{"id":85,"date":"2019-08-15T14:22:45","date_gmt":"2019-08-15T14:22:45","guid":{"rendered":"http:\/\/www.dataprotectionconsultant.it\/EN\/?p=85"},"modified":"2020-05-17T15:15:29","modified_gmt":"2020-05-17T15:15:29","slug":"gdpr-news","status":"publish","type":"post","link":"https:\/\/www.dataprotectionconsultant.it\/EN\/gdpr-news\/","title":{"rendered":"GDPR & News"},"content":{"rendered":"

\"\"<\/a>\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

The \u00abGeneral Data Protection Regulation\u00bb (\u00abGDPR<\/em>\u00bb)<\/strong><\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

The \u00abGeneral Data Protection Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC<\/em>\u00bb (so called \u00abGDPR<\/em>\u00bb) is born with the aim of standardising and homogenising the legislation on data protection in Europe and of enhancing the responsibility of controllers and processors<\/span><\/span><\/a>. The key aim is enhancing attention on data protection, with written documentation of procedures, processes, technical and organisational measures put in place to carry out data processing in compliance with the GDPR requirements and obligations. Much has been imported from the previous legislation and a meaningful contribution has been given by the Italian Personal Data Protection Code (so called \u00abCodice Privacy<\/em>\u00bb). Therefore, not everything is completely new and unknown to us. <\/strong><\/span><\/p>\n

The key principle is strengthening and keeping a regular and systematic accountability<\/a><\/span> of controllers and processors<\/a>,<\/span><\/span> demanding to expressly demonstrate that data processing carried out is GDPR compliant<\/span>. The accountability<\/a><\/span><\/span> required is linked to the principle of data protection by design and by default<\/a><\/span>.\u00a0Applying procedures to meet the GDPR requirements at the time of planning of any activity must become a consolidated practice, like any decision relating to the activity itself. These procedures, which must be appropriately documented, have to be kept updated and checked in their substantial application; they have to be permanent and basic for any operation of processing.<\/strong><\/span><\/p>\n

The GDPR demands that the highest management level demonstrates compliance with provisions on data protection, with appropriate procedures able to protect individuals\u2019 rights and freedoms. <\/strong><\/span><\/p>\n

A preventative risk analysis<\/a><\/span><\/span> for any processing becomes the starting point for assessing the lawful feasibility of any processing and to determine whether and how much the data subject runs the risk to be exposed to breaches of rights and freedoms. <\/strong><\/span><\/p>\n

Many obligations are not new at all, but only stressed or refined, pointed out by specific recalls and provisions; others are certainly new.<\/strong><\/span><\/p>\n

The GDPR ranges from the principles relating to processing of personal data<\/a><\/span><\/span> to the legal basis for processing<\/a><\/span> (lawfulness of processing<\/span><\/span><\/a>), from a chart of responsibility inside and outside the organisation of controllers and processors<\/a><\/span> (controller, processor<\/a>,<\/span> persons authorised to data processing<\/a><\/span><\/span>) to the security of processing, from the data protection impact assessment<\/a><\/span> to data breach<\/a><\/span><\/span>, from the appointment of a Data Protection Officer<\/span><\/span><\/a> to the keeping of the Records of processing activities<\/a><\/span><\/span>. Besides, the GDPR governs how transfer of personal data to third countries or international organisations<\/a><\/span><\/span> can be lawfully carried out. Last, but not least, it is important to govern the obligations of information to data subjects<\/a><\/span><\/span> and how to allow them to control the processing of their personal data, through the exercise of specific rights<\/a>,<\/span><\/span> including the right to lodge a complaint<\/a><\/span><\/span> with the supervisory authority and the right to compensation<\/a><\/span><\/span> for the damage suffered.\u00a0In order to appropriately face the GDPR requirements, it is fundamental to get to know its key definitions<\/a><\/span><\/span>.<\/strong><\/span><\/p>\n

The GDPR is a great challenge, we shall see together how to cope with it. <\/strong><\/span><\/p>\n

To learn more, click on the subject of interest, read FAQs<\/a><\/span><\/span> or contact me<\/a><\/span><\/span>.<\/strong><\/span><\/p>\n

1. Key definitions<\/a><\/span><\/span><\/strong><\/span><\/p>\n

2. Accountability & Governance<\/span><\/span><\/a><\/strong><\/span><\/p>\n

3. Principles relating to processing of personal data<\/span><\/span><\/a><\/strong><\/span><\/p>\n

4. Lawfulness of processing<\/a><\/span><\/span><\/strong><\/span><\/p>\n

5. Obligations of information to the data subject<\/a><\/span><\/span><\/strong><\/span><\/p>\n

6. Rights of data subjects<\/a><\/span><\/span><\/strong><\/span><\/p>\n

7. Data Protection by design and by default <\/a><\/span><\/span><\/strong><\/span><\/p>\n

8. Data Protection Officer (\u00abDPO<\/em>\u00bb)<\/a><\/span><\/strong><\/span><\/p>\n

9. Processor<\/span><\/span> <\/a><\/strong><\/span><\/p>\n

10. Processing under the authority of the controller or the processor (persons authorised to data processing<\/span><\/span>)<\/span><\/a><\/strong><\/span><\/p>\n

11. Records of processing activities<\/a><\/span><\/span><\/strong><\/span><\/p>\n

12. Data Protection Impact Assessment (impact assessment)<\/span><\/span><\/a><\/strong><\/span><\/p>\n

13. Personal data breach (data breach)<\/a><\/span><\/span><\/strong><\/span><\/p>\n

14. Codes of conduct and certification<\/a><\/span><\/span><\/strong><\/span><\/p>\n

15. Transfer of personal data to third countries or international organisations<\/a><\/span><\/span><\/strong><\/span><\/p>\n

16. Administrative fines and penalties<\/a><\/span><\/span>.<\/strong><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    The \u00abGeneral Data Protection Regulation\u00bb (\u00abGDPR\u00bb)   The \u00abGeneral Data Protection Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC\u00bb (so … <\/p>\n

Continue reading “GDPR & News”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/85"}],"collection":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/comments?post=85"}],"version-history":[{"count":22,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/85\/revisions"}],"predecessor-version":[{"id":87,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/85\/revisions\/87"}],"wp:attachment":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/media?parent=85"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/categories?post=85"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/tags?post=85"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}