GDPR and Research Data Management

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

An introduction
GDPR and Research Data
Management
Tim Rodgers, Compliance and Information Governance Manager, ICT
November...

GDPR…what’s new?
• A single set of rules governing all EU nations, and all organisations that
process personal data of EU ...

Definitions of data
Personal data includes online identifiers and location data (IP addresses, mobile
device IDs, cookie I...

Sanctions
• Isn’t (and has never been) just about loss of data
• For controllers and processors
• Two bands of fine – 2%/€...

Data protection safeguards
“To implement appropriate technical and organisational measures”
These safeguards should be app...

Privacy by Design
• Essential an organisation ‘shows its working’
• DP concerns should be weaved into the design of all pr...

Consent
• Where required it must be :
Any freely given, specific, informed and unambiguous indication of his or
her wishes...

Rights for data subjects
• To be informed – for privacy notices to be more robust and transparent
• To have explained purp...

Breach reporting
• Mandatory unless there is no risk to the rights of data subjects
• Articles 33 & 34 indicate pseudonymi...

Privacy and Innovation
• Obvious main thrust of GDPR – to bolster privacy rights
• BUT ALSO…
• Harmonising legislation
• E...

Key articles and recitals
• Recital 159 – broad definition of research
• Article 6(4), Recital 50 – organisations processi...

Research as a basis for processing
• Article 6(1) outlines lawful bases for processing
• Article 6(4) allows data obtained...

Research as a purpose
• Controllers may process personal data, without consent, when “processing is
necessary for the purp...

Article 89 Appropriate Safeguards
• Controllers that process personal data for research purposes need to have
safeguards
•...

Other considerations
• Article 12(1) – Need to inform data subjects of what’s happening to their data
• This should be pro...

Data Subject Rights
• Article 17 discusses the right of erasure when consent is withdrawn, or the
data subject ob However ...

Transfer to third countries for research
• Article 45(1) prohibits transfer of data outside EU unless there is adequate
pr...

Profiling
• Article 35(2) requires a PIA for :“a systematic and extensive evaluation of
personal aspects relating to…perso...

Research sensitive personal data
• Sensitive data can be processed for research – please see Article 9(2)(i)
which says th...

Summary of regulation
Exemptions carved out for researchers :
- Researchers can process data for purposes beyond that for ...

• IAO
• IAA
• Who has access (organisation)
• Categories of data
• How is it secured?
• How often is it backed up?
• Is it...

DPIA
• All projects/processes require a DPIA – a Data Privacy Impact Assessment
• Being embedded in ICT Project Management...

The Governance of Information Governance
The Senior Information Risk Owner – John Neilson
Data Protection Co-ordinators (a...

Information Governance Policy Framework
Information Governance Policy Framework – overarching document
Information Securit...

Q&A

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1057327 views
Storytelling For The Web: Integrate... by Chiara Aliotta 973877 views
Artificial Intelligence, Data and C... by OECD Directorate ... 910242 views
How to Leverage AI to Boost Employe... by SocialHRCamp 385546 views
2024 State of Marketing Report – by... by Marius Sescu 218326 views
Everything You Need To Know About C... by Expeed Software 235577 views

View on Slideshare

1 of 26 Ad

View on Slideshare

1 of 26 Ad