GDPR – Data Portability

GDPR – Data Portability

• 1.
  GDPR – IndividualRights 1. Right to be informed 2. Right to access (SAR) 3. Right to rectification 4. Right to erasure ( right to be ‘forgotten’) 5. Right to restrict processing 6. Right to data portability 7. Right to object 8. Right related automated decision making and profiling
• 2.
  Elements of dataportability • Access to personal data based on consent or contract (which data subject is a party) • Strictly limited to automated processing by Data Controller • Data must be structured, commonly used and machine readable • Access to data subject’s personal data without ‘hindrances’ by other data controllers • Limited to information provided by data subject • Includes information generated due to use of service • Excludes inferred information generated by data controller • Must consider third party personal data during transfer - individual rights/personal use and • Data transfer between data controllers ought to be ‘interoperable’
• 3.
  GDPR – DataPortability Access Request Data portability Time One month One month Type of data All personal data •Personal data provided to a controller; •Processing based on consent or for the performance of a contract; and •Processing is carried out by automated means. fee Possibly ( excessive and repetitive) Free of charge Proof of identity Yes – drivers licence, recent utility bill etc. Yes – password or unique identifier Procedure Individual/third party Individual/third party (other than solicitors firm). Request extension Two months ( write to explain reason for extension within a month) Two months ( write to explain reason for extension within a month)
• 4.
  Way forward • Checkyour business areas for data portability and inform team leader • Website and Intranet will be updated re: changes ( before the end of the next financial year i.e. 2017 - 18) • Develop templates to support process?