8 ms·

I have been helping a school who I do IT work for with their GDPR roll out - not because it is my area of expertise but because they had nobody else to turn to

I have been helping a school who I do IT work for with their GDPR roll out - not because it is my area of expertise but because they had nobody else to turn to and the Local Authority who control the school have released zero guidance in preparation. There are many, many unresolved issues: We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. We sought volunteers but didn't get a single applicant. It is difficult to justify paying someone to do it (if you can find a qualified person) - the budget for things like school books is already paper thin. I contact external suppliers who use our data and receive a wall of silence. Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost. Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. There seems to be a raft of GDPR training systems which are basically a single page questionnaire, costing upwards of £300. I don't have an issue with what the legislation is trying to do it just seems so vaguely implemented. Basically we all know that the organisations who need to clean up their act will be doing the least to comply.

castlecrasher2 8y ago
> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?
- kerrsclyde 8y ago
  We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.
- guitarbill 8y ago
  FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)
  - jamescostian 8y ago
    GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.
    - the_mitsuhiko 8y ago
      There are limits to which data can be requested to be deleted.
    - Cass 8y ago
      It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?
      - 0xffff2 8y ago
        1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
        jdietrich 8y ago
        >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
- existencebox 8y ago
  Disclaimers, although I was responsible for implementing GDPR for a subsection of a bigCo, I am not a lawyer, do not speak for my company, etc. I've just been getting increasingly annoyed by the amount if misinformation on both sides of the GDPR debate, (that it's both a straight good or a straight bad) even in sister comments to this, that I figured I'd try and give a Real Answer to your question. They would need to provide functionality such that an EU resident could request timely export and deletion of any records belonging to them in that guestbook. If your guestbook is physical and substantial, this may be limiting without additional systems, but GDPR also is rather vague in the pushback you're allowed to give if you're completing the export with best intentions, so this will likely not be settled until precedent occurs; this will be even more grey-area due to considerations of "ease of access" of the information in question, and other "softer" considerations. So to answer your question more bluntly: Without the bare minimum of a business process for someone to call up and say "I want to export/delete my entry in your guestbook" I'd say the experts who guided my team would probably agree that the business owner should err on the side of assuming non-compliance, so long as you don't reasonably preclude EU visitors.
  - 0xffff2 8y ago
    Can you clarify how your entire response is substantially different in any way from the single word "maybe"?
    - existencebox 8y ago
      "maybe" doesn't detail the steps you could take to bring yourself into compliance, doesn't describe the specific decision points that put you at risk, and doesn't describe how the "maybe" ever resolves to a hard "yes or no" I've given you the benefit of the doubt in answering this honestly but I don't think you read my initial response charitably.
  - donogh 8y ago
    I would say that you could provide a notice specifying that signing the guestbook also constitutes consent to the public display of the person's name. If you want to take it further, you could ask them to submit a small form confirming their consent. Worst case, you redact their name -- use a marker! -- and document that process as part of your data review. Either way, it's complete overkill. It's not about following the letter of the law; it's about the spirit of the law. No one is going to get sued or fined for providing a public guest book.
- r3bl 8y ago
  Absolutely not. At best, you can challenge them to remove the page with your contribution to the guest book.
  - Spearchucker 8y ago
    TipEx would do, and you could preserve the page.
    - 0xffff2 8y ago
      TipEx == White Out for other US residents. (I had to look it up.)
- deleted 8y ago
  [deleted]
- PeterisP 8y ago
  As far as I'm aware, GDPR doesn't make any new prohibitons in this regard - however, it's quite plausible that they were already technically forbidden for years by the earlier data privacy laws, but simply most organizations didn't pay much attention to them.
- wbeckler 8y ago
  Recital 15 of the GDPR states that it only applies "to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system." So if you don't file the sign in book, it's out of scope of the GDPR.
guitarbill 8y ago
> I contact external suppliers who use our data and receive a wall of silence. > Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. Oh no! Protecting pupil's private information. For me, the shocking part is that the suppliers aren't receiving anonymized data already.
- andybak 8y ago
  I don't think you read the sentence properly before responding. Notice the word "safety" there? I presume he's talking about issues where you need ready access to medical data for students to allow a quick response to medical emergencies in class or elsewhere. Things like allergies and other conditions where normal first aid might cause serious harm. There seems to be two types of responses to GDPR. On one side people saying "I don't see what the problem is with just doing the right thing!" and on the other people that have thought about it in a real-world scenario to realise what the problems might be.
  - guitarbill 8y ago
    That's not how I read it, since there's already data protection laws for how to handle kids information. If the data is being used for it's intended purposes ("Parents, give us this information so we can use it in an emergency"), and there's some kind of safe-guard (Only teachers can see it), that should still be fine. What about that under the GDPR is not okay?
    - andybak 8y ago
      > What about that under the GDPR is not okay? I don't know because I didn't write the original post. However your interpretation seems rather peculiar considering the last part of the sentence explicitly mentioned safety issues. One should surely give the original commentator the benefit of the doubt that he talking about a real issue and not just saying "I don't care about pupil's privacy"
  - watwut 8y ago
    These mesical data were supposed to be private by other laws even before - unless you have consent from parent.
oliwarner 8y ago
> this basically cannot be anyone who works in the school at present Why? That isn't a requirement of the law. I could understand how existing staff wouldn't want to take on the role without additional renumeration, but the liability would naturally fall on the head.
- pfg 8y ago
  Depending on the organization, it can be quite hard to find someone who does not have a conflict of interest while still having the necessary skills to act as a Data Protection Officer. As an example, someone working in IT might have the necessary skill, but is likely to have a conflict of interest because part of their duty as a DPO would be to inspect their own work.
  - theptip 8y ago
    The GDPR is pretty vague on that point -- from https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/, the regulation just says: > The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. It seems to me a bit of a stretch that working in IT is a conflict of interest with adhering to data processing regulations; ensuring that your infrastructure is compliant is generally one of the remits of the IT function. You could convince me that the head of "analytics and user data extraction" at Facebook might have a conflict of interest with the DPO hat, but I'm skeptical about the broader claim that these conflicts are hard to avoid.
    - pfg 8y ago
      > It seems to me a bit of a stretch that working in IT is a conflict of interest with adhering to data processing regulations; ensuring that your infrastructure is compliant is generally one of the remits of the IT function. That's a bit like saying auditing/compliance is something that you might as well let the accounting department take care of. It's certainly true that making sure you're compliant with various regulations is a large part of what someone in accounting does, but it seems pretty clear that you can't let the same person be the auditor as well without a conflict of interest, and that's roughly what the role of a data protection officer is all about. There's some evidence that data protection authorities share this view; a German authority fined a company after they appointed the IT manager as their DPO[1] (sorry, German-only source). It might be too early to say for sure how this will play out, but I wouldn't gamble on data protection authorities accepting just any IT employee unless they're working in some very specific role that prevents any conflict of interest. [1]: https://www.lda.bayern.de/media/pm2016_08.pdf https://www.lda.bayern.de/media/pm2016_08.pdf
mgbmtl 8y ago
> We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. Naive question: isn't the data officer basically a single point of contact on data issues (and have some general knowledge on the topic)? Why can it not be someone working at the school? By default, if they cannot delegate, wouldn't the responsibility go to the director of the school? I feel like we tend to be overly pedantic in how we interpret some of the GDPR. For example, a small shop might not have a physical security officer. The owner/manager of the shop still has to have some general sense about ensuring the physical security of the shop, dealing with contractors/vendors (alarm system), etc. With data collection, isn't it the same? Aren't people already doing this? No one would collect data, and not care about its basic security? I think it's great that GDPR is forcing people to wonder: what data do we have, is it shared, who is responsible, what's the retention, and can it be deleted on request. After that, I don't buy into the fear mongers trying to make a quick buck.
- 0xffff2 8y ago
  >No one would collect data, and not care about its basic security? Um... I think that's exactly what most small organizations do.
- donogh 8y ago
  A small shop absolutely does not need a DPO. See guidance here: http://gdprandyou.ie/data-protection-officer/ http://gdprandyou.ie/data-protection-officer/ If the small shop happens to be collecting sensitive personal data -- health data, political affiliations or union membership, etc. -- (a) they should probably stop and (b) they would need a DPO. Highly unlikely in any case ! As to the DPO, it is meant to be an independent person within the organisation, who cannot be unduly influenced by management, etc. Assigning the role to a regular employee who, e.g., reports to the principal and is a teacher by day, would not seem to satisfy the requirement. Bear in mind that a DPO has to have "expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39".
  - jamescostian 8y ago
    The link you provided says you need a DPO in an organization > Where the core activities of the organisation (controller or processor) consist of data processing operations, which require regular and systematic monitoring of individuals on a large scale Small shops contain things that they sell, and they also keep records of selling things for tax purposes, and may even have video cameras to avoid getting robbed. IANAL but isn't that a lot of data processing operations, and isn't there lots of systematic monitoring of individuals? Or are you saying that because it's not "large scale" (e.g. only 100 people walk in a day) and it doesn't have sensitive data, then it's immune?
jdietrich 8y ago
>We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. As a public body, you are required to appoint a data protection officer. That officer may be an existing staff member, provided that they have suitable training. They may fulfil other tasks and duties, as long as these duties do not result in a conflict of interests. The same person can act as the data protection officer for more than one organisation, so you could share a DPO with other schools or the local authority. (GDPR Art. 37-39) If no-one in your organisation is competent to act as a DPO, then you were almost certainly breaching the Data Protection Act. https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/ >Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost. They were already illegal under the Data Protection Act. You can use visitor forms or cards instead of a visitor book - the receptionist still has a record of visitors, but their personal information isn't on display. >Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. This was already illegal under the Data Protection Act. If parents want staff to be aware of sensitive medical information relating to their child, you should have taken a written declaration consenting for that information to be shared. That information should not be displayed in a place where pupils, visitors or any other unauthorised person might see it.
- donogh 8y ago
  A school does not necessarily meet the definition of a public authority [1]; I would say it's not; it depends on individual EU countries to legislate on that definition. Furthermore, in Ireland, for example, fines cannot be levied against public authorities: https://www.irishtimes.com/news/crime-and-law/public-bodies-not-subject-to-fines-under-new-data-protection-bill-1.3377063 https://www.irishtimes.com/news/crime-and-law/public-bodies-... [1] https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b-4dba-a866-ca5daa8e2e91 https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b...
  - jdietrich 8y ago
    The Data Protection Act 2018 was passed by parliament today. It applies the definitions of "public authority" given in Schedule I of the Freedom of Information Act 2010 (with a few exceptions), so maintained and academy schools are considered public authorities for the purposes of the GDPR. It does grant the Secretary of State the right to alter this definition, so it's possible that schools could be removed from this scope if the impact is deemed to be unreasonably onerous. http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180...
donogh 8y ago
Unfortunately, most organisations need professional guidance on GDPR, and that's not necessarily cheap or accessible to the budget-constrained. A few points on their issues (IANAL): 1. Most organisations do NOT need a Data Protection Officer (DPO). There are a set of criteria for determining if you do. Here is guidance on it from the Irish DPC: http://gdprandyou.ie/data-protection-officer/ http://gdprandyou.ie/data-protection-officer/ If they are processing health data, then technically, yes, you might need one. You can consider outsourcing the DPO role to a privacy consultant; it may be the most sensible option. 2. If your data processors have not put agreements in place, then you are legally obliged to do so yourselves. This can actually be an advantage because you set the terms. Unfortunately, again it's best to seek professional advice, preferably legal advice when it comes to drafting contracts. I would go so far as to ask your solicitor to send a "threatening" letter with the agreement they need to sign. 3. Why does the visitor book need to be publicly visible? Is there a secretary or receptionist who could handle the book? Switching it to an electronic system is not necessarily going to meet the requirement. (GDPR is intentionally technologically neutral by the way -- there is no inherent advantage of one medium over another, so long as you're collecting and using data in a justifiable way, and meeting the other data controller requirements.) 4. Again, regarding display of health data, which is considered sensitive personal data, I would say it depends. GDPR is not a series of absolute dictums. Use of data does have to be explained and documented, and I believe you could seek parental consent for display of that information under certain circumstances. (Presumably to teachers who will be overseeing children?) 5. The vagueness of the legislation is definitely a problem. The GDPR does allow for an official certification[i], which will be a huge improvement (whenever we see it!). All the scaremongering aside, the reality is that the legislation is still largely untested. We can fully expect to see a series of test cases appear over the coming months, which will provide clarity. However, it's important to note and realise that no data protection authorities are going to start doling out extreme fines come Friday morning. Even if an organisation is reported to the authority, there will undoubtedly be opportunities for remediation first and, unless it's a serious data breach, I seriously doubt anyone will receive a significant fine any time soon. Facebook, on the other hand... 6. When it comes to training and certification, I'd recommend the IAPP: https://iapp.org/ https://iapp.org/ They are one of the thought leaders in the space, and have a solid track record, with affiliations with lots of reputable privacy consultants. [i] http://www.privacy-regulation.eu/en/article-42-certification-GDPR.htm http://www.privacy-regulation.eu/en/article-42-certification...

castlecrasher2 8y ago

> Things like publicly visible visitors books are outlawed Does this mean the quaint guest book visitors could sign at the hotel I stayed in a couple weeks ago would be illegal under the GDPR?

kerrsclyde 8y ago
We have been told so, if you are publicly displaying personal information about an individual without their permission. Of course their are ways around this, using a single sheet for each person for example.
guitarbill 8y ago
FFS, no. It's optional, you volunteered the data, and the data is used for it's intended purposes. This is still fine. (What wouldn't be fine is scraping the guest book, and then using that info)
- jamescostian 8y ago
  GDPR mandates that you can see your data and remove it in a timely fashion. If you can't contact the person with the guest book some years later, then you can't see your data in a machine-readable format or delete it.
  - the_mitsuhiko 8y ago
    There are limits to which data can be requested to be deleted.
  - Cass 8y ago
    It seems like this would be a trivial problem to solve. In the extremely unlikely case that some guest requests access to or deletion of their data in your physical guestbook, just ask for the approximate date of their stay, look through the book for the relevant page, (presumably entries are sorted by date), make a copy for them (with the data of anyone else that wrote on the page censored out), and stick the original in the shredder. Done. Yeah, it's gonna take you ten, fifteen minutes, but how often is it going to happen, realistically?
    - 0xffff2 8y ago
      1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? 2) If you stick the original in the shredder, you are removing much more than just the requestor's data.
      - jdietrich 8y ago
        >1) Are you allowed under the GDPR to ask for additional information (i.e. date of stay in this case)? You can ask for whatever you like. If I hold any data about you, I have to provide it. It is my responsibility to either store personal data in a form that is amenable to access requests by data subjects, or delete it immediately. >2) If you stick the original in the shredder, you are removing much more than just the requestor's data. There is no "right to retention" under the GDPR. Unless I am obliged to retain that particular data under some other legislation, the GDPR requires me to retain it "for no longer than is necessary for the purposes for which the personal data are processed". The regulations specifically require you to delete personal data as soon as possible. Throwing the whole damned book into the shredder is not only permissible but actively encouraged. https://gdpr-info.eu/art-5-gdpr/ https://gdpr-info.eu/art-5-gdpr/
existencebox 8y ago
Disclaimers, although I was responsible for implementing GDPR for a subsection of a bigCo, I am not a lawyer, do not speak for my company, etc. I've just been getting increasingly annoyed by the amount if misinformation on both sides of the GDPR debate, (that it's both a straight good or a straight bad) even in sister comments to this, that I figured I'd try and give a Real Answer to your question. They would need to provide functionality such that an EU resident could request timely export and deletion of any records belonging to them in that guestbook. If your guestbook is physical and substantial, this may be limiting without additional systems, but GDPR also is rather vague in the pushback you're allowed to give if you're completing the export with best intentions, so this will likely not be settled until precedent occurs; this will be even more grey-area due to considerations of "ease of access" of the information in question, and other "softer" considerations. So to answer your question more bluntly: Without the bare minimum of a business process for someone to call up and say "I want to export/delete my entry in your guestbook" I'd say the experts who guided my team would probably agree that the business owner should err on the side of assuming non-compliance, so long as you don't reasonably preclude EU visitors.
- 0xffff2 8y ago
  Can you clarify how your entire response is substantially different in any way from the single word "maybe"?
  - existencebox 8y ago
    "maybe" doesn't detail the steps you could take to bring yourself into compliance, doesn't describe the specific decision points that put you at risk, and doesn't describe how the "maybe" ever resolves to a hard "yes or no" I've given you the benefit of the doubt in answering this honestly but I don't think you read my initial response charitably.
- donogh 8y ago
  I would say that you could provide a notice specifying that signing the guestbook also constitutes consent to the public display of the person's name. If you want to take it further, you could ask them to submit a small form confirming their consent. Worst case, you redact their name -- use a marker! -- and document that process as part of your data review. Either way, it's complete overkill. It's not about following the letter of the law; it's about the spirit of the law. No one is going to get sued or fined for providing a public guest book.
r3bl 8y ago
Absolutely not. At best, you can challenge them to remove the page with your contribution to the guest book.
- Spearchucker 8y ago
  TipEx would do, and you could preserve the page.
  - 0xffff2 8y ago
    TipEx == White Out for other US residents. (I had to look it up.)
deleted 8y ago
[deleted]
PeterisP 8y ago
As far as I'm aware, GDPR doesn't make any new prohibitons in this regard - however, it's quite plausible that they were already technically forbidden for years by the earlier data privacy laws, but simply most organizations didn't pay much attention to them.
wbeckler 8y ago
Recital 15 of the GDPR states that it only applies "to the processing of personal data by automated means, as well as to manual processing, if the personal data are contained or are intended to be contained in a filing system." So if you don't file the sign in book, it's out of scope of the GDPR.

guitarbill 8y ago

> I contact external suppliers who use our data and receive a wall of silence. > Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. Oh no! Protecting pupil's private information. For me, the shocking part is that the suppliers aren't receiving anonymized data already.

andybak 8y ago
I don't think you read the sentence properly before responding. Notice the word "safety" there? I presume he's talking about issues where you need ready access to medical data for students to allow a quick response to medical emergencies in class or elsewhere. Things like allergies and other conditions where normal first aid might cause serious harm. There seems to be two types of responses to GDPR. On one side people saying "I don't see what the problem is with just doing the right thing!" and on the other people that have thought about it in a real-world scenario to realise what the problems might be.
- guitarbill 8y ago
  That's not how I read it, since there's already data protection laws for how to handle kids information. If the data is being used for it's intended purposes ("Parents, give us this information so we can use it in an emergency"), and there's some kind of safe-guard (Only teachers can see it), that should still be fine. What about that under the GDPR is not okay?
  - andybak 8y ago
    > What about that under the GDPR is not okay? I don't know because I didn't write the original post. However your interpretation seems rather peculiar considering the last part of the sentence explicitly mentioned safety issues. One should surely give the original commentator the benefit of the doubt that he talking about a real issue and not just saying "I don't care about pupil's privacy"
- watwut 8y ago
  These mesical data were supposed to be private by other laws even before - unless you have consent from parent.

oliwarner 8y ago

> this basically cannot be anyone who works in the school at present Why? That isn't a requirement of the law. I could understand how existing staff wouldn't want to take on the role without additional renumeration, but the liability would naturally fall on the head.

pfg 8y ago
Depending on the organization, it can be quite hard to find someone who does not have a conflict of interest while still having the necessary skills to act as a Data Protection Officer. As an example, someone working in IT might have the necessary skill, but is likely to have a conflict of interest because part of their duty as a DPO would be to inspect their own work.
- theptip 8y ago
  The GDPR is pretty vague on that point -- from https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/, the regulation just says: > The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. It seems to me a bit of a stretch that working in IT is a conflict of interest with adhering to data processing regulations; ensuring that your infrastructure is compliant is generally one of the remits of the IT function. You could convince me that the head of "analytics and user data extraction" at Facebook might have a conflict of interest with the DPO hat, but I'm skeptical about the broader claim that these conflicts are hard to avoid.
  - pfg 8y ago
    > It seems to me a bit of a stretch that working in IT is a conflict of interest with adhering to data processing regulations; ensuring that your infrastructure is compliant is generally one of the remits of the IT function. That's a bit like saying auditing/compliance is something that you might as well let the accounting department take care of. It's certainly true that making sure you're compliant with various regulations is a large part of what someone in accounting does, but it seems pretty clear that you can't let the same person be the auditor as well without a conflict of interest, and that's roughly what the role of a data protection officer is all about. There's some evidence that data protection authorities share this view; a German authority fined a company after they appointed the IT manager as their DPO[1] (sorry, German-only source). It might be too early to say for sure how this will play out, but I wouldn't gamble on data protection authorities accepting just any IT employee unless they're working in some very specific role that prevents any conflict of interest. [1]: https://www.lda.bayern.de/media/pm2016_08.pdf https://www.lda.bayern.de/media/pm2016_08.pdf

mgbmtl 8y ago

> We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. Naive question: isn't the data officer basically a single point of contact on data issues (and have some general knowledge on the topic)? Why can it not be someone working at the school? By default, if they cannot delegate, wouldn't the responsibility go to the director of the school? I feel like we tend to be overly pedantic in how we interpret some of the GDPR. For example, a small shop might not have a physical security officer. The owner/manager of the shop still has to have some general sense about ensuring the physical security of the shop, dealing with contractors/vendors (alarm system), etc. With data collection, isn't it the same? Aren't people already doing this? No one would collect data, and not care about its basic security? I think it's great that GDPR is forcing people to wonder: what data do we have, is it shared, who is responsible, what's the retention, and can it be deleted on request. After that, I don't buy into the fear mongers trying to make a quick buck.

0xffff2 8y ago
>No one would collect data, and not care about its basic security? Um... I think that's exactly what most small organizations do.
donogh 8y ago
A small shop absolutely does not need a DPO. See guidance here: http://gdprandyou.ie/data-protection-officer/ http://gdprandyou.ie/data-protection-officer/ If the small shop happens to be collecting sensitive personal data -- health data, political affiliations or union membership, etc. -- (a) they should probably stop and (b) they would need a DPO. Highly unlikely in any case ! As to the DPO, it is meant to be an independent person within the organisation, who cannot be unduly influenced by management, etc. Assigning the role to a regular employee who, e.g., reports to the principal and is a teacher by day, would not seem to satisfy the requirement. Bear in mind that a DPO has to have "expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39".
- jamescostian 8y ago
  The link you provided says you need a DPO in an organization > Where the core activities of the organisation (controller or processor) consist of data processing operations, which require regular and systematic monitoring of individuals on a large scale Small shops contain things that they sell, and they also keep records of selling things for tax purposes, and may even have video cameras to avoid getting robbed. IANAL but isn't that a lot of data processing operations, and isn't there lots of systematic monitoring of individuals? Or are you saying that because it's not "large scale" (e.g. only 100 people walk in a day) and it doesn't have sensitive data, then it's immune?

jdietrich 8y ago

>We are supposed to employ a 'data officer' this basically cannot be anyone who works in the school at present. As a public body, you are required to appoint a data protection officer. That officer may be an existing staff member, provided that they have suitable training. They may fulfil other tasks and duties, as long as these duties do not result in a conflict of interests. The same person can act as the data protection officer for more than one organisation, so you could share a DPO with other schools or the local authority. (GDPR Art. 37-39) If no-one in your organisation is competent to act as a DPO, then you were almost certainly breaching the Data Protection Act. https://gdpr-info.eu/art-37-gdpr/ https://gdpr-info.eu/art-37-gdpr/ >Things like publicly visible visitors books are outlawed (depending on how you read guidance), the alternative are electronic systems - more cost. They were already illegal under the Data Protection Act. You can use visitor forms or cards instead of a visitor book - the receptionist still has a record of visitors, but their personal information isn't on display. >Displaying certain sensitive information, prescriptions for pupils, are now outlawed, this could compromise safety. This was already illegal under the Data Protection Act. If parents want staff to be aware of sensitive medical information relating to their child, you should have taken a written declaration consenting for that information to be shared. That information should not be displayed in a place where pupils, visitors or any other unauthorised person might see it.

donogh 8y ago
A school does not necessarily meet the definition of a public authority [1]; I would say it's not; it depends on individual EU countries to legislate on that definition. Furthermore, in Ireland, for example, fines cannot be levied against public authorities: https://www.irishtimes.com/news/crime-and-law/public-bodies-not-subject-to-fines-under-new-data-protection-bill-1.3377063 https://www.irishtimes.com/news/crime-and-law/public-bodies-... [1] https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b-4dba-a866-ca5daa8e2e91 https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b...
- jdietrich 8y ago
  The Data Protection Act 2018 was passed by parliament today. It applies the definitions of "public authority" given in Schedule I of the Freedom of Information Act 2010 (with a few exceptions), so maintained and academy schools are considered public authorities for the purposes of the GDPR. It does grant the Secretary of State the right to alter this definition, so it's possible that schools could be removed from this scope if the impact is deemed to be unreasonably onerous. http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180...

donogh 8y ago

Unfortunately, most organisations need professional guidance on GDPR, and that's not necessarily cheap or accessible to the budget-constrained. A few points on their issues (IANAL): 1. Most organisations do NOT need a Data Protection Officer (DPO). There are a set of criteria for determining if you do. Here is guidance on it from the Irish DPC: http://gdprandyou.ie/data-protection-officer/ http://gdprandyou.ie/data-protection-officer/ If they are processing health data, then technically, yes, you might need one. You can consider outsourcing the DPO role to a privacy consultant; it may be the most sensible option. 2. If your data processors have not put agreements in place, then you are legally obliged to do so yourselves. This can actually be an advantage because you set the terms. Unfortunately, again it's best to seek professional advice, preferably legal advice when it comes to drafting contracts. I would go so far as to ask your solicitor to send a "threatening" letter with the agreement they need to sign. 3. Why does the visitor book need to be publicly visible? Is there a secretary or receptionist who could handle the book? Switching it to an electronic system is not necessarily going to meet the requirement. (GDPR is intentionally technologically neutral by the way -- there is no inherent advantage of one medium over another, so long as you're collecting and using data in a justifiable way, and meeting the other data controller requirements.) 4. Again, regarding display of health data, which is considered sensitive personal data, I would say it depends. GDPR is not a series of absolute dictums. Use of data does have to be explained and documented, and I believe you could seek parental consent for display of that information under certain circumstances. (Presumably to teachers who will be overseeing children?) 5. The vagueness of the legislation is definitely a problem. The GDPR does allow for an official certification[i], which will be a huge improvement (whenever we see it!). All the scaremongering aside, the reality is that the legislation is still largely untested. We can fully expect to see a series of test cases appear over the coming months, which will provide clarity. However, it's important to note and realise that no data protection authorities are going to start doling out extreme fines come Friday morning. Even if an organisation is reported to the authority, there will undoubtedly be opportunities for remediation first and, unless it's a serious data breach, I seriously doubt anyone will receive a significant fine any time soon. Facebook, on the other hand... 6. When it comes to training and certification, I'd recommend the IAPP: https://iapp.org/ https://iapp.org/ They are one of the thought leaders in the space, and have a solid track record, with affiliations with lots of reputable privacy consultants. [i] http://www.privacy-regulation.eu/en/article-42-certification-GDPR.htm http://www.privacy-regulation.eu/en/article-42-certification...