The rules apply to any personal data related to any natural person (identified by name, id, genetic material etc.) that is used by a data processor (person or company anywhere in the world) on behalf of a data controller (the person or company responsible for the data who might be anywhere in the world). Basically, GDPR gives a natural person the right to their own data, but there are some interesting consequences of those rights which might make you think about how you manage your online identities.
The GDPR right to portability and the right to be forgotten means that you are now legally entitled to take your data and move it from one controller to another. This means that a company must be able to isolate the personal data and ensure that it can deleted as well as copied or moved in a structured and commonly used, machine-readable format. The GDPR consent criteria mean that your private data can only be stored if your consent is freely given, specific, informed and unambiguous.
The GDPR data quality provisions mean that personal data should only be collected for specified and legitimate purposes; and should not be excessive given the purposes for which the data was collected and processed; as well as accurate and kept up to date. It also means that if the original purpose for collection has gone then the data must be deleted – Even if the data is still useful to the controller.
“But I’m not in marketing why do I care?”, I hear you ask. There are 3 aspects to that:
(1) you will provide personal information to manage your private identity every day. You should be aware of GDPR because affects almost every online portal you use.
(2) in your job, you will manage an identity which might involve your personal identity leaking into your work identity. This might be an issue if you use online tools which have merged your professional and personal data e.g. because you signed into a portal with a private Facebook account. Oops! Who owns that login identity – you or your employer?
(3) in your job you might manage other peoples’ identity information which is almost certainly linked to some personal information. I am sure you know and have implemented your GDPR requirements.
By the time you read this, GDPR will be in its early stages of enforcement. Whether you’re a UK, EU or US company, the world will have changed for you. You might be an international expert and familiar with the EU-US Privacy Shield or you might be a sole trader searching google and jotting your data breach plan onto a table napkin for later use. Whatever you do, spend an hour or two figuring out how it applies to your identities. In today’s cyber-security world, you’ll need that information either as a professional or an individual. Security relies on identity and identity is affected by GDPR.
Until next time, whoever you are!
|