Difference between revisions of "General Data Protection Regulation (GDPR)"

From SmartWiki
Jump to: navigation, search
 
(5 intermediate revisions by one other user not shown)
Line 1: Line 1:
−
{{ Banner-UnderConstruction }}
 
−
 
 
Please see [[Configuring Privacy, Confidentiality and Other Policies]] for related information. 
 
Please see [[Configuring Privacy, Confidentiality and Other Policies]] for related information. 
  
Line 13: Line 11:
  
 
=Feature Descriptions and Requirements=
 
=Feature Descriptions and Requirements=
 +
SmartSimple has created two categories of features that are GDPR-compliant: features related to '''Personal Data Management, '''and those related to '''Consent and Compliance. '''
 +
 
==Personal Data Management Features==
 
==Personal Data Management Features==
 
'''Personal Data Management '''features are focused on managing your data effectively and automating your data governance model. To make the most use of the following features, we recommend identifying all personal data fields in the system and organizing them into data categories. 
 
'''Personal Data Management '''features are focused on managing your data effectively and automating your data governance model. To make the most use of the following features, we recommend identifying all personal data fields in the system and organizing them into data categories. 
Line 134: Line 134:
 
||'''Request Tracker UTA'''
 
||'''Request Tracker UTA'''
 
||
 
||
−
<pre> This is a customized feature that must be requested by the client to be configured into their specific instance of SmartSimple. </pre>
+
<pre>This is a customized feature that must be requested by the client to be configured into their specific instance of SmartSimple. </pre>
−
 
 
 
We are able to build a Request Tracker {{UTA}} to help you manage Data Subject Requests, such as the following: Right of Access; Right to Rectification; Right to Erasure; Right to Restriction of Processing, etc. 
 
We are able to build a Request Tracker {{UTA}} to help you manage Data Subject Requests, such as the following: Right of Access; Right to Rectification; Right to Erasure; Right to Restriction of Processing, etc. 
  
Line 143: Line 142:
  
 
|}
 
|}
 +
=Glossary for GDPR=
 +
{| class="wikitable"
 +
|-
 +
!|Term, Principle, or Abbreviation
 +
!|Definition
 +
|-
 +
||'''EEA'''
 +
||
 +
''European Economic Area - ''based on an international agreement in 1992, the EEA enables the extension of the European Union's single market to non-EU member parties. Membership has grown to 31 states as of 2016: 28 EU member states, as well as three of the four member states of the European Free Trade Association: Iceland, Liechtenstein, and Norway. The agreement is applied provisionally with respect to Croatia. Switzerland has not yet joined the EEA, but has a series of bilateral agreements with the EU which allow it to also participate in the internal market. 
 +
 +
|-
 +
||'''EU'''
 +
||
 +
''European Union'' - a political and economic union of 28 member states that are located primarily in Europe. 
 +
 +
|-
 +
||'''GDPR'''
 +
||
 +
''General Data Protection Regulation - ''The GDPR 2016/679 is a regulation in EU Law on data protection and privacy for all individual citizens of the European Union (EU) and the European Economic Area (EEA). The GDPR was adopted on April 14, 2016 and became enforceable beginning May 25, 2018. 
 +
 +
|}
 +
 +
{| class="wikitable"
 +
|-
 +
!|GDPR Principle
 +
!|Description
 +
|-
 +
||'''(5)(1)(b) Purpose Limitation'''
 +
||
 +
'''Article 5 '''of GDPR: Principles relating to processing of personal data 
 +
 +
1. Personal data shall be: 
 +
 +
b) collected for spescific, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation') 
 +
 +
|-
 +
||'''(5)(1)(e) Storage Limitation'''
 +
||
 +
'''Article 5 '''of GDPR: Principles relating to processing of personal data 
 +
 +
1. Personal data shall be: 
 +
 +
e) kept in a form which permits identification of data subjects for ''no longer than is necessary ''for the purposes for which the personal data are processed 
 +
 +
|-
 +
||'''(5)(1)(f) Integrity and Confidentiality '''
 +
||
 +
'''Article 5 '''of GDPR: Principles relating to processing of personal data
 +
 +
1. Personal data shall be: 
 +
 +
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures ('integrity and confidentiality') 
 +
 +
|-
 +
||'''(5)(2) Accountability '''
 +
||
 +
'''Article 5 '''of GDPR: Principles relating to processing of personal data
 +
 +
2. The controller shall be responsible for, and be able to demonstrate compliance with, [https://gdpr-info.eu/art-5-gdpr/ paragraph 1] ('accountability') 
 +
 +
|-
 +
||'''(7)(1) Informed consent, demonstration of consent'''
 +
||
 +
'''Article 7''' of GDPR: Conditions for consent
 +
 +
1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of his or her personal data.
 +
 +
|-
 +
||'''(25)(2) Technical and organisational measures - purpose'''
 +
||
 +
'''Article 25 '''of GDPR: Data protection by design and by default 
 +
 +
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of processing are processed. 
 +
 +
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of processing are processed.
 +
 +
That obligation applies to: 
 +
 +
* the amount of personal data collected
 +
* the extent of their processing
 +
* the period of their shortage
 +
* their accessibility 
 +
 +
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
 +
 +
|-
 +
||'''(30)(1)(e) Categories of Personal Data'''
 +
||
 +
'''Article 30 '''of GDPR: Records of processing activities
 +
 +
1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: 
 +
 +
e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards 
 +
 +
|-
 +
||'''(89)(1) Safeguards and Pseudonymization '''
 +
||
 +
'''Article 89 '''of GDPR: Safeguards and derogations relating to process for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 
 +
 +
1. <sup>1</sup> Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject.
 +
 +
<sup>2</sup> Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation.
 +
 +
<sup>3</sup> Those measure may include ''pseudonymization ''provided that those purposes can be fulfilled in that manner. 
 +
 +
<sup>4</sup> Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. 
 +
 +
|}
 +
=Support for Privacy Policies and Features=
 +
If you have any inquiries about the GDPR, the implementation of any of these features, and/or [[SmartSimple]]'s [[Privacy Policy|privacy policies]], please feel free to reach out to us via our [[How the SmartSimple Support Desk Works|support team]]. 
 +
 
=See Also=
 
=See Also=
 
* [[Configuring Privacy, Confidentiality and Other Policies]]
 
* [[Configuring Privacy, Confidentiality and Other Policies]]

Latest revision as of 15:16, 24 February 2022

Please see Configuring Privacy, Confidentiality and Other Policies for related information. 

Overview

One of the largest aspects of SmartSimple's privacy configuration is our compliance with the General Data Protection Regulation (GDPR). The GDPR is an EU legislation that is designed to protect the fundamental rights of citizens and their personal data. This law ensures that people not only know where their private data is kept, but it also holds organizations accountable and transparent in their practices.

EUGDPR.org lists the key changes brought about by the enforcement of the GDPR, which began on May 25, 2018. As a directly binding regulation, the GDPR stipulates that controllers of personal data must put in place appropriate technical and organizational measures to implement its data-protection principles.

This article describes which features and policies SmartSimple has implemented into our platform to help you comply with the GDPR.

For more information about SmartSimple's implementation of GDPR-compliance, see our website. 

Feature Descriptions and Requirements

SmartSimple has created two categories of features that are GDPR-compliant: features related to Personal Data Management, and those related to Consent and Compliance. 

Personal Data Management Features

Personal Data Management features are focused on managing your data effectively and automating your data governance model. To make the most use of the following features, we recommend identifying all personal data fields in the system and organizing them into data categories. 

Feature Description GDPR Regulation
Personal Data Field (Indicator)

This will indicate whether a field contains personal data and add a processing description.

This allows you to quickly differentiate between personal and non-personal data fields, and allow internal and external users to view the description. Adding an indicator makes it easier to ensure that all personal data fields are accounted for when erasing personal data, adding policies, enabling pseudonymization, or searching/reporting.

Data Categories

Organizing the data you collect into data categories such as the following: Contact Data, Financial Data, Highly Sensitive Data, etc.

This feature will allow you to tailor highly specific security and data retention policies to different classes of data. You are able to apply any number of policies to a category.

Data Retention Policies A data retention policy defines how long your organization will need to retain the data of this category in the system before it is erased. A data retention policy can be placed on any field in the system, and the erasure will be completely automated. Retention is based on the number of months or days after a specific date.
  • (5)(1)(e) Storage Limitation
  • (5)(1)(b) Purpose Limitation
Data Security Policies

A data security policy defines who can see and/or modify the data of this category in the system.

Security policies support SmartSimple's role-based security. We can configure your security policies to help you achieve the principle of principle limitation and integrity and confidentiality by ensuring that only those who need to access data for legitimate, specified purposes will be allowed to do so.

  • (5)(1)(b) Purpose Limitation
  • (5)(1)(f) Integrity and Confidentiality
Pseudonymization

Pseudonymization allows you to mask personal data fields, so that the data you retain on an individual is rendered unidentifiable.

Pseudonymization allows for a nuanced approach to data management. Deleting a entire profile and all the data associated with a person is often unnecessary and will create gaps in reports. Utilizing pseudonymization enables you to render specific fields unidentifiable, retaining the effectiveness of long-term reporting while meeting data retention requirements.

  • (5)(1)(e) Storage Limitation
  • (5)(1)(f) Integrity and Confidentiality
  • (5)(1)(b) Purpose Limitation

Consent and Compliance Features

These features are catered towards managing your data subject's consent, as well as managing your overall compliance.

Feature Description GDPR Requirements
Personal Data Field (Information & Access)

It is essential that the end user understands why and how you will process their personal data in order for them to make an informed consent decision. 

The Personal Data Field Indicator gives you the ability to indicate any field that will hold personal information and set a description of the uses of that field. 

When the user displays any page in the system that uses personal information fields, they have the ability to see all of the explanations that you have added. On their profile, the user can view a list of personal data fields that you hold on them.  

This feature is automatically available in every instance of SmartSimple.
  • Informed consent
  • Data subject's right to transparent information
  • Information to be provided where data is collected from the data subject
  • Right of access 
Policy Consent

After establishing a policy internally, you can enforce it by having your users agree to it upon login. The policy can be set to mandatory, ensuring that if a user does not accept the policy, they will not be able to access the system or enter personal information.

Any number of policies can be added, and they can be enforced one time, or at timed intervals. Once a user accepts a policy, the system will create a PDF of the acceptance with a time/date stamp, creating a fully auditable consent collection process. 

  • (7)(1) informed consent, demonstration of consent
  • (2) Accountability
Cookie Policy

Cookie Policy is a feature to alert users to the use of cookies on the SmartSimple application. It will alert users landing on the login page and require them to accept the use of cookies. 

We have also introduced a policy template that you can use to create your own cookie usage policy within your Privacy and Security Policies. 

  • Informed consent
Personal Data Erasure

The personal data erasure is used in order to comply with requests to delete user data. This new feature can be enabled on UTA Level 2 types as an individual's data erasure request. 

Within this Level 2, an administrator would then be able to review these Level 2 requests and have an option available that would delete the user profile of the Level 2 owner.

A certificate of data erasure is then created in order to reference this activity.

  • Rights of the data subject
Request Tracker UTA 
This is a customized feature that must be requested by the client to be configured into their specific instance of SmartSimple.

We are able to build a Request Tracker to help you manage Data Subject Requests, such as the following: Right of Access; Right to Rectification; Right to Erasure; Right to Restriction of Processing, etc. 

  • Obligations of the controller
  • Rights of the data subject

Glossary for GDPR

Term, Principle, or Abbreviation Definition
EEA

European Economic Area - based on an international agreement in 1992, the EEA enables the extension of the European Union's single market to non-EU member parties. Membership has grown to 31 states as of 2016: 28 EU member states, as well as three of the four member states of the European Free Trade Association: Iceland, Liechtenstein, and Norway. The agreement is applied provisionally with respect to Croatia. Switzerland has not yet joined the EEA, but has a series of bilateral agreements with the EU which allow it to also participate in the internal market. 

EU

European Union - a political and economic union of 28 member states that are located primarily in Europe. 

GDPR

General Data Protection Regulation - The GDPR 2016/679 is a regulation in EU Law on data protection and privacy for all individual citizens of the European Union (EU) and the European Economic Area (EEA). The GDPR was adopted on April 14, 2016 and became enforceable beginning May 25, 2018. 

GDPR Principle Description
(5)(1)(b) Purpose Limitation

Article 5 of GDPR: Principles relating to processing of personal data 

1. Personal data shall be: 

b) collected for spescific, explicit, and legitimate purposes, and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation') 

(5)(1)(e) Storage Limitation

Article 5 of GDPR: Principles relating to processing of personal data 

1. Personal data shall be: 

e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed 

(5)(1)(f) Integrity and Confidentiality 

Article 5 of GDPR: Principles relating to processing of personal data

1. Personal data shall be: 

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures ('integrity and confidentiality') 

(5)(2) Accountability 

Article 5 of GDPR: Principles relating to processing of personal data

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability') 

(7)(1) Informed consent, demonstration of consent

Article 7 of GDPR: Conditions for consent

1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to the processing of his or her personal data.

(25)(2) Technical and organisational measures - purpose

Article 25 of GDPR: Data protection by design and by default 

2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of processing are processed. 

2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of processing are processed.

That obligation applies to: 

  • the amount of personal data collected
  • the extent of their processing
  • the period of their shortage
  • their accessibility 

In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.

(30)(1)(e) Categories of Personal Data

Article 30 of GDPR: Records of processing activities

1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: 

e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards 

(89)(1) Safeguards and Pseudonymization 

Article 89 of GDPR: Safeguards and derogations relating to process for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 

1. 1 Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject.

2 Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation.

3 Those measure may include pseudonymization provided that those purposes can be fulfilled in that manner. 

4 Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. 

Support for Privacy Policies and Features

If you have any inquiries about the GDPR, the implementation of any of these features, and/or SmartSimple's privacy policies, please feel free to reach out to us via our support team. 

See Also

Retrieved from ‘https://wiki.smartsimple.com/index.php?title=General_Data_Protection_Regulation_(GDPR)&oldid=39466’