How to implement GDPR for the public sector, December 2017

Join in the conversation #GenerationGDPR Connect with our experts | LinkedIn
How to implement GDPR for
the public sector

Connect with Dmitrije
dmitrije.sirovica@brownejacobson.com
+44 (0)115 976 6238
Connect with Patrick
patrick.o‘connell@brownejacobson.com
+44 (0)330 045 2149
How to implement GDPR for
the public sector

• key definitions
• legal grounds for processing
• guidance and tips
• questions
GDPR

Article 4(1)
‘personal data’ means any
information relating to an
identified or identifiable natural
person (the data subject)
Key definitions

Article 4(7)
‘controller’ means the natural or
legal person, public authority,
agency or other body which,
alone or jointly with others,
determines the purposes and
means of the processing of
personal data;
Key definitions

Article 4(7)
where the purposes and means
of such processing are
determined by Union or Member
State law, the controller or the
specific criteria for its
nomination may be provided for
by Union or Member State law
Key definitions

Requirement for a
lawful basis for
processing

1. processed lawfully, fairly and in
a transparent manner
2. only processed for specified,
explicit and legitimate purposes
3. adequate, relevant and limited to
the purposes for which processed
4. must be accurate
5. kept for no longer than necessary
6. kept securely
Data protection
principles

• personal data
– Article 6 GDPR
• special categories of personal
data
– Article 9 GDPR
Bases for processing

• Article 13 GDPR
– information to be provided
where personal data are
collected from the data
subject
• Article 14 GDPR
– information to be provided
where personal data have
not been obtained from the
data subject
Information to be
provided to data
subjects

“means any information relating to an identified or identifiable natural person
(‘data subject’)
an identifiable natural person is one who can be identified, directly or
indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more
factors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of that natural person”
Personal data

• (1)(c) – processing is necessary
for compliance with a legal
obligation to which the
controller is subject
• (1)(e) – processing is necessary
for the performance of a task
carried out in the public interest
or in the exercise of official
authority vested in the
controller
Article 6

• (1)(b) – processing is necessary
for the performance of a
contract to which the data
subject is party or in order to
take steps at the request of the
data subject prior to entering
into a contract
• (1)(d) – processing is necessary in
order to protect the vital
interests of the data subject or
of another natural person
Article 6

• the processing of genetic data,
biometric data for the purpose
of uniquely identifying a natural
person
• data concerning health
• data concerning a natural
person's sex life or sexual
orientation
Processing special categories of
personal data
• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership

• Article 9(2)(b) – employment,
social security and social
protection
• Article 9(2)(h) – health or social
care purposes
• Article 9(2)(i) – public health
Bases for processing

Processing is necessary for reasons
of substantial public interest, on the
basis of Union or Member State law
which shall be proportionate to the
aim pursued, respect the essence of
the right to data protection and
provide for suitable and specific
measures to safeguard the
fundamental rights and interests of
the data subject
Article 9(2)(g)

Explains the controller’s:
• procedures for securing
compliance with the data
protection principles in
connection with the processing
of that personal data
• policies as regards the retention
and erasure of that personal
data, giving an indication of how
long such personal data is likely
to be retained
Appropriate policy
document

processing data
• consent and legitimate interests
other legal grounds
• contractual necessity
• statutory basis/public function
• compliance with a legal
obligation
Schedule 2 to the Data
Protection Act 1998

‘consent’ of the data subject means
any freely given, specific, informed
and unambiguous indication of the
data subject's wishes by which he or
she, by a statement or by a clear
affirmative action, signifies
agreement to the processing of
personal data relating to him or her
Article 4(11)

In order to ensure that consent is freely given, consent should not provide a
valid legal ground for the processing of personal data in a specific case where
there is a clear imbalance between the data subject and the controller, in
particular where the controller is a public authority and it is therefore unlikely
that consent was freely given in all the circumstances of that specific situation
Recital 43

The data subject shall have the right
to withdraw his or her consent at
any time. The withdrawal of consent
shall not affect the lawfulness of
processing based on consent before
its withdrawal. Prior to giving
consent, the data subject shall be
informed thereof. It shall be as easy
to withdraw as to give consent.
Article 7(3)

processing is necessary for the
purposes of the legitimate interests
pursued by the controller or by a
third party, except where such
interests are overridden by the
interests or fundamental rights and
freedoms of the data subject which
require protection of personal data,
in particular where the data subject
is a child.
Article 6(1)(f)

Point (f) of the first subparagraph
shall not apply to processing carried
out by public authorities in the
performance of their tasks.
Article 6(1)

Connect with Dmitrije
dmitrije.sirovica@brownejacobson.com
+44 (0)115 976 6238
Connect with Patrick
patrick.o‘connell@brownejacobson.com
+44 (0)330 045 2149
Get in touch with your
questions

How to implement GDPR for the public sector, December 2017

More Related Content

What's hot (19)

Similar to How to implement GDPR for the public sector, December 2017 (20)

More from Browne Jacobson LLP (20)

Recently uploaded (20)

How to implement GDPR for the public sector, December 2017