Choosing measures based on Principles of Data
Protection by Design and by Default
ü Describing security measures in the Record of
Processing Activities and attaching them to the Data
Processing agreements
ü Conducting a Data Protection Impact Assessment for
risky processing activities, and finding the relevant
security measures
ü Adopting Data Breach Management Policies
ü Adhering to relevant Certifications to demonstrate
compliance
ü Data Protection Self Assessment Toolkit
v Data Controller and Data Processor’s
checklist
v Record of Processing Activities assessment
v Direct Marketing assessment
16

Sanctions and enforcement
Ø Data subjects’ right to remedies
Ø Right to lodge a complaint with a Supervisory Authority for processing of
their data in violation with the GDPR
Ø Right to start legal action
Ø against a Supervisory Authority for failure to investigate a complaint or
keeping the data subject informed
Ø against a controller or processor for processing of their data in violation
with the GDPR (courts where controller or processor is established/courts
of place of residence of data subject)
Ø Right to obtain compensation for material or immaterial damage
Ø joint liability of controllers and processors for the entire damage
Ø Class actions
Ø certain not-for-profit organizations can be mandated by data subjects to
lodge complaints and claim compensation on their behalf
Ø Member States may also mandate organizations to act on behalf of data
subjects
Ø Fines
Ø Up to the greater of 2% of an
undertaking’s total annual worldwide
turnover or €10 million for a large
number of violations
Ø Up to the greater of 4% of an
undertaking’s total annual
worldwide turnover or €20 million
for a more limited set of violations,
including
Ø violation of data subjects’ rights
Ø violation of basic principles for
processing (legal basis, new consent
rules, special categories of personal
data)
Ø violation of the rules on data
transfers
17

www.ictlegalconsulting.com© 2018 ICT Legal Consulting – All rights reserved 18
Stay updated!
ictlegalconsulting.com/eng/newsletter/
Thank you for your attention!
Anastasia Botsi – Associate, LL.B.
anastasia.botsi@ictlegalconsulting.com

Awards
19

"Legal tips and compliance requirements" - Anastasia Botsi, ICT Legal

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a "Legal tips and compliance requirements" - Anastasia Botsi, ICT Legal

Similar a "Legal tips and compliance requirements" - Anastasia Botsi, ICT Legal (20)

Más de Cyber Watching

Más de Cyber Watching (7)

Último

Último (20)

"Legal tips and compliance requirements" - Anastasia Botsi, ICT Legal