6 ms·
How would you ensure that a company is only using the data for legitimate purposes without resorting to some kind of control mechanism?
by ThePhysicist 9y ago
How would you ensure that a company is only using the data for legitimate purposes without resorting to some kind of control mechanism?
- Silhouette 9y agoWe do have control mechanisms, but they are practical measures. Data of a given type is kept in one primary location with systematic backups. Processing of that data is typically done by programs that all use a specific related module in the code to access the data so they're easy to review, except for things like email where the nature of the processing is obvious anyway. Only a limited number of people have access to the relevant code or data at all, and everyone involved knows everything that is going on and could immediately describe exactly what data we store and how it is used. The privacy policy discloses our practices accordingly. What we don't currently have is a lot of the formalities that may (or may not) be required once the GDPR comes into effect.
- lagadu 9y agoI commend your organization: by following some good practices when it comes to data collection and storage it's already very far into the process of being GDPR compliant, it looks like all you all are missing is the documenting it part of it where the processes are clearly defined and nominating someone to be the data protection officer. He was asking in general however, without a mechanism to control that corporations are doing what yours is already doing, how would we verify compliance?