Data Protection Implementation Guide

Name: Data Protection Implementation Guide | A Legal, Risk and Technology Framework for the GDPR
Brand: Kluwer Law International
Price: 151.99 EUR
Availability: OnlineOnly

A Legal, Risk and Technology Framework for the GDPR

Brendan Quinn(Autor*in)

Kluwer Law International (Verlag)

Erschienen am 2. September 2021

384 Seiten

E-Book

ePUB mit Adobe-DRM

Systemvoraussetzungen

978-94-035-2901-1 (ISBN)

151,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für ePUB mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Half-Title Page
Title Page
Copyright Page
Disclaimer
About the Author
Table of Contents
Chapter 1 Data Protection Projects: Building an Inventory
1.1 Introduction
1.2 How This Book Helps Enterprises in GDPR Projects
1.2.1 The Risk-Based Approach in the GDPR
1.3 Topics Covered and Purposes of the Book
1.4 Building an Inventory and the Key Documentation
1.5 Material and Territorial Scope of the GDPR
1.5.1 Article 2: Material Scope
1.5.2 Article 3: Territorial Scope
1.6 The Establishment Criterion: Article 3(1)
1.7 The Targeting Criterion: Article 3(2)
1.7.1 Position of Processors When Not Established in the EU
1.7.2 Appointing Representatives under Article 27
1.8 How to Achieve a Minimum Level of Compliance
1.9 GDPR the Terminology and Common Problems in Completing an Inventory
1.10 Content and Format of an Inventory
1.11 Personal Data
1.12 Names as Identifiers
1.13 The Use of Unique Identifiers
1.14 IP Addresses
1.15 Pseudonymised Data
1.16 Anonymous Data
1.17 ECJ Case Law on What Constitutes Personal Data
1.18 Sensitive Data and Criminal Conviction Data
1.18.1 Health Data
1.18.2 The Meaning of Racial or Ethnic Origin
1.19 Processing
1.20 List of Useful Documents
Chapter 2 Gap Analysis: Identifying the Enterprise's Gaps
2.1 Developing a Project Management Methodology
2.2 Implementation of the Gaps
2.3 Starting the Gap Analysis or Data Audit
2.4 Benefits of a Gap Analysis
2.5 High-risk Areas to Date for Enforcement by Regulators
2.6 Drafting a Project Plan for GDPR
2.7 The Role of the DPO
2.8 Policies, Procedures, Standards, and Guidelines
2.9 Building a Risk Analysis Framework
2.10 Individuals' Rights under the GDPR
2.11 Summary of Powers of the Supervisory Authorities
2.12 Direct Marketing under the ePrivacy Directive
2.13 ePrivacy Directive
Chapter 3 Legal Bases for Processing
3.1 The Lawful Basis Principle
3.2 The Categories of Data Determine the Legal Bases
3.3 The Six Legal Bases for Processing Personal Data
3.4 Sensitive/Special Category Personal Data
3.5 Consent
3.6 Vital Interest
3.7 Contract with the Data Subject
3.8 Legal Obligation
3.9 Public Interest
3.10 Legitimate Interest: Purpose and Necessity
3.10.1 Balancing of Rights
3.10.2 Impact
3.10.3 Assessment by Enterprise
3.11 Further Processing
Chapter 4 Article 30 Record Keeping
4.1 Records of Processing for Article 30
4.2 What Records Must a Controller Keep?
4.2.1 Purposes of Processing
4.2.2 Categories of Personal Data
4.2.3 Technical and Organisational Safeguards
4.3 Who Is the Controller?
4.3.1 Factors in Determining Whether the Enterprise Is a Controller
4.3.2 Purposes and Means Test
4.3.3 Factors in Determining Whether the Enterprise Is a Joint Controller
4.3.4 Jointly Determined Purpose(s)
4.3.5 Joint Controller Agreements
4.4 Who Is the Processor?
4.5 What Records Must Be Kept by Processors?
4.5.1 Categories of Processing Activity
4.5.2 Safeguards over Transfers
4.5.3 Retention Period
4.5.4 Categories of Recipients
4.5.5 Sub-processors in the GDPR Article 28
4.5.6 Technical and Organisational Safeguards
4.5.7 Factors in Determining Whether the Enterprise Is a Processor
4.5.8 EDPB Guidance on Processors
4.5.9 Article 28: Processing Agreement - What Is Included?
4.5.10 Clauses Which Should Be in Data Processing Agreements
Chapter 5 Breaches, Incident Response, Security, and Controls
5.1 What Is a breach?
5.2 Responding to Breaches
5.2.1 Most Common Breaches Attracting Enforcement Action
5.2.2 Accidental and Unlawful Destruction
5.2.3 When Does an Enterprise Need to Notify a Breach?
5.3 Notification to the Supervisory Authority
5.3.1 What Records Does an Enterprise Need to Keep?
5.4 Reporting
5.4.1 Breach Recording
5.4.2 Notification to the Supervisory Authority
5.4.3 Information to Be Provided to Supervisory Authorities
5.4.4 Delays in Notification and Notifying in Phases
5.5 Article 34: Notification to the Data Subject
5.5.1 Notifying the Data Subject
5.5.2 Information to Be Provided
5.5.3 When Is a Notification Not Required
5.6 Article 32 Security and Controls: Technical, Physical, and Organisational
5.6.1 Summary of Controls for Controllers
5.6.2 What Do Enterprises Need to Consider in Implementing Controls?
5.6.3 Technical Controls
5.6.4 Organisational Measures
5.6.5 Physical Security
Chapter 6 Data Protection Impact Assessments
6.1 Asset Type
6.2 DPO Involvement
6.3 Stages
6.4 Identify Data Protection and Related Risks
Chapter 7 Retention of Data and the Right to Erasure
7.1 The Meaning of Storage in Processing
7.2 Google Spain and the Right to Be Forgotten
7.3 Principles of Data Protection and Data Retention
7.4 The Right to Erasure Explained
7.5 Writing a Data Storage, and Erasure: Retention Policy
7.5.1 Scope
7.6 Classification
7.7 Purpose of Retention
7.8 Policy for Managing Personal Data in Record Keeping
7.9 Principles for Retaining Data
7.10 Record Creation
7.11 Record Retention and Maintenance
7.11.1 Retention Based on One of the Five Exceptions in Article 17(3)
7.11.2 Assessing the Value of Records
7.12 Data Retention Rules for Processors
7.13 Secure Disposal of Records
7.14 European Court of Human Rights Cases on Data Retention
Chapter 8 Data Protection by Design and Default
8.1 What Is Meant by Privacy by Design and by Default?
8.1.1 The Ontario Principles
8.2 DPbDD: The Principles
8.2.1 Demonstrate Compliance with the Principles: Accountability
8.3 Pseudonymising of Personal Data
8.4 Certification Mechanisms
8.5 Technical and Organisational Controls in Software Development
8.6 Software Design and Development: Our Experience
Chapter 9 Data Subject Rights
9.1 Introduction: Data Subject Rights Are Mandatory
9.2 Transparency in Articles 13 and 14
9.2.1 Transparency and Writing Privacy Notices
9.3 Subject Access Requests SARs and the Article 15 Requirements
9.3.1 Restricting Rights and Freedoms and Article 23
9.3.2 Opening a Request and Whether a Controller Can Reject a SAR
9.3.3 Receiving a SAR What to Do
9.3.4 Identifying the Data Subject for the SAR
9.3.5 Communication with the Data Subject
9.3.6 Searching and Communicating with Data Subjects
9.3.7 Requirements for Communication with Data Subjects
9.3.8 Making the Records Available to the Data Subject
9.3.9 Methods for Redacting Documents
9.4 Right to Portability
9.5 Article 16: Rectification
9.6 Erasure: Article 17 and the Right to Be Forgotten
9.7 Article 18: Restriction
9.8 Right to Object
Chapter 10 Automated Decision-Making and Profiling Technologies
10.1 Introduction to Big Data and Machine Learning
10.2 Big Data under GDPR
10.2.1 What Is Big Data?
10.2.2 Personal Data Processing in Research Falling under Article 89
10.2.3 Processing Big Data in Commercial Applications
10.3 What Is Artificial Intelligence?
10.4 Common Types of Algorithms
10.5 Designing Machine Learning, Data Mining and AI Processes
10.5.1 Stages in the Data Lifecycle
10.5.2 'Automated Decision-Making Including Profiling' under Article 22
Chapter 11 Children's Data under the GDPR
11.1 Introduction to Children's Rights
11.2 Why Are Children Considered Vulnerable under the GDPR?
11.3 General Rules for Processing Children's Data
11.4 Information Society Services
11.5 Schools
11.6 COVID-19 and Health Matters
11.7 Biometrics Cases on Children Before the ECHR
11.8 Regulators Focus on Processing Children's Data
11.8.1 CCTV and Home Learning
11.9 Biometrics and Children
11.10 Facial Recognition and Children
11.11 Publishing Children's Photos and School Teachers' Personal Data Online
11.12 Apps Evaluating Teachers
11.13 Surveys Collecting Children's Personal Data
11.14 Data Breaches of Children's Data
Chapter 12 CCTV, Video, and IP Cameras
12.1 The Meaning of the Terms Necessary and Proportionate in EU Law
12.2 CCTV and Video
12.3 DPbDD in Video
12.4 When Does the GDPR Apply to Video Surveillance Devices?
12.5 Key Precedent in Processing CCTV Images: The Rynes Case
12.6 Is Processing Video Images a High-Risk Process Requiring a DPIA?
12.7 Interaction with the Right to Privacy under Article 8 of the ECHR
12.8 What Information Do Controllers Need to Provide to Data Subjects?
12.8.1 Transparency
12.9 Making CCTV GDPR Compliant
12.10 Webcams and Web Conferencing Software
12.11 Spy Cameras
Chapter 13 Facial Recognition and Biometrics
13.1 Categories of Biometrics
13.2 Classifying Biometric Technology
13.3 Data Protection Risks when Processing Biometric Data
13.4 Facial Recognition
13.5 Emerging Use Cases for Facial Recognition Software
13.5.1 Detection
13.5.2 Alignment
13.5.3 Measurement
13.5.4 Translation of Templates
13.5.5 Matching
13.5.6 Verification or Identification
13.5.7 Principal Component Analysis
13.5.8 Linear Discriminant Analysis
13.5.9 Elastic Bunch Graph Matching
13.6 Data Protection Issues to Consider and Completing a DPIA when Deploying Facial Recognition
13.6.1 Safeguards to Consider If Deploying Facial Recognition Technology
Chapter 14 Third-Country Transfers Outside the EEA
14.1 Transfers under an Adequacy Decision or to Inadequate Jurisdictions
14.2 Adequacy under the GDPR
14.3 Adequate Countries: Requirements
14.4 Non-adequate Jurisdictions the Options for Controllers
14.5 Binding Corporate Rules
14.6 Appropriate Safeguards for Transfers: Inadequate Jurisdictions Pre-Schrems II
14.7 Standard Contractual Clauses
14.8 Schrems II and European Essential Guarantees and Supplemental Measures
14.8.1 The Schrems II Decision: Judgment of the Court (Grand Chamber) of 16 July 2020
14.8.2 EDPB Recommendations on Supplementary Measures for International Data Transfers
14.8.3 The Six Steps Recommended by the EDPB
14.8.4 Annex II: Examples of Effective and Non-effective Transfers
14.8.5 Transfers for Which Supplementary Measures Are Unlikely to Be Effective
14.8.6 European Essential Guarantees
14.9 The Early Cases and DPA Decisions Based on Schrems II
14.9.1 Amazon AWS and the Conseil d'État
14.9.2 Microsoft and the Conseil d'État
14.9.3 Bavarian DPA and Mailchimp
14.10 Codes of Conduct and Certification Mechanisms
14.11 Derogations for Specific Situations
14.11.1 Explicit Consent
14.11.2 Contractual Exceptions
14.11.3 Important Public Interests
14.11.4 Legal Claims
14.11.5 Vital Interests
14.11.6 Register to Provide Information
14.11.7 Necessary for Compelling Legitimate Interests
Chapter 15 Data Protection of Employees in the Workplace
15.1 Data Protection Versus Privacy
15.2 Data Generated by the Employment Relationship
15.3 The Basics of an Employment Inventory
15.4 Building an Employee Inventory
15.5 The Impact of Article 88 of the GDPR
15.6 Legal Bases for Processing Employee Personal Data
15.7 Employee Capacity to Give Consent
15.7.1 The ECHR on Privacy under the European Convention on Human Rights
15.7.2 The EDPB View on Using Consent to Process Employee Personal Data
15.8 Processing Is Necessary to Fulfil the Employment Contract Between the Employer and Employee
15.9 Processing Is Necessary for Compliance with a Legal Obligation to Which the Employer Is Subject
15.10 Impact of Charter of Fundamental Rights of the European Union on Legitimate Interest Assessments
15.11 Processing Is Necessary for the Employer's Legitimate Interests and Others
15.12 Processing Sensitive Employee Data
Chapter 16 Processing Employee Health Data
16.1 Processing Employees' Health Data and Working from Home
16.2 Temperature Control and Access Technology in the Workplace
16.3 Employees and Temperature Screening
16.4 How Temperature Screening Works
16.5 Risks That Should Be Considered in the DPIA
16.6 The EDPB Guidance for Employers on COVID-19
16.7 Member State Regulators Views on Temperature Checks
Chapter 17 Surveillance in the Workplace
17.1 Derogations for Employee Monitoring under Article 88 of the GDPR
17.2 The Council of Europe's Employment Data Recommendation
17.3 European Court of Human Rights Cases on Surveillance
17.4 Justifiable Use of Surveillance in an Employment Context
17.5 EDPS Guidelines on Assessing the Proportionality of Measures That Limit Fundamental Rights
17.6 Workplace Monitoring for Loss Prevention
17.7 Background Checks on Employees
17.8 Data Loss Prevention in the Workplace
17.9 Monitoring the Social Media of Prospective, Current, and Former Employees
17.10 Transparency and AUP of IT Resources
17.11 The Obligation to Provide Information to the Data Subject
17.12 Recommended Minimum Content for an Employers Policy on Monitoring Email
17.13 Recommended Minimum Content for a Policy on Monitoring Internet Use
17.14 Principles Relating to Internet Monitoring
17.15 Where Employee Monitoring May Not Be Legitimate
17.16 Bring Your Own Device Policies
Table of Cases

Systemvoraussetzungen

Als PDF speichern Als Link merken