Here the complete recorded presentation for the speach "GDPR & AML what can go wrong" :

<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/dcloDlNi554" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

A general presentation General Data Protection Regulation (GDPR) within the context of AML (KYC) 

GDPR and AML, what can go wrong ?


The General Data Protection Regulation (GDPR) has revolutionized organizational data privacy practices with the introduction of the Data Protection Officer (DPO) role. Recognized as a crucial element for privacy management, the GDPR mandates the involvement of the DPO in all aspects of personal data protection. This key position underscores the pivotal role of the DPO in guiding and shaping an organization's data privacy strategies.

Under the GDPR, it is incumbent upon organizations to provide the DPO with the necessary resources and access to data and operations. This support is essential for the DPO to effectively oversee and influence the organization’s data protection policies and procedures.

In this discussion, we delve into the DPO's position within the GDPR framework, examining their responsibilities, the importance of their role in ensuring compliance, and the fundamental need for their operational independence.

## The DPO has to be involved in all issues related to personal data

One of the foundational aspects of the Data Protection Officer's (DPO) role is their mandatory involvement in all matters pertaining to personal data within an organization. This requirement ensures that the expertise and guidance of the DPO are integral to the organization's data handling processes. 

The DPO's involvement spans the entire spectrum of data processing activities. From the initial stages of data collection to the final phases of data deletion or archiving. This ensures that all aspects of data handling are scrutinized and aligned with GDPR requirements. At the outset of data collection, the DPO advises on the legality, transparency, and fairness of the data collection methods. They ensure that the principles of data minimization and purpose limitation are adhered to, preventing the unnecessary accumulation of data and clarifying the purposes for which the data is collected.


## The DPO receives necessary ressource 

The GDPR mandates that organizations must equip their DPO with the necessary resources, including access to personal data and processing operations. This requirement goes beyond mere logistical supportas it also encompasses various forms of assistance that enable the DPO to perform their role comprehensively.

Access to data and processing operations is fundamental for the DPO to gain a thorough understanding of how data is handled within the organization. This access allows the DPO to provide informed advice, conduct accurate compliance monitoring, and effectively manage data protection risks.

Equally important is the provision of tools and personnel. The DPO may require specific software to monitor compliance or personnel support for extensive data protection initiatives. Ensuring that the DPO has these resources at their disposal is vital for the efficient execution of their duties.

Another crucial resource is the opportunity for the DPO to maintain and update their expert knowledge. This includes ongoing training, attending relevant data protection seminars, and staying abreast of the latest developments in data protection laws and practices. 

The allocation of resources to the DPO has a direct impact on their effectiveness and, by extension, on the organization's data protection posture. Without adequate support, a DPO's ability to ensure GDPR compliance and safeguard personal data can be significantly hindered. On the other hand, well-resourced DPOs can proactively address data protection challenges, guide the organization effectively through the complexities of GDPR, and foster a culture of data privacy and security.


## No Instructions: Upholding the DPO's Independence

A cornerstone of the Data Protection Officer's (DPO) role within the GDPR framework is their operational independence. Organizations must ensure that the DPO does not receive any instructions regarding the execution of their tasks. This independence is crucial for allowing the DPO to perform their duties without any conflict of interest or undue influence.

The provision that the DPO should not receive instructions about their tasks underlines the need for unbiased decision-making in data protection matters. This autonomy allows the DPO to objectively assess the organization’s data processing activities and provide impartial advice and recommendations. It ensures that their judgment is not swayed by organizational biases or pressures.

The GDPR explicitly protects the DPO from being dismissed or penalized for performing their tasks. This safeguard is critical in allowing the DPO to enforce data protection regulations without fear of repercussions, particularly in situations where they may need to challenge the organization's practices or bring attention to areas of non-compliance.

Another key aspect of the DPO’s independence is their direct reporting line to the highest management level within the organization, be it the controller or the processor. This reporting structure emphasizes the significance of the DPO’s role and ensures that their insights and recommendations are given due consideration. It places the DPO in a strategic position to influence decision-making and reinforces their authority within the organization.


## Handeling data subject requests


A significant aspect of the Data Protection Officer’s (DPO) role under the GDPR is to be the point of contact for data subjects concerning the processing of their personal data and the exercise of their rights. This responsibility underscores the DPO’s role in bridging the gap between the organization and the individuals whose data it processes.

The GDPR grants individuals various rights regarding their personal data, such as the right to access, rectification, erasure, and data portability. The DPO plays a crucial role in facilitating the exercise of these rights. They are responsible for ensuring that data subjects can easily contact them and receive timely and appropriate responses to their queries or concerns.

The DPO handles inquiries from data subjects about data processing practices and responds to requests for exercising their rights under the GDPR. This involves coordinating with relevant departments within the organization to gather the necessary information or to take action on the requests.

In dealing with data subject requests, the DPO ensures that the organization's responses comply with GDPR requirements. This includes adhering to response timeframes, ensuring the clarity and accessibility of information provided, and maintaining the confidentiality and security of personal data during the process.

Some data subject requests may be complex, involving nuanced interpretations of data protection laws. The DPO provides expertise in these situations, advising on the legal obligations and best practices for handling such requests.


## DPO's work is subject to confidentiality 




## DPO might do other tasks, as long as no conflict of interests 





## Details of article 38 

> Article 38 Position of the data protection officer
> 1.   The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
> 2.   The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
> 3.   The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.
> 4.   Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.
> 5.   The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law.
> 6.   The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.





Position of the data protection officer (DPO) in the GDPR

The notion of personal data is without question the most important component of the GDPR, because **it defines if GDPR applies or not**. If an organization is processing personal data it is mandatory to ensure compliance with all provisions of the GDPR (99 articles - 100 pages). However, none of these obligations will apply if no personal data is involved. Let's illustrate that by a diagram :

<center><img src="/img/blog/what-is-personal-data-gdpr.png" alt="Personal data" style="width:60%;"/></center>

So understanding what is personal data has real important consequences. Let's dive into the notion.

## I. - The notion of personal data and first examples

The simplest way to understand personal data is : any data that allows to identify directly or indirectly a natual person. It's very a simplified version of the legal definition given by article 4, but it has the benefit of being extremely clear and handle 90% of the situations. Now let's look at a few practical examples.

**Here are some practical examples of personal data :**
- A first name combined with a last name 
- A social security number
- An IP address - as long as there's a natural person behind it 
- A photo of a person
- The recording of a person's voice
- Licence plates
- Someone's CV
- A person's LinkedIn profile

E-commerce orders naturally process personal data : 

<center><img src="/img/blog/personal-data-e-commerce.png" alt="Personal data" style="height: 400px; margin-bottom:40px;" /></center>

**Personal data is not private data**

Personal data is frequently confused with private data - as taken in the sense of "my personal diary" or as data that is intimate to a person. The legal definition is much broader: any data that allows the identification of a person enters the GDPR's scope.

In real life, personal data are always integrated into personal data processing. For example, a company collects emails for its newsletter. Once we've identified that an organization is processing personal data, it's important to be able to record the fact that there is personal data processing, as this is required by law. Let's take a few examples of personal data processing.

## II. - Examples of personal data processing

Here are some classical examples of personal data processing for which organizations will need to ensure compliance:

- HR : recruitment (CV, LinkedIn...), employee payment processes
- Marketing : a newsletter, a blog 
- Sales: CRM
- IT : logs, company's email & messaging, backups
- Operations : company's phones, renting offices...

Let's now look a bit deeper into the legal definition.

## III. - The legal definition of personal data 

So far, we've introduced a simple definition that is great for a first understanding of the concept but that is also imperfect. So let's take look at its exact definition.

The notion of personal data has been defined in [article 4](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN): 

>For the purposes of this Regulation:
>(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Recital 26 also has interesting developments in regard to anonymisation of personal data : 
>The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Recital 30 also has interesting developments : 
>Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.


## 4. So you are processing personal data, now what?

As we said, the main consequence of personal data processing is that GDPR will apply. This also means that each data processing will have to be integrated into a compliance process, as well as recorded into the records of processing activities as required by article 30.

[Legiscope helps controllers to automate these obligations](https://www.legiscope.com) and currently reduces the time needed to fill up the records of processings from multiple weeks of work to a few minutes for most standard processing activities. [Check us out!](https://www.legiscope.com)

The notion of personal data is one of the most important notions in GDPR compliance. Here's everything you need to know about it

What is personal data ?


One of the fundamental principles enshrined in the General Data Protection Regulation (GDPR) is the principle of data minimization. This principle, outlined in Article 5 of the GDPR, mandates that personal data collected and processed by organizations must be adequate, relevant, and limited to what is necessary for the specific purposes for which it is processed. In this article, we will delve into the importance of data minimization, its practical implications, and how organizations can ensure compliance with this crucial aspect of the GDPR.

## I - Understanding the Principle of Data Minimization

The principle of data minimization is a cornerstone of data protection and privacy. It aims to ensure that organizations collect and process only the personal data that is strictly necessary for the intended purposes. By adhering to this principle, organizations can reduce the risks associated with data breaches, unauthorized access, and misuse of personal information.

### A - Key Elements of Data Minimization

The GDPR breaks down the principle of data minimization into three key elements:

1. **Adequacy**: The personal data collected must be sufficient and appropriate for the specified purposes. Organizations should carefully consider what data is truly necessary to achieve their goals and avoid collecting excessive or irrelevant information.

2. **Relevance**: The collected data must be directly related to the purposes for which it is processed. Organizations should ensure that there is a clear and justifiable link between the data they collect and the intended use of that data.

3. **Necessity**: The data collected should be limited to what is absolutely necessary for the specified purposes. Organizations should critically evaluate their data collection practices and eliminate any data fields or categories that are not essential.

### B - Benefits of Data Minimization

Implementing the principle of data minimization offers several benefits to both organizations and individuals:

1. **Enhanced Data Security**: By collecting and storing only the necessary data, organizations reduce the potential impact of data breaches. If a breach occurs, the amount of compromised data is minimized, limiting the harm to individuals and the organization's reputation.

2. **Improved Data Quality**: Focusing on collecting only relevant and necessary data helps ensure the accuracy and quality of the information. It reduces the likelihood of errors, inconsistencies, and outdated data, leading to more reliable and effective data processing.

3. **Increased Trust and Transparency**: Adhering to data minimization demonstrates an organization's commitment to protecting individuals' privacy rights. It fosters trust and transparency in the relationship between the organization and its customers or users.

## II - Implementing Data Minimization in Practice

To effectively implement the principle of data minimization, organizations should take a proactive approach and embed it into their data collection and processing practices.

### A - Data Mapping and Inventory

The first step in implementing data minimization is to conduct a thorough data mapping and inventory exercise. Organizations should identify all the personal data they collect, process, and store. This includes understanding the sources of the data, the purposes for which it is used, and the retention periods.

By creating a comprehensive data inventory, organizations can assess whether the collected data is adequate, relevant, and necessary for the specified purposes. They can identify any excessive or unnecessary data collection and take steps to eliminate or minimize it.

### B - Privacy by Design and Default

The GDPR emphasizes the concept of privacy by design and default. This means that data protection should be integrated into the design and development of systems, processes, and products from the outset.

When designing data collection forms, applications, or systems, organizations should apply the principle of data minimization. They should carefully consider what data fields are essential and eliminate any unnecessary or optional fields. Default settings should be configured to collect the minimum amount of data required.

### C - Regular Data Review and Deletion

Data minimization is an ongoing process that requires regular review and maintenance. Organizations should establish procedures to periodically review the personal data they hold and assess its continued relevance and necessity.

If certain data is no longer needed for the original purposes or has exceeded its retention period, it should be securely deleted or anonymized. This helps prevent the accumulation of unnecessary data and reduces the risks associated with data breaches or unauthorized access.

### D - Staff Training and Awareness

Effective implementation of data minimization relies on the awareness and cooperation of all individuals within an organization. Organizations should provide regular training and guidance to their staff on the principles of data minimization and their responsibilities in upholding it.

Employees should be encouraged to critically evaluate data collection practices, question the necessity of certain data fields, and suggest improvements to minimize data collection. Creating a culture of data minimization within the organization is crucial for sustained compliance.

## III - Challenges and Considerations

While the principle of data minimization is straightforward in concept, its practical implementation can present challenges for organizations.

### A - Balancing Business Needs and Data Minimization

Organizations often face the challenge of balancing their legitimate business needs with the requirements of data minimization. In some cases, collecting additional data may be seen as beneficial for improving services, personalizing experiences, or generating insights.

However, organizations must carefully assess whether the potential benefits outweigh the risks and whether the additional data collection is truly necessary. They should explore alternative approaches that can achieve similar goals while minimizing the collection and processing of personal data.

### B - Ensuring Data Quality and Accuracy

Data minimization should not compromise the quality and accuracy of the data collected. Organizations must strike a balance between collecting sufficient data to ensure the accuracy and completeness of their records while still adhering to the principle of minimization.

This may require implementing robust data validation and verification processes to ensure that the collected data is accurate, up to date, and free from errors or inconsistencies.

### C - Addressing Legacy Systems and Data

Many organizations have legacy systems and databases that were designed and implemented before the GDPR came into effect. These systems may collect and store excessive or unnecessary personal data.

Addressing data minimization in legacy systems can be challenging, as it may require significant modifications or even the replacement of existing systems. Organizations should prioritize the review and remediation of legacy systems to ensure compliance with the principle of data minimization.

## Conclusion

The principle of data minimization is a fundamental aspect of the GDPR that aims to protect individuals' privacy rights and reduce the risks associated with excessive data collection and processing. By collecting only adequate, relevant, and necessary personal data, organizations can enhance data security, improve data quality, and foster trust with their customers and users.

Implementing data minimization requires a proactive approach, including data mapping and inventory, privacy by design and default, regular data review and deletion, and staff training and awareness. While challenges may arise in balancing business needs and ensuring data quality, organizations must prioritize data minimization to achieve GDPR compliance and demonstrate their commitment to data protection.

By embracing the principle of data minimization, organizations can navigate the complexities of the GDPR, safeguard individuals' privacy rights, and build a strong foundation for responsible and ethical data practices.


The GDPR requires organizations to adhere to the principle of data minimization when collecting and processing personal data.

The Principle of Data Minimization in the GDPR

Beware not to confuse the DPO the **"Data Protection Officer"** (GDPR) and the **"Data Privacy Officer"** (not a GDPR concept)! And the reason is that the GDPR has a very specific view of the DPO : **the data Protection officier is NOT in charge of ensuring compliance with the GDPR**. That's the role of the Controller, not the DPO! Let's clarify this important distinction, often misunderstood by businesses who designate a DPO and discover after that the need additionnal staff to ensure compliance.

## I. - The DPO is not responsible for compliance

Within the GDPR, the Data Protection Officer has a very specific function, which is to **act independently from the Controller and ensure the GDPR is correctly implemented**. The DPO belongs in a way to the control departement. He's here to ensure the work is done properly, he's not here to do the work in the first place. A simple way to view the DPO is to see him as an employee of a data protection authority, but paid by the Controller of course. 

**Why the DPO is fundamentaly independant**

To understand why the DPO was created, we have to come back to the EU directive 95/46 (the directive that basically created data protection rules in Europe in 1995, before the GDPR was adopted as a regulation). This directive set the following structure : 

- before carrying out any data processing operation an organization had to inform the supervisory authority 
- with two exceptions to that rule : 
 - for certain types of processing activities that were unlikely to "affect adversely the rights and freedoms of data subjects" (no risks), no information was needed ;
 - or, in the case where the Controller had a "Data Protection Official" (at the time), who *ensured independently* the compliance of the processing activities to the law, no formality was needed either.

And this is a very important paradigm because the role of the DPO in the GDPR, inherits from this. Structurally, his duties are to ensure *independently* that the regulation is applied in the organization, and causes no substantial risks to data subjects. The DPO is here to review the work, not to do the work in the first place! 

This structure was established at a time when mostly big businesses were conducting data processing activities (in 1995...): banks, insurances, hospitals, etc. And the legislator assumed these businesses had :
- an IT team to handle the processing activities
- a legal teams to handle the compliance 
- and therefore could easily appoint an independent official within the structure that could verify independently that everything was done according to the legislative plan

There are a lot of consequences of this position : 
1. The DPO is always independent from the Controller: he can not be sanctionned by the Controller for doing his work. He can not receive instructions from the Controller either. The DPO has to be properly informed of all processing operations (as well as have all qualifications necessary to handle compliance work). 
2. The DPO can not be liable for the Controller's non-compliances: it is the Controller who assumes the compliance and all legal risks of his operations. The DPO is there only to verify that the work is done properly and offer a review of where the Controller is in terms of data privacy.


## II. When do organizations really need a DPO?

There are 3 cases in which the appointment of a DPO is mandatory:

1. when the controller is a public authority or a public body, with the exception of courts acting in the exercise of their judicial function
2. when the organization's core activities require regular and systematic tracking of people on a large scale
3. when the activities of the organization consist of large-scale processing of health data, for example (more generally Article 9 or 10 data)

**In all other cases, the appointment of a DPO is optional**. However, it's practically always necessary to have a person in charge of the compliance inside the organization.


### A. - Who can be apointed as DPO?

Anyone who at least has taken a [two days training on GDPR compliance](https://www.legiscope.com). The training of the DPO is an obligation to be able to perform these functions.

### B. - The Tasks of the DPO

The data protection officer shall have at least the following tasks:
1. *Inform and advise* the controller or processor and the employees who carry out the processing on their obligations under this Regulation and other provisions of Union or national law. Member States on data protection;
2. *Monitoring compliance with the GDPR, including with regard to the distribution of responsibilities, awareness and training of staff involved in processing operations, and audits
3. *Provide advice* on data protection impact assessment and verify its execution under Article 35
4. *Cooperate with the supervisory authority*
5. *Act as a contact point* for the supervisory authority on matters relating to the processing, including the prior consultation referred to in Article 36, and carry out consultations, where appropriate, on any other matter.

In general, the DPO also assists in the creation and updating of the register of processing activities.The DPO has to perform his tasks with due regard to the risk associated with processing operations.

### C. - Position of the DPO

The Controller has a certain number of duties regarding the DPO, he has to :

- ensure the DPO is involved in all issues which relate to the protection of personal data ;
- support the DPO in performing his tasks, by providing all necessary resources to carry out his mission as well as all access to personal data and processing operations, and tools to maintain his or her expert knowledge.

The DPO *does not receive any instructions regarding the exercise of those tasks*. He or she shall not be dismissed or penalized by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.

Data subjects may contact the data protection officer about all issues related to the processing of their data and to the exercise of their rights under this Regulation.

The DPO is bound by secrecy or confidentiality concerning the performance of his or her tasks. He may fulfill other tasks and duties however, the controller has to ensure that any such tasks and duties do not result in a conflict of interests.

The DPO - the Data Protection Officer, is the person in charge of GDPR compliance management. Details on his functions and missions

Role and missions of the Data Privacy Officer (GDPR)



Implementing **Article 28 of the General Data Protection Regulation (GDPR)** is a cornerstone for organizations that process personal data on behalf of data controllers. In an era where data flows seamlessly across organizational and geographical boundaries, understanding and adhering to Article 28 is essential for maintaining trust and mitigating risks associated with data breaches and non-compliance. The regulatory landscape surrounding data protection has evolved to become more stringent, placing significant emphasis on the necessity for organizations to establish clear contractual obligations and robust security measures to safeguard personal data.

The significance of Article 28 lies in its delineation of the responsibilities and obligations of data processors, ensuring that data controllers retain control over their personal data even when processing is outsourced. As businesses increasingly rely on third-party processors for various operational functions, the importance of comprehensively understanding and effectively implementing Article 28 cannot be overstated. Failure to comply not only results in substantial financial penalties but also irreparably damages an organization's reputation and erodes stakeholder trust.

This article provides a comprehensive exploration of Article 28, examining its legal obligations, analyzing notable sanction cases, and offering practical guidance for organizations striving to achieve GDPR compliance. By fostering a thorough understanding of Article 28, companies can enhance their data protection strategies, thereby building and maintaining trust within their data processing operations.

## I. Understanding Article 28: Obligations for Data Processors

Article 28 of the GDPR establishes the foundational framework governing the relationship between data controllers and data processors. According to [Article 28.1](https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2423-1), a data processor is mandated to act solely on documented instructions from the data controller, ensuring that all personal data processing activities are aligned with the controller’s directives. This provision is critical in maintaining the controller's autonomy over data processing activities, preventing processors from deviating from agreed-upon instructions, and ensuring that data processing remains within the bounds of the controller’s intentions.

Moreover, [Article 28.3](https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2678-1) stipulates that data processors must implement appropriate technical and organizational measures to secure personal data against unauthorized access, alteration, or destruction. This includes utilizing encryption, pseudonymization, and robust access controls to protect data integrity and confidentiality. The evolving landscape of cyber threats necessitates that data processors continuously adapt their security measures to effectively safeguard personal data, ensuring compliance with the high standards set forth by the GDPR.

In addition to security measures, Article 28 requires data processors to maintain a detailed record of processing activities, as outlined in [Article 28.7](https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2803-1). These records must encompass the nature of processing, categories of data subjects, types of personal data processed, and the duration of processing activities. Maintaining comprehensive records not only facilitates accountability but also enables supervisory authorities to efficiently assess the processor's compliance with GDPR requirements. This level of documentation is essential for demonstrating adherence to regulatory standards and for conducting effective audits and reviews.

Furthermore, [Article 28.4](https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2685-1) addresses the obligations related to sub-processing. It requires data processors to obtain prior written authorization from the data controller before engaging any sub-processors. This ensures that the same level of data protection is maintained throughout the entire processing chain, preventing potential gaps in compliance and security. By enforcing stringent controls over sub-processing activities, Article 28 safeguards the integrity of the data processing framework and ensures that all parties involved adhere to the established data protection standards.

The contractual relationship between data controllers and processors is another pivotal aspect of Article 28. Establishing Data Processing Agreements (DPAs) is essential to formalize roles, responsibilities, and expectations. These agreements should explicitly outline the scope and purpose of data processing, ensuring that processors understand and adhere to the controller’s requirements. By doing so, organizations can mitigate risks associated with data handling and ensure that all processing activities are conducted within the legal framework established by the GDPR. For further guidance on drafting effective DPAs, refer to [ICO's DPA Guidelines](https://ico.org.uk/for-organisations/guide-to-data-protection/contracts-with-data-processors/).

## II. Sanctions and Case Studies: Learning from Enforcement Actions

The enforcement of Article 28 has led to significant sanctions against organizations failing to comply with GDPR requirements, underscoring the regulatory authorities' commitment to data protection. Analyzing these cases provides valuable insights into the practical implications of non-compliance and highlights critical areas organizations must address to adhere to Article 28.

One notable case is the sanction imposed on British Airways for a data breach that compromised the personal data of approximately 500,000 customers. The Information Commissioner's Office (ICO) scrutinized the contractual arrangements between British Airways and its data processors, highlighting deficiencies in the security measures implemented, which directly contravened [Article 28.3](https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e2678-1). This case underscores the necessity for comprehensive security measures and regular audits to ensure that all contractual obligations are met and that personal data is adequately protected. A detailed analysis of this case can be found in [British Airways GDPR Fine](https://www.bbc.com/news/technology-55544037).

Similarly, Marriott International faced substantial fines following a data breach that affected millions of customers globally. The ICO's investigation revealed that Marriott's data processors did not adhere to the security protocols stipulated in their contractual agreements, resulting in unauthorized access to personal data. This case emphasizes the criticality of ensuring that data processors not only comply with contractual obligations but also implement robust security measures as mandated by Article 28. The implications of this case are further discussed in [Marriott GDPR Sanctions](https://www.theguardian.com/business/2020/oct/20/marriott-data-breach-gdpr-fine).

Another significant sanction involved a European healthcare provider that failed to ensure its data processors implemented adequate technical and organizational measures. The supervisory authority found that the healthcare provider did not sufficiently monitor its processors' compliance with GDPR requirements, leading to unauthorized disclosures of sensitive patient data. This case illustrates the dual responsibility of data controllers to both select compliant data processors and continuously oversee their adherence to Article 28 obligations. Insights into this case can be found in [Healthcare GDPR Compliance](https://www.dataguidance.com/news/eu-healthcare-company-fined-over-gdpr-breach).


## III. Practical Implementation: Strategies for Ensuring Compliance and Building Trust

Ensuring compliance with Article 28 necessitates a strategic approach that encompasses legal, technical, and organizational dimensions. By adopting a multifaceted strategy, organizations can effectively navigate the complexities of GDPR compliance, mitigate risks, and build trust with stakeholders.

A foundational step involves meticulously drafting Data Processing Agreements (DPAs) that reflect the stipulations of Article 28. These agreements must explicitly outline the scope of data processing, the security measures to be implemented, and the protocols for handling data breaches. Organizations should ensure that DPAs include detailed provisions regarding the purpose and scope of processing, roles and responsibilities of each party, stringent security measures, and clear guidelines for sub-processing authorization. By doing so, organizations can create a robust contractual framework that safeguards personal data and ensures that all parties involved understand their obligations. For guidance on drafting effective DPAs, consult [ICO's DPA Guidelines](https://ico.org.uk/for-organisations/guide-to-data-protection/contracts-with-data-processors/).

In addition to contractual arrangements, investing in advanced security technologies is essential for protecting personal data effectively. Implementing encryption and pseudonymization techniques can significantly reduce the risk of data breaches, while regular security assessments and penetration testing can identify and mitigate potential vulnerabilities. Adopting role-based access controls (RBAC) and multi-factor authentication (MFA) further enhances data security by ensuring that only authorized personnel can access sensitive information. Collaborating with IT security experts and utilizing tools offered by compliance software, such as those provided by [Legiscope](https://www.legiscope.com), can streamline the implementation of these measures, ensuring that organizations maintain a high standard of data protection.

Beyond technical measures, fostering a culture of data protection within the organization is crucial for sustaining compliance and building trust. Training employees on GDPR requirements and the importance of data security can enhance their awareness and adherence to best practices. Establishing a designated Data Protection Officer (DPO), as outlined in [our blog](https://www.legiscope.com/blog/gdpr-dpo-tasks.html), can further reinforce the organization's commitment to data protection, serving as a point of contact for supervisory authorities and data subjects alike. Regular training programs, clear data protection policies, and encouraging a proactive approach to data security are integral to cultivating a data protection-centric organizational culture. 

Moreover, utilizing specialized compliance tools and software can significantly simplify the implementation of Article 28 requirements. Platforms like [Legiscope GDPR Compliance Platform](https://www.legiscope.com) offer features such as automated DPA generation, compliance checklists, and real-time monitoring of data processing activities. These tools help organizations manage their compliance obligations more efficiently, reducing the likelihood of human error and ensuring that all regulatory requirements are consistently met. By leveraging such technologies, organizations can enhance their data protection strategies while saving valuable time and resources.

Regular audits and assessments are essential for verifying ongoing compliance with Article 28 and identifying areas for improvement. Organizations should establish a routine schedule for conducting internal audits, assessing the effectiveness of security measures, and ensuring that all data processing agreements remain up-to-date with current regulations and business practices. Effective auditing involves defining clear objectives, developing comprehensive checklists based on GDPR requirements, engaging independent auditors for unbiased evaluations, and documenting findings and corrective actions meticulously. These practices enable organizations to maintain continuous compliance and address any emerging vulnerabilities proactively.

Managing international data transfers is another critical component of Article 28 compliance, especially for organizations operating across borders. The GDPR imposes strict rules on transferring personal data outside the European Economic Area (EEA), requiring appropriate safeguards to protect data subjects' rights and freedoms. Organizations must navigate adequacy decisions, implement Standard Contractual Clauses (SCCs), and adopt Binding Corporate Rules (BCRs) where applicable. Ensuring that all international data transfers comply with GDPR standards is essential for maintaining data protection and avoiding regulatory penalties. Comprehensive guidelines on international data transfers can be found in [EU Commission's GDPR International Transfers](https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).


## Conclusion

Article 28 of the GDPR serves as a cornerstone in the regulatory landscape, delineating the responsibilities of data processors and establishing a framework for secure and compliant data processing practices. The significant sanctions imposed on organizations for non-compliance underscore the criticality of adhering to Article 28's provisions, emphasizing the necessity for robust contractual agreements, advanced security measures, and continuous oversight.

For organizations striving to navigate the complexities of GDPR compliance, adopting a multifaceted approach that integrates legal, technical, and organizational strategies is essential. Leveraging compliance software solutions, such as those offered by [Legiscope](https://www.legiscope.com), can streamline the implementation of Article 28 requirements, saving valuable time and resources while ensuring steadfast adherence to regulatory standards.

Moreover, fostering a culture of data protection, conducting regular audits, and staying informed about future regulatory trends are crucial for maintaining compliance and building trust with stakeholders. By embracing the comprehensive guidelines and practical strategies outlined in this article, companies can establish a resilient and trustworthy data processing framework that aligns with both legal obligations and ethical imperatives. Additionally, exploring resources like [Legiscope's blog](https://www.legiscope.com/blog.html) can provide ongoing insights and updates to support continuous improvement in data protection practices.

Ultimately, the effective application of Article 28 not only safeguards personal data but also fosters trust among stakeholders, reinforcing the organization's commitment to data protection. As data continues to play an integral role in business operations, prioritizing compliance with Article 28 will remain essential for organizations aiming to thrive in a data-driven world.

An in-depth analysis of Article 28 of the GDPR, focusing on data processor obligations, sanctions, and practical implementation tips to ensure compliance and build trust.

Article 28 of the GDPR: Obligations, Enforcement, and Compliance Strategies

The question of how to validly obtain consent under the GDPR generates a lot of discussion, even though the problem is quiet often simple to address. In this practical guide, we will look at how to obtain a legally valid consent under the GDPR and how to comply with all the conditions imposed by the regulation.

It is important to ensure that this process is properly followed, because in case of default, national control authorities can request the deletion of all data that has not been validly collected. It has already done so in two major cases in which the CNIL for example ordered the deletion of 14 million, then 60 million prospect data! This can have drastic consequences on a business's marketing and sales.

Given the damage this can cause to a company, ensuring the validity of this process is a mandatory compliance point in terms of GDPR.

Note that if you are using [Legiscope](https://www.legiscope.com) you can perform an automated audit of your web forms, which allows you to know if you are compliant or not in a few clicks, all thanks to AI !


## I - Only ask for consent in certain cases!

The first mistake to avoid, and the first element to understand is that consent should only be requested in certain cases. We will see some examples before looking at the legal text.

### A - Examples where consent must be requested (or not)

Traditionally, consent is requested for marketing processes such as:
- signing up for a newsletter
- downloading and receiving a guide (e.g. whitepaper...)

However, consent should never be requested in the following cases: 

- for hiring 
- when the law requires collecting and processing personal data (e.g. for invoicing - this is a legal obligation).


### B - What the law states precisely

From a legal point of view, consent is an obligation that drives from Article 6 of the GDPR - and which requires the data controller (generally, the person collecting the data) - to have a _legal basis_. 

#### 1. A "legal basis" is required (permission)

In summary, to legally collect data relating to individuals (email, name, first name), we must ensure that we are in at least one of the following 6 cases: 

>a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
>b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
>c) processing is necessary for compliance with a legal obligation to which the controller is subject;
>d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
>e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
>f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

#### 2. How to determine if the legal basis is really consent?

In practice, we can determine the need to request consent by eliminating the other legal bases, as follows: 

- does the law require us to collect personal data (e.g. in HR matters, retirement obligations, in commercial matters, invoicing)? If so, the legal basis is then the legal obligation, and there is no need to request consent.
- is the data of the data subject processed as part of a contractual relationship - for example, an e-commerce site? In this case, the legal basis is the performance of pre-contractual measures or the performance of a contract. However, be careful, because only the data necessary for this contract can be validly collected! For example, signing a person up for a newsletter following a purchase will not fall under the contract, but under consent.
- are we in another case (example: a person arrives at a hospital in a coma and the person needs a transplant, the legal basis will then be the safeguarding of their vital interests).
- failing that, we can rely on consent

#### 3. Be careful not to put everything under a single legal basis

However, be careful to ensure that the personal data is really necessary for this legal basis. The case of the e-commerce site is a good example : here the data controller needs to collect data for invoicing (the legal basis = legal obligation), and for payment management (the legal basis = contract), as well as for the order and its shipment, such as the person's address and email (legal basis = contract). The controller can also ask the data subject to include the person's email to send them promotions (legal basis = consent).

Assuming that we are in a situation where we need to obtain the consent of the person, there are then two essential conditions to comply with.

## II - The two essential conditions to respect to obtain valid GDPR consent 

The legal definition of consent is given to us by Article 4 of the GDPR: 

> "consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

In fact, behind this definition, there are two essential conditions that are imposed by the GDPR: there must be a positive act by the person (A), and the person must be clearly informed of what will be done with their data (B).

### A - We need a positive act by the data subject

For consent to be validly collected, there must first be a positive act by the person. In fact, this is an old legal problem which is whether silence can mean consent. The answer in the GDPR is - fortunately no! Without this, the GDPR would open to significant abuses. For consent to be validly collected, the person must therefore perform a positive act themselves - such as entering their personal data themselves in a collection form.

However, the GDPR does not necessarily require a checkbox! A checkbox can be the manifestation of a positive act, but it is not necessarily so. In fact, a person who adds their email address themselves in a form performs a positive act that is sufficient to validate this condition imposed by the GDPR.

What is important is that the action comes from the person themselves. For example: 

- it would be illegal to collect emails on forums and send commercial advertisements to people
- it is illegal to add one's contacts to a commercial newsletter without having asked people for their consent beforehand.

### B - The data subject must be informed of what will be done with their data

The GDPR has added more legal conditions, but we can summarize things as follows: the person whose data is processed must be clearly informed of what will be done with their data. 

And this is essential, otherwise how could they consent to anything? How to consent to data being processed for example for a newsletter if the person is not clearly informed of it? 

From a legal point of view, the GDPR imposes several additional conditions, in order to ensure that the consent given is indeed informed: 

- there must be a free expression of will that must not be constrained or influenced (e.g. a person who is forced to give their consent does not validly consent; we typically find this type of situation in labor law in which the employer can impose a processing of personal data - in such cases, consent cannot be used as a legal basis. However, it is possible to request consent in labor law matters, but it is necessary to ensure that the person's choice is truly free). Therefore, be careful of power relationships that can block the acquisition of consent 
- consent must be specific: the data subject must consent to something specific, such as receiving a newsletter. But it is not possible to ask them to consent to "any processing of personal data" for example.
- consent must be informed: in general, it is sufficient for this to clearly detail on the collection form what will be done with the personal data 
- and it must be unambiguous (cf. unequivocal), one must not seek to deceive the person for example as to the reality of the processing carried out on this data, and clearly inform them of what is done with their data

The G29 has written very detailed <a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051">guidelines on consent</a> which can be consulted.


## Conclusion: the processes to implement

The main risk for organizations that collect personal data is not validly collecting this data - and then finding themselves in a situation where the CNIL would request the deletion of all the data for example. 

Avoiding this catastrophic scenario is relatively simple, however, provided that precise consent acquisition processes are put in place. The GDPR requires the implementation of a variety of processes and it is advisable to use software to manage them:

Whether for <a href="https://www.legiscope.com">consent acquisition or registry management</a>, tools to automate these processes are essential to save time for organizations.

The GDPR requires the collection of consent from individuals before processing their personal data in certain cases, here's how to do that

How to get a valid consent under the GDPR


    
Data breaches represent one of the most significant challenges for organizations in the digital age. With the increasing volume and sophistication of cyberattacks, the General Data Protection Regulation (GDPR) has established stringent requirements to ensure that personal data is adequately protected. The GDPR not only mandates preventive measures but also prescribes specific protocols that organizations must follow in the event of a data breach. Understanding and effectively handling these breaches is crucial for maintaining compliance, avoiding substantial fines, and preserving the trust of stakeholders.

The GDPR emphasizes the importance of accountability and transparency in data processing activities. Organizations are required to implement appropriate technical and organizational measures to prevent breaches and mitigate their impacts. However, breaches can still occur despite best efforts. In such cases, the GDPR provides a clear framework for responding swiftly and effectively. This article delves into the essential aspects of handling data breaches under the GDPR, offering practical insights and legal analysis to help organizations navigate this complex landscape.

Moreover, the evolving nature of cyber threats necessitates continuous adaptation of data protection strategies. As organizations strive to balance operational efficiency with robust security measures, understanding the legal imperatives and best practices for managing data breaches becomes indispensable. This discussion incorporates relevant legal references, case studies, and practical tips to provide a comprehensive guide for legal professionals and organizational leaders committed to GDPR compliance.

## 1. Legal Obligations and Consequences under GDPR

Under the GDPR, organizations are subject to strict obligations when a data breach occurs. According to [Article 33](https://eur-lex.europa.eu/eli/reg/2016/679/oj), data controllers must notify the relevant supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it. This notification must include specific details such as the nature of the breach, the categories and number of affected individuals, and the measures taken to address the breach. Additionally, if the breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller must also communicate the breach to the affected individuals without undue delay, as stipulated in [Article 34](https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Failure to comply with these requirements can result in severe penalties. The GDPR permits fines of up to €20 million or 4% of the company's annual global turnover, whichever is higher. These fines are tiered based on the nature of the violation, with breaches of basic principles incurring lower penalties compared to infringements related to the rights of individuals or cross-border processing. Moreover, non-compliance can lead to additional consequences, such as enforced audits, orders to cease data processing activities, and mandatory implementation of corrective measures.

Compliance with GDPR's breach notification requirements extends beyond merely fulfilling legal obligations. Organizations must establish a culture of accountability where data protection becomes an integral part of their operations. Non-compliance can lead to not only financial penalties but also significant reputational damage, eroding the trust of customers and partners. The [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) underscores that maintaining robust data protection measures is not just a regulatory requirement but also a cornerstone of sustainable business practices in the digital era. For instance, the [BBC](https://www.bbc.com/news/technology-57148258) reported on the broader impacts of GDPR compliance on business trust and customer relationships.

The consequences of non-compliance are exemplified by several high-profile cases. British Airways was fined €22 million for failing to implement adequate security measures to protect customer data, while Marriott International faced a £18.4 million fine after a breach compromised up to 339 million guest records globally. These cases highlight the financial and reputational risks associated with data breaches and the importance of adhering to GDPR's provisions. Additionally, the Equifax data breach, although occurring before GDPR's implementation, serves as a stark reminder of the extensive ramifications of inadequate data protection measures. The breach exposed sensitive information of approximately 147 million consumers, leading to a significant loss of consumer trust and prompting widespread calls for enhanced data security regulations. 

## 2. Developing Effective Breach Response and Prevention Strategies

Effective breach response strategies are essential for minimizing the impact of data breaches and ensuring compliance with GDPR requirements. Developing a robust incident response plan is the cornerstone of these strategies. This plan should outline the procedures for detecting, reporting, and managing data breaches, ensuring that all relevant stakeholders are aware of their roles and responsibilities. Regular training and simulations can help organizations prepare for potential breaches, ensuring that responses are swift and coordinated.

Preventive measures play a critical role in safeguarding personal data. Implementing advanced detection and monitoring technologies, such as Security Information and Event Management (SIEM) systems and Intrusion Detection Systems (IDS), enhances an organization's ability to identify and respond to potential threats promptly. These technologies provide real-time analysis of security alerts generated by applications and network hardware, enabling organizations to detect suspicious activities early and take proactive measures to prevent breaches. Moreover, the integration of Artificial Intelligence (AI) and Machine Learning (ML) into security systems can significantly enhance threat detection capabilities by analyzing vast amounts of data to identify patterns and anomalies that may indicate a breach.

Adopting practices like encryption, strict access controls, and data minimization reduces the risk of unauthorized access and data exposure. Encryption ensures that data remains unreadable to unauthorized parties, even if they manage to access it. Implementing multi-factor authentication (MFA) and role-based access control (RBAC) limits access to sensitive data to only those individuals who need it for their roles, thereby minimizing the potential for internal breaches. Data minimization, another key principle under GDPR, involves limiting the collection and retention of personal data to what is strictly necessary for the intended purpose. This reduces the overall risk surface by ensuring that less data is available to be compromised in the event of a breach. Further insights into data minimization can be found in [Data Minimization under GDPR](https://www.legiscope.com/blog/data-minimization.html).

Organizations should also consider conducting regular security assessments and vulnerability scans to identify and address potential weaknesses in their security infrastructure. Penetration testing, where ethical hackers simulate attack scenarios, can provide valuable insights into how well an organization can withstand real-world cyber threats. By proactively identifying and mitigating vulnerabilities, organizations can strengthen their defenses and reduce the likelihood of successful attacks. Additionally, staying informed about the latest cybersecurity threats and trends through reputable sources such as [Krebs on Security](https://krebsonsecurity.com/) and [SANS Institute](https://www.sans.org/) can help organizations anticipate and prepare for emerging challenges.

## 3. Building and Maintaining Trust and Accountability

Building and maintaining trust is paramount for organizations handling personal data. Transparency in how data breaches are managed plays a crucial role in fostering this trust. Organizations should communicate openly with stakeholders about their data protection practices and the steps they take to prevent and address breaches. Transparent communication reassures individuals that their data is being handled responsibly and demonstrates the organization's commitment to upholding GDPR standards. For example, clear communication strategies are discussed in Effective Communication Post-Breach.

Adopting a culture of accountability ensures that data protection is ingrained in the organization's operations. This involves senior management demonstrating a commitment to data protection by allocating resources and setting clear policies. Empowering employees to take ownership of data protection tasks and ensuring they understand their roles in maintaining compliance further reinforces this culture. Regular audits and assessments help identify and address vulnerabilities, ensuring adherence to data protection policies. Implementing [Privacy by Design](https://www.legiscope.com/blog/privacy-by-design.html) and Privacy by Default principles, as outlined in [Article 25](https://eur-lex.europa.eu/eli/reg/2016/679/oj), ensures that data protection measures are integrated into the development of business processes and systems from the outset.

The appointment of a qualified Data Protection Officer (DPO) is another critical aspect of maintaining accountability. The DPO plays a pivotal role in overseeing data protection strategies, ensuring compliance, and serving as a point of contact between the organization, the supervisory authorities, and data subjects. A competent DPO can help navigate complex regulatory landscapes, provide training and guidance to staff, and lead the response to data breaches, thereby strengthening the organization's overall data protection framework. Detailed responsibilities of a DPO are elaborated in Role of the Data Protection Officer.

Building trust also involves demonstrating a commitment to data ethics and responsible AI practices. Ensuring fairness, transparency, and accountability in data processing and AI deployment not only complies with GDPR but also fosters stakeholder confidence. Organizations that prioritize ethical data practices are better positioned to maintain long-term relationships with their customers and partners, ultimately contributing to sustained business success.

## 4. Leveraging Technology in Data Breach Management

Technology plays a critical role in both preventing data breaches and managing their aftermath. Leveraging the right technological solutions can significantly enhance an organization’s ability to protect personal data and respond efficiently to incidents. Automation can streamline the incident response process by utilizing AI-driven tools to identify and alert on suspicious activities in real time. Automated response actions, such as predefined response protocols, can be triggered automatically to contain breaches, thereby reducing response time and limiting potential damage.

Data Loss Prevention (DLP) tools help prevent unauthorized data transfers by monitoring data flows within and outside the organization. These tools enforce data protection policies to block or alert on unauthorized data access or movements, ensuring that sensitive personal data is not inadvertently or maliciously exposed. Cloud security solutions are essential as more organizations migrate to cloud-based services, offering advanced encryption, access controls, and continuous monitoring to protect data stored in the cloud. For more information on cloud security best practices.

Regularly updating software and systems through patch management is crucial for preventing breaches. These systems ensure that software patches are applied promptly to address known vulnerabilities, conduct vulnerability assessments to identify and prioritize threats, and maintain compliance reporting for audit purposes.  Implementing endpoint protection solutions, such as antivirus software and endpoint detection and response (EDR) tools, further enhances security by safeguarding individual devices against malware and unauthorized access. Network segmentation can limit the spread of breaches by isolating sensitive data within secure network zones, making it more difficult for attackers to access critical information. Moreover, adopting secure software development practices, including code reviews and security testing, ensures that applications are built with security in mind from the ground up. Integrating security into the software development lifecycle (SDLC) helps identify and mitigate vulnerabilities early, reducing the risk of breaches resulting from software flaws.

By integrating these technological solutions into their data protection and breach management strategies, organizations can enhance their resilience against cyber threats and ensure a more robust and efficient response to data breaches. Embracing emerging technologies, such as blockchain for data integrity and advanced biometrics for authentication, can further bolster security measures and provide additional layers of protection against evolving cyber threats. For insights into the latest technological advancements in data protection..html
## Conclusion

Handling data breaches under the GDPR requires a multifaceted approach that combines legal compliance, effective response strategies, and a commitment to transparency. Organizations must navigate complex regulatory requirements to ensure that they respond promptly and appropriately to breaches, minimizing their impact and maintaining trust with stakeholders. The examples of significant sanctions, such as those imposed on British Airways and Marriott International, illustrate the severe consequences of non-compliance and highlight the critical importance of robust data protection measures.

Implementing a comprehensive incident response plan, investing in advanced detection technologies, and fostering a culture of transparency and accountability are essential steps for organizations aiming to comply with the GDPR and protect personal data effectively. Additionally, appointing a qualified Data Protection Officer, adopting technical and organizational measures to prevent breaches, and staying informed about emerging trends and regulations are crucial for maintaining a strong data protection posture.

As data breaches continue to pose significant threats, the proactive measures outlined in this article provide a practical roadmap for organizations to enhance their data protection strategies and uphold the principles of the GDPR. By doing so, companies not only avoid substantial fines but also reinforce their reputation as trustworthy custodians of personal information. Moreover, embracing a holistic approach that integrates legal, technological, and organizational strategies will enable organizations to adapt to the evolving threat landscape and regulatory environment. This comprehensive strategy ensures that data protection remains a core priority, driving continuous improvement and resilience against future challenges.

For more detailed guidance on GDPR compliance, visit [Legiscope's GDPR compliance platform](https://www.legiscope.com) and explore our [blog](https://www.legiscope.com/blog.html).


Comprehensive guidance on managing data breaches in compliance with GDPR, including legal obligations, case studies, and practical implementation tips.

How to Handle Data Breaches under the GDPR


GDPR information notices are among the mandatory mentions that are important to comply with. Indeed, they will demonstrate whether an organization is in compliance or not with the European regulation.

We will see the list of information to be provided before looking at a practical example.

## I - The List of Information to Provide to be Compliant with the GDPR

The information to be provided to individuals whose personal data is being collected are as follows:

- The identity and contact details of the data controller and, where applicable, the data controller's representative.
- Where applicable, the contact details of the data protection officer;
- The purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
- Where the processing is based on Article 6(1)(f), the legitimate interests pursued by the data controller or by a third party;
- The recipients or categories of recipients of the personal data, if any;
- Where applicable, the fact that the data controller intends to transfer personal data to a third country or international organization, and the existence or absence of an adequacy decision by the Commission, or, in the case of transfers referred to in Article 46 or 47, or Article 49(1) second paragraph, the reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

Additionally, the following supplementary information:

- The duration for which the personal data will be stored, or if that is not possible, the criteria used to determine that duration;
- The existence of the right to request from the data controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject, or to object to processing as well as the right to data portability;
- Where processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- The right to lodge a complaint with a supervisory authority;
- Information as to whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the personal data, and the possible consequences of failure to provide such data;
- The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Note that the data controller is not required to provide these information if a person has already been informed once.

## II - A Practical Example of GDPR Notices

Here is a practical example of an information notice:

> Registration allows you to download the guide and receive communications on GDPR compliance as well as our product and service offers; the legal basis is Article 6.1.a of the European regulation on the protection of personal data (consent); the recipients of data are the data controller, its internal services in charge of the mailing list management, the subcontractor operating the web server management (Dupond Durand), as well as any legally authorized person to access the data (judicial services, if applicable). The duration of data processing is limited to the time you are registered for our communication services, it being understood that you can withdraw your consent and unsubscribe at any time by clicking on the unsubscribe link at the bottom of each email. The server on which the mailing list is hosted is hosted by Durand Durand, which implies that your data may be transferred outside the EU under Article 46.2.d of the GDPR – Durand Durand having provided the adequate protection clauses on the model established and approved by the European Commission. You can find more information about these clauses here: https://durand.durand. You have the right to request the data controller access to personal data, rectification or erasure of such data, or a limitation of the processing concerning the data subject, or the right to object to the processing and the right to data portability. The data controller is SARL Dupont Dupont. You also have the right to lodge a complaint with a supervisory authority. Providing your email is necessary to receive the aforementioned communications and is entirely optional.





Here is the list of GDPR information notices that you must mandatorily provide before collecting personal data

GDPR Information notices, a few things you need to know






The landscape of data protection within the European Union has been significantly shaped by the General Data Protection Regulation (GDPR), which came into effect in May 2018. Central to the enforcement and harmonization of GDPR across member states is the European Data Protection Board (EDPB). As organizations navigate the complexities of data privacy, understanding the role and functions of the EDPB is paramount for ensuring compliance and fostering trust throughout the data processing chain.

The EDPB not only provides authoritative guidance but also plays a crucial role in adjudicating disputes and coordinating actions among national supervision authorities. This article delves into the structure, responsibilities, and impact of the EDPB, highlighting key cases and offering practical insights for organizations aiming to align their operations with GDPR requirements. Through a comprehensive examination of legal frameworks and real-world applications, we aim to elucidate the indispensable role of the EDPB in the European data protection ecosystem.

## I. Structure and Mandate of the EDPB

The European Data Protection Board was established under the GDPR to ensure consistent application of data protection laws across all EU member states. Comprising representatives from each national supervisory authority and the European Data Protection Supervisor (EDPS), the EDPB serves as a collaborative platform for fostering uniformity in data protection practices. Article 68 of the GDPR outlines the composition and governance of the EDPB, emphasizing the importance of representation from each member state to reflect the diverse legal landscapes within the EU.

Each member state nominates one representative to the EDPB, ensuring that the board embodies a broad spectrum of perspectives and experiences. Additionally, the EDPS has the right to appoint one representative to the Board, facilitating close cooperation between the EDPB and the EDPS. This structure not only promotes inclusivity but also ensures that the EDPB’s decisions are balanced and considerate of the varying national contexts within the EU.

The governance of the EDPB is designed to ensure transparency, accountability, and efficiency. The Board operates through plenary sessions, where representatives deliberate on key issues, adopt guidelines, and make binding decisions. Plenary meetings are typically held several times a year, providing a structured environment for comprehensive discussions on emerging data protection challenges and regulatory updates. Decision-making within the EDPB follows a consensus-based approach, fostering collaboration and mutual understanding among member states. In cases where consensus cannot be reached, a majority vote is employed to ensure timely resolutions. This balanced approach allows the EDPB to navigate complex legal and technical issues effectively, maintaining the momentum necessary for dynamic data protection landscapes.

The EDPB’s strategic objectives revolve around promoting uniformity, enhancing supervisory cooperation, and strengthening data protection across the EU. These objectives are operationalized through various initiatives, including the development of detailed guidelines, the facilitation of joint operations among supervisory authorities, and the provision of expert advice to legislative bodies. By prioritizing these strategic goals, the EDPB ensures that data protection remains a dynamic and responsive area of law, capable of addressing new challenges posed by technological advancements and evolving data processing practices.

## II. Enforcement and Compliance Role of the EDPB

The EDPB plays a pivotal role in guiding organizations toward GDPR compliance through the development of comprehensive guidelines and interpretative documents. These resources address various aspects of data protection, ranging from data subject rights to obligations of data controllers and processors. By clarifying ambiguities within the GDPR, the EDPB aids organizations in implementing effective data protection strategies, thereby reducing the risk of non-compliance. For instance, the EDPB’s [Guidelines on Consent under GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) provide detailed criteria for obtaining valid consent, ensuring that organizations understand the importance of clear and affirmative actions from data subjects.

A significant aspect of the EDPB's mandate involves overseeing cross-border data transfers, a topic extensively covered in their [Guidelines on Cross-Border Data Transfers](https://eur-lex.europa.eu/eli/reg/2016/679/oj). The EDPB ensures that data transfers outside the EU adhere to the stringent standards set by the GDPR, safeguarding the privacy rights of individuals irrespective of geographical boundaries. This oversight is particularly important in an era where data flows seamlessly across borders, necessitating robust mechanisms to prevent unauthorized access and data breaches. The EDPB’s guidance on Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) provides a framework for organizations to transfer data securely and legally, ensuring compliance with EU standards.

Furthermore, the EDPB is instrumental in handling complaints and adjudicating disputes related to GDPR violations. Their decisions in high-profile cases set precedents that influence data protection practices across the EU. For example, in the [Google Ireland Data Transfer case](https://eur-lex.europa.eu/eli/reg/2016/679/oj), the EDPB played a crucial role in assessing and sanctioning inadequate data transfer mechanisms, underscoring the necessity for compliant data transfer solutions. The EDPB’s adjudicative power ensures that penalties and sanctions are consistently applied, reinforcing the seriousness of data protection compliance. Organizations can refer to these decisions to better understand the implications of non-compliance and the importance of adhering to GDPR principles such as [purpose limitation](https://eur-lex.europa.eu/eli/reg/2016/679/oj) and [data minimization](https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Significant cases handled by the EDPB, including those involving British Airways and Marriott International, exemplify the Board’s rigorous enforcement of GDPR standards. The substantial fines imposed in these cases serve as stark reminders of the repercussions of failing to implement adequate security measures and timely breach notifications. These instances provide operational lessons for organizations, emphasizing the need for continuous risk assessment, [privacy by design](https://eur-lex.europa.eu/eli/reg/2016/679/oj), and robust data protection frameworks to mitigate potential damages and maintain stakeholder trust.

## III. Impact on International Data Protection Standards

While the EDPB operates within the EU framework, its influence extends beyond European borders. As GDPR sets a global standard for data protection, organizations worldwide look to the EDPB’s guidelines and decisions as benchmarks for their own data protection practices. This global influence is evident in the adoption of similar data protection laws in countries such as Brazil, Japan, and South Korea, which have drawn inspiration from GDPR and, by extension, the EDPB’s interpretations. The EDPB contributes to the harmonization of global data protection practices by promoting principles that prioritize individual privacy and data security. Through its guidelines and advocacy, the EDPB encourages organizations globally to adopt robust data protection measures, fostering a unified approach to safeguarding personal data.

However, aligning with EDPB guidelines can present challenges for non-EU organizations. Variations in local data protection laws and differing interpretations of GDPR principles require organizations to navigate a complex regulatory landscape. The EDPB’s clear and comprehensive guidelines help mitigate some of these challenges by providing detailed frameworks that can be adapted to diverse legal contexts. Nonetheless, organizations must remain vigilant and proactive in ensuring that their data protection practices comply with both EU standards and local regulations. Engaging with resources such as [Legiscope](https://www.legiscope.com) can facilitate this process by automating compliance tasks and providing up-to-date information on legal requirements.

The EDPB’s role in international data protection cooperation is poised to grow, particularly as data flows continue to increase globally. Strengthening cooperation with international regulatory bodies and aligning data protection practices across regions will be essential for addressing cross-border data protection challenges. The EDPB may engage in more bilateral and multilateral agreements to facilitate cooperation and ensure that data protection standards remain high on a global scale. This international collaboration is crucial for maintaining the integrity and effectiveness of data protection measures in an interconnected world.

## IV. Practical Compliance Tips Inspired by the EDPB

Organizations aiming for GDPR compliance can draw valuable insights from the EDPB’s guidelines and decisions. A comprehensive data protection strategy should encompass several key elements to ensure adherence to GDPR principles. Understanding what data is collected, how it is processed, and where it is stored is foundational to GDPR compliance. Conducting regular data inventories helps organizations identify potential risks and ensure that data processing activities align with GDPR principles. Additionally, regularly conducting Data Protection Impact Assessments (DPIAs) to identify and mitigate risks associated with data processing activities is crucial. The EDPB’s Guidelines on DPIAs provide a structured approach for assessing risks and implementing appropriate safeguards.

Integrating data protection into the design of systems and processes ensures that privacy considerations are embedded from the outset. This proactive approach minimizes the potential for data breaches and enhances overall data security. Ensuring that employees are aware of GDPR requirements and understand their roles in maintaining data protection is essential. Regular training programs can help foster a culture of privacy within the organization. Utilizing compliance software platforms like [Legiscope](https://www.legiscope.com) can automate and streamline the compliance process, saving hundreds of hours and reducing operational burdens. By integrating such tools into their data protection strategies, companies can ensure adherence to legal requirements while maintaining operational efficiency and building trust with their stakeholders.

Proactive engagement with the EDPB and national supervisory authorities can further enhance compliance efforts. Organizations should consider seeking guidance or clarification on specific data protection issues, particularly when dealing with complex or cross-border data processing activities. Establishing open lines of communication can help organizations navigate challenges and ensure that their data protection practices remain aligned with regulatory expectations. Additionally, participating in industry forums and working groups facilitated by the EDPB provides valuable opportunities for organizations to share best practices and collaborate on common data protection challenges. This collaborative approach fosters a supportive environment for continuous improvement and innovation in data protection.

## Conclusion

The European Data Protection Board is a cornerstone of the GDPR framework, ensuring cohesive and effective data protection across the European Union. Through its comprehensive guidelines, enforcement actions, and coordination with national supervisory authorities, the EDPB facilitates a unified approach to data privacy, thereby enhancing compliance and fostering trust throughout the data processing chain. Organizations must recognize the significance of the EDPB’s role and actively engage with its resources and directives to navigate the intricate landscape of data protection.

To effectively implement GDPR compliance and leverage the expertise provided by the EDPB, organizations can benefit from tools like [Legiscope](https://www.legiscope.com), a GDPR compliance platform that automates and streamlines the compliance process, saving hundreds of hours and reducing operational burdens. By integrating such compliance software into their data protection strategies, companies can ensure adherence to legal requirements while maintaining operational efficiency and building trust with their stakeholders.

Moreover, staying informed about the EDPB’s latest guidelines and case rulings is essential for continuous compliance and risk management. Resources such as Legiscope’s blog provide valuable insights into various aspects of GDPR, including [data portability rights](https://www.legiscope.com/blog/data-portability-right.html), [the role of the Data Protection Officer](https://www.legiscope.com/blog/gdpr-dpo-designation.html), and [privacy by design](https://www.legiscope.com/blog/privacy-by-design.html), which can further aid organizations in refining their data protection practices. Embracing the guidance and regulatory direction offered by the EDPB will not only ensure compliance but also cultivate a culture of data privacy and security, thereby reinforcing the foundational goal of GDPR to build trust throughout the entire data processing chain.

By understanding and leveraging the role of the EDPB, organizations can navigate the complexities of data protection with greater confidence and efficacy, ultimately fostering a trustworthy and secure data environment. As data continues to be a vital asset in the digital age, the EDPB’s role in shaping and enforcing data protection standards will remain indispensable, ensuring that the rights and freedoms of individuals are upheld across the European Union and beyond.

An in-depth analysis of the European Data Protection Board's role in enforcing GDPR, including legal frameworks, case studies, and practical compliance tips.

The Role of the European Data Protection Board (EDPB)

An in-depth analysis of the right to data portability under GDPR, including legal requirements, implementation strategies, and practical tips for organizations.

The Right to Data Portability Under GDPR: Legal Framework, Implementation, and Enforcement Challenges


The concept of 'legitimate interests' as a legal basis under the General Data Protection Regulation (GDPR) is often misunderstood and misapplied, leading to unnecessary legal risks. This is evident in cases such as the notable sanction against Facebook (now META), which faced a fine of 390 million euros for [improper application of legitimate interests European Court of Justice Decision] (HTTPS:/ /curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageindex=0&doclang=fr&mode=req&dir=&occ=first&part=1&cid=1652408).

To appropriately invoke legitimate interests under Article 6(1)(f) of the GDPR, it is imperative to conduct a thorough **triple test**. This test ensures the legality of processing activities under the specified legal basis and aims to prevent potential abuses, especially since obtaining explicit consent from data subjects is not required in this context.


## 1. Understanding "Legitimate Interests"

According to Article 6(1)(f) of the GDPR:

"The processing is lawful only if and to the extent that at least one of the following applies:
f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a child."

These provisions allows data controllers to collect and process personal data without obtaining consent, provided they have a legitimate reason to do so. However, to prevent potential misuse, the GDPR adds additional requirements for invoking legitimate interests. These are encapsulated in the following triple test:

- Objective Test: Does the controller have a legitimate interest in processing the data?
- Necessity Test: Is the processing of data genuinely necessary for the stated purpose?
- Balance Test: Do the interests of the data subject outweigh the legitimate interest of the controller?

The French Data Protection Authority (CNIL) emphasizes that this legal basis is applicable to processing activities by private entities that do not significantly harm the rights and interests of the data subjects [CNIL Guidelines] (https://www.cnil.fr/fr/les-bées-legales/tert-legitime)



## 2. Practical Examples of Legitimate Interests under the GDPR

The GDPR provides specific instances where legitimate interests can be considered a valid legal basis for data processing. These examples, highlighted in Recitals 47, 48, and 49 of the GDPR, include:

- Fraud Prevention: A key area where legitimate interests are often invoked, highlighting the necessity of processing personal data to protect against fraudulent activities.
- Network and Information System Security: As elaborated in Recital 49, ensuring the security of network and information systems is a paramount concern. This involves processing personal data as strictly necessary to safeguard against accidental or unlawful events that compromise the integrity, availability, and confidentiality of stored or transmitted data.
- Commercial Prospecting: The use of personal data for business development and marketing purposes, within certain limits, can be justified under legitimate interests.

The [European Commission further clarifies](https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/what-does-grounds-legitimate-interest-mean_fr#:~:text=Votre%20entreprise%2Forganisation%20a%20un,informations%20de%20vos%20systèmes%20informatiques) that legitimate interests may be applicable when processing occurs in the context of a customer relationship, for purposes such as marketing, fraud prevention, or ensuring the security of network and IT systems.

If we analyze Recital 49 of the GDPR, we observe that the processing carried out to ensure the security of information systems, based on legitimate interest, has been extensively mentioned: 'The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring the security of the network and information, that is, the ability of a network or an information system to withstand, at a given level of confidence, accidental events or illegal or malicious actions that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communications services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, stopping 'denial of service' attacks, and addressing damage to computer and electronic communication systems.


## 3. No Legitimate Interest for Public Authorities

It is important to remember that the legal basis of legitimate interests cannot be used by public authorities; Recital 47 explains why: "Considering that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks."


### 4.1 Identifying the Interests of the Data Controller or a Third Party and Their Legitimacy

Firstly, it is necessary to clearly identify the interests and objectives of the data controller or third party under which the processing is operated. The following questions can be asked:

- Why is the processing being carried out?
- What benefits are expected from the processing?
- Who benefits from the processing?
- What would be the impact if the organization could not implement the processing?

Recital 47 is useful in this analysis: "The existence of a legitimate interest would need careful assessment, including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place." In the context of a business relationship, it is useful to consider the reasonable expectations of individuals regarding the processing of their data. For example, in a B2B context, it is reasonable for a customer of a company to expect to be contacted by email for a commercial proposal related to an ancillary service.

The [french CNIL indicates](https://www.cnil.fr/fr/les-bases-legales/interet-legitime)  that "the interest pursued by an entity can be presumed if the following 3 conditions are met:

- The interest is manifestly lawful in view of the law;
- It is determined clearly and precisely;
- It is real and present for the concerned entity, and not fictitious.


## 4.2 The Condition of Necessity

The organization must then ensure that the **processing is necessary** (see Art. 6: "the processing is necessary for the purposes of legitimate interests").

This condition can be broken down into two points:

On one hand, it is necessary to verify that the processing actually achieves the intended purpose, rather than serving other objectives. This condition often poses problems in cases where an organization claims to collect data for one purpose, while in reality, it uses the data for entirely different purposes. Attention must be paid to this as it represents a real and significant risk of deviation.
On the other hand, it is necessary to ensure that there is no less intrusive means of achieving the same objective than implementing the processing.
Therefore, the following questions can be asked:

- Will this processing actually help the organization achieve the initially stated objective?
- Is the processing proportionate to this objective?
- Is it possible to achieve the same objective without the processing?
- Is it possible to achieve the same objective by processing less data, or by processing the data in a less intrusive manner (also consider the principle of data minimization)?

The fundamental interests and rights of the data subject could, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing.

Generally, "necessary" means that the processing must be a targeted and proportionate means of achieving the stated objective. Again, the legal basis of legitimate interests cannot be relied upon if there is another reasonable and less intrusive means to achieve the same result.



### 4.3 The Balancing Condition

To understand the balancing test, we need to revisit Article 6. Indeed, the legitimate interests of the data controller (DC) may justify this legal basis "unless the interests or fundamental freedoms and rights of the data subject that require protection of personal data prevail."

Thus, a balance is established: the interests of the DC cannot override the interests, freedoms, or fundamental rights of the data subject.

Recital 47 adds further elements to the analysis of this balancing condition:

- "unless the interests or fundamental freedoms and rights of the data subject prevail, **taking into account the reasonable expectations of the data subjects based on their relationship with the controller**"
- "the existence of a legitimate interest should be subject to careful assessment, particularly **to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose**"
- "The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed **in circumstances where data subjects do not reasonably expect further processing**"

The reasonable expectations of the data subjects - [in English](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) "reasonable expectations of data subjects based on their relationship with the controller" - are thus essential elements to consider.

The CNIL [states that](https://www.cnil.fr/fr/les-bases-legales/interet-legitime) "the entity must therefore strike a balance, a weighing of the rights and interests at stake, and verify in this context that the interests (commercial, security of goods, fraud prevention, etc.) it pursues do not create an imbalance to the detriment of the rights and interests of the individuals whose data is processed." Then "the entity must first identify all kinds of consequences that its processing may have on the data subjects: on their privacy but also, more broadly, on all the rights and interests covered by the protection of personal data." Finally, "The entity must then take into account, in the weighting between its legitimate interest and the rights and interests of the persons, their 'reasonable expectations'."

A series of questions can be posed to clarify these aspects:

- **General Context of Processing**
    - Are there any Article 9 or 10 data involved?
    - Are these data likely to be considered particularly "private" or sensitive by the individuals?
    - Are data of children, minors, or vulnerable individuals being processed?
    - Are data related to the personal or professional capacity of individuals being processed?

- **Relationship with the Data Subjects**
    - Is there a relationship with the individual?
    - What is the nature of this relationship, and how have the data been used in the past?
    - Were the data collected directly from the individuals?
    - What information were they provided with?
    - How long ago were the data collected? Are there any technological or contextual changes since then that would affect expectations?

## 5. Key Texts

The aforementioned Article 6.

- Recital 47 "The legitimate interests of a data controller, including those of a data controller to whom personal data may be disclosed, or of a third party, may constitute a legal basis for processing, unless the interests or fundamental rights and freedoms of the data subject prevail, taking into account the reasonable expectations of the data subjects based on their relationship with the data controller. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the data controller in situations such as where the data subject is a client of the data controller or is in the service of the data controller. In any case, the existence of a legitimate interest should be subject to careful assessment, particularly to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose. The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks. The processing of personal data strictly necessary for fraud prevention purposes also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as being carried out for a legitimate interest."

- Recital 48 "Controllers that are part of a group of undertakings, or institutions affiliated with a central body, may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of personal data of clients or employees. The general principles for the transfer of personal data, within a group of undertakings, to an enterprise in a third country remain unaffected."

- Recital 49 "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e., the ability of a network or an information system to withstand, at a given level of security, accidental or unlawful events that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communication services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, and stopping 'denial of service' attacks and damage to computer and electronic communication systems."



A Comprehensive Guide to Using 'Legitimate Interests' as a Legal Basis under the GDPR, Including Challenges, Conditions, and Practical Examples

How to Conduct the Triple Test to Assess the Legitimate Interests of the Data Controller (GDPR)

It is important to ensure GDPR compliance when collecting personal data, as numerous sanctions have been imposed in this regard (see 14 GDPR Sanctions You Must Know). However, it is quite easy to implement minimal rules and avoid the risk of a fine.

In most cases, collecting data through a questionnaire, form, or web survey will trigger the application of the GDPR due to the use of the user's IP address (which is considered a personal data under the GDPR).

Therefore, there are certain important obligations to implement to ensure compliance (I). We will then see some practical examples (II).

## I. - Key Obligations to Comply With

There are a number of important obligations to comply with: adding the processing activity to the registry, minimizing collected data, and displaying GDPR information notices.

### Step 1: Add the Processing Activity to the Registry

As soon as an organization sets up an activity that processes personal data (under the GDPR = any data that allows the identification of individuals, directly or indirectly), the organization must reference this activity in a registry.

Note, __the data processed is not referenced, but the activity itself (e.g., conducting customer satisfaction surveys)__. The reason for this is that it then allows for knowing where the personal data processed by the organization are and subsequently verifying their compliance (e.g., their security, the periods during which the data are processed, etc).

Typically, a [GDPR compliance management software](https://www.legiscope.com) is used for this - and for the example of [Legiscope](https://www.legiscope.com), the software already offers a series of pre-written and GDPR-compliant standard data collection and processing activities; so one can simply import this type of processing into the registry:

<img src="/img/questionnaire.png" />

Once the activity is imported, it will be automatically added to the registry and the description of the processing activity will be compliant with the [requirements of Article 30 for the creation of the registry](https://www.donneespersonnelles.fr/registre-rgpd).

Indeed, the organization must detail:

* a) the name and contact details of the data controller and, where applicable, the joint controller, the representative of the data controller, and the data protection officer; 
* b) the purposes of the processing;
* a description of the categories of data subjects and the categories of personal data;
* the categories of recipients;
* transfers of personal data;
* the envisaged time limits for the erasure of the different categories of data;
* a general description of the technical and organizational security measures

It is possible to write this documentation manually, but the task is laborious for each treatment [and here](https://www.legiscope.com), the drafting has been pre-performed entirely:

<img src="/img/questionnaire-detail.png" />

Once the activity is added to the registry, it is then necessary to minimize the collected data.

### Step 2: Minimize Collected Data

The GDPR requires the collection of the minimum amount of data from the data subjects (Art. 5):

> adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimization)

Therefore, it is necessary to reflect on the questions asked and ensure that they are adequate in relation to the objectives of the processing.

For example, **for a company operating a home cleaning service**:

* the quality of the cleaning: rating from 1 to 10
* the punctuality of the person: rating from 1 to 10
* the politeness of the person: rating from 1 to 10
* the name of the client or their identifier

These data are indeed objectively necessary for evaluating the service. Note that the data here are well minimized by using a rating from 1 to 10 and carefully avoiding a free text field which would open the possibility for clients to enter all sorts of data (comments unrelated to the work performed).

This is an important element of implementation.


### Step 3: Display GDPR Information Notices

GDPR information notices are also important to display to the user, as this is part of the transparency obligations that organizations have when collecting personal data - [the french CNIL has very detailed prescriptions in this regard](https://www.cnil.fr/fr/conformite-rgpd-information-des-personnes-et-transparence).

To simplify things, it is necessary to clearly inform the user about what is done with their data, the reason for collecting it, and a series of other information such as the duration for which the data will be retained.

Legal notices can be generated automatically using GDPR compliance management software or drafted manually.



### Step 4: Is Consent Necessary?

It is not necessarily required to obtain the consent of individuals whose data is processed if the questionnaire is part of a service provided by the organization.

Indeed, [what the GDPR requires is to have a legal basis](https://www.donneespersonnelles.fr/article_6-rgpd). Consent is one legal basis, but it is not the only one!

Article 6 of the GDPR provides 6 legal bases that authorize the collection of personal data:

* The consent of the individuals
* The contract, or pre-contractual measures
* A legal obligation
* The protection of vital interests of a person
* Public interest / public authority
* The legitimate interests of the data controller

In this respect, it is perfectly conceivable for the evaluation of a service, to rely on the "contractual" legal basis. That being said, beyond a service provided, consent will be the most appropriate legal basis for any general questionnaire (see here [how to collect valid consent under the GDPR](https://www.donneespersonnelles.fr/consentement-rgpd-valable))


## II. - Practical Example

To conclude, here is a practical example of a GDPR-compliant service evaluation questionnaire:

<img src="/img/exemple-questionnaire-rgpd.png" />

How to design a questionnaire that is compliant with the GDPR and ensures data collection in accordance with the law

How to Create a GDPR Compliant Questionnaire (Surveys, Satisfaction Inquiries, etc.)

Commercial prospecting is undoubtedly one of the risk areas of the GDPR, where it is important to be rigorous to ensure compliance with the law. A company has just learned this the hard way, as the CNIL has recently issued a fine of €500,000 for non-compliance with the GDPR rules. It is worth noting that the company in question made about €500,000 in profits (in 2018), so the fine imposed by the CNIL will _a priori_ absorb the entire profits of the company for the year 2019.


<img src="img/prospection-commerciale-rgpd.png" class="border" style="border: 1px solid #ccc;">

Let's review the facts before discussing the points of non-compliance and the actions the company could have taken to avoid such a sanction. Note that our goal is not to point fingers but to enable other companies to learn from this case.

## The Facts

The case is interesting - although quite typical for anyone familiar with GDPR compliance: a company decides to conduct commercial prospecting by phone to sell its services (here, building insulation). To do this, it uses call centers based in North Africa. These subcontractors call prospects en masse but fail to record their objections to telemarketing. Inevitably, this triggers a complaint from a person who is subject to repeated telemarketing despite their objection (and the sending of a registered letter).

The CNIL then initiates an on-site inspection, which reveals a series of infractions:

- Numerous complaints from people being approached despite their objection
- Excessive comments about the company's clients - insults or remarks about their health status - in free text fields
- Recording of telephone conversations without the knowledge of the called individuals and without prior information

Following the inspection, the CNIL issued a formal notice to the company to comply, but the latter did not deem it necessary to follow the Commission's instructions. This proved to be a poor decision, as a sanction procedure was then initiated and carried through to completion.

There are four breaches here that are interesting to analyze and comment on.


## Error 1: Non-Compliance with Individuals' Opposition

The decision highlights the importance of respecting individuals' rights in risk-related processing. Commercial prospecting in B2C is generally perceived as a nuisance by individuals and, as such, must be strictly regulated from a legal perspective.

Here, we see that the company had not established GDPR compliance processes: a person who opposed commercial solicitation should not have been called again if these processes were in place. In fact, the lack of process in this type of treatment will inevitably generate litigation, because if the company grows, it is only a matter of time before someone takes offense and contacts the CNIL.

The actions the company should have taken were as follows:
- Ensure the existence of an opposition list.
- Conduct tests to verify the effectiveness of the list.
- Create fake profiles in its database that refer to internal personnel responsible for GDPR compliance, to ensure that in case of process failure, the flaw is quickly detected.

## Error 2: Collecting Excessive Data

Free text fields - particularly in CRM software - pose structural problems, as they allow operators who are in contact with the public to enter data without any limit. This generally results in the entry of excessive data, which is a disaster from a GDPR perspective. In fact, the issue is so significant that the CNIL systematically checks for the existence of free text fields during inspections and has developed internal software to detect excessive data.

It is legally possible to implement a free text field in software, but it is necessary to ensure that the subsequent data entered are adequate and relevant to the purposes in order to comply with Article 5 of the regulation. This implies a range of material measures ranging from the awareness of data entry operators to the regular extraction and verification of data.

The compliance actions for the company were as follows:
- Remove free text fields from the CRM software.
- Train a GDPR officer to ensure the regular compliance of entered data.

## Error 3: Transfers of Personal Data Outside the EU

Companies often think they are saving money by outsourcing commercial solicitation services to French-speaking countries outside the European Union - until the costs related to GDPR compliance are discussed.

Outsourcing outside the EU is possible, but it is often very costly to implement due to the complexity of the GDPR (note that the case of major Cloud operators, such as AWS, Google, or Microsoft, are special cases in this regard).

It is indeed necessary to both validate the legal framework of the transfer and also to visit the site to ensure the respect of GDPR obligations by the subcontractor on all implemented tools. For a process as risky as commercial prospecting, one should seriously consider the overall costs of such an operation and the risks of sanctions / damage to the company's brand image before embarking on such an operation.

The compliance actions for the company were as follows:
- Perform a real cost calculation for GDPR compliance of the call center and integrate the hidden costs of GDPR compliance.
- If necessary, repatriate activities within the EU.

## Error 4: Failure to Cooperate with the CNIL

While it was possible to gain the favor of the CNIL before the entry into force of the GDPR by cooperating with it in case of discovering an infraction, the margin for maneuver is now almost nil (see Art. 83).

In case of an inspection, it is therefore essential to ensure that all points raised by the CNIL are managed and addressed by GDPR compliance professionals. With sanctions exceeding 10 million euros for SMEs and 2% of the global turnover for groups, it is not possible to manage a formal notice - which will probably lead to a sanction - without responding to all of the Commission's observations.

Here, the company could probably have reduced its sanction to €250,000 if it had implemented adequate means to respond to each point raised by the Commission. But apparently, this was not the choice it made.

If you are subject to a formal notice, or an inspection, surround yourself with experts who have at least 10 years of experience in these matters!

[Link to the decision](https://www.cnil.fr/fr/futura-internationale-sanction-de-500-000-euros-pour-demarchage-telephonique-illegal)

The CNIL has just imposed a €500,000 fine on a company for conducting commercial prospecting without complying with the GDPR

GDPR and Outbound sales : €500,000 fines for non-compliance

How to apply the data protection principles effectively

Article 28 of the GDPR is arguably one of the most important provisions in practical terms, as it imposes a series of practical obligations on data controllers (DC) in managing the processors (PR) who work with personal data.

The first mistake to avoid is to properly understand when Article 28 will apply, in simple terms: as soon as an organization gives a processor access to personal data it processes.

Here are some practical examples:

1. An organization uses HR software or a CRM hosted in SaaS mode (web platform) (the platform publisher will then be the PR).
2. An organization requests IT assistance from a company - with remote access to employees' computers (the IT company is then the PR).
3. A SaaS software publisher uses subcontractors - for example, for sending SMS messages - the PR will then be in relation with a sub-processor - Article 28 will also apply to the PR who must ensure that their sub-processor complies with the conditions imposed by the GDPR.

Here, the GDPR aims to regulate the entire personal data processing chain to ensure that the obligations imposed on the data controller follow the data at all times and provide adequate protection.

## I. - The Main Obligations Imposed by Article 28 (Summary)

If we analyze the details of Article 28 (see below), here are the main obligations it imposes:

* The data controller must exclusively use processors that provide sufficient guarantees.
* The processor cannot subcontract without the data controller's authorization.
* There must be a written contract between the data controller and the processor.
* The processor must delete all data at the end of the service.
* The processor can only act on the data on the instruction of the data controller.

Here is an [example of a standard contract between DC and PR that will give you a clear idea of what is required in legal terms](https://www.donneespersonnelles.fr/contrat-sous-traitance-rgpd); you can freely reuse this contract, which is offered to you (value €2,000)!

## II. - How to Comply with Article 28

To bring an organization into compliance, it is necessary to go through three steps that will allow for the inventory and evaluation of the compliance of the processors.


### A. - Understanding the Concepts of Controller and Processor

Firstly, ensure a good **understanding of the concepts of processors and controllers**, without which it will be difficult to qualify the relationships between each organization. Some subcontractors in the classical sense are not subcontractors in the GDPR sense.

If you use [Legiscope](https://www.legiscope.com), you already have access to comprehensive training modules on this topic (30 minutes) that allow you to master the relationships between DC and PR.

Alternatively, you can also read our article on [the concept of a GDPR processor](https://www.donneespersonnelles.fr/sous-traitant-rgpd) which goes into more detail on these points.

### B. - Inventorying All Processors

Next, it is necessary to conduct an inventory of all processors involved in data processing operations. For this, it is appropriate to list all the companies or organizations that will have access in one way or another to the personal data of the company.

This will then allow us to carry out a precise evaluation of the processor's compliance with each criterion imposed by the GDPR:


### C. - Evaluating the Processors 

From there, three elements will appear: processors that are not compliant at all and from whom it will be necessary to separate; those who have undertaken compliance work that is still in progress - it is possible to keep them if the processing is not very sensitive. And finally, processors who have a good/very good level of compliance - and on whom the organization can rely.



## III - Article 28 in detail 

Article 28 Processor

1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

2. The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:

(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c ) takes all measures required pursuant to Article 32;

(d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

4. Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

5. Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

6. Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.

7. The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).

8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

9. The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

10. Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

Article 28 of the GDPR is a critical juncture for compliance, governing the relationship between data controllers and processors

GDPR and AML, what can go wrong ?

Témoignages

Articles connexes