Business Monitor includes genetic data, information about
sexual orientation, religion, membership of political parties and much besides. Those fines which have attracted much attention can be triggered in various ways: if an organisation doesnʼt process an individualʼs data properly, if it requires a data protection officer but doesnʼt have one, if thereʼs a security breach. Elizabeth Denhamʼs office will decide the level of fines but she says speculation that her office will aim to make examples of companies by issuing the sort of fines which would cripple a business is far wide of the mark. Her office will have the option of big fines (and businesses will know it) but she says: “We always prefer the carrot to the stick.” The ICO prefers to work with organisations to improve their practices and a stern letter will usually achieve the desired result.
The view being held is clearly that, if a company is trying to get GDPR right, the ICO is not going to jump on them with steel clad boots for a minor infraction. They want to use those big fines only when they canʼt achieve compliance in other ways. Ms Denham says: “Fining a top whack is not going to become the norm.”
New obligations
As well as putting new obligations on businesses collecting personal data, GDPR gives the individual significantly increased power to access information thatʼs held about them. Currently, a charge of £10 can be levied by a business faced with a Subject Access Request (SAR). That is being scrapped. Not only must the job be done free, it must be done within 30 days. The foregoing is reassuring but not entirely. The ICO promises to play nice if we are all good boys and girls. Of course, 99% of us will be, but we will also be unsure if we have got this new beast under control until a test case occurs, at which point things could get messy. Then thereʼs the law of unintended consequences which governments everywhere unfailingly pass. Smartpipe, a customer data intelligence specialist, has warned that the American technology giants could prove to be the first beneficiaries of GDPR, thanks to their sheer size.
European companies will be reliant on outside partners to create targeted ads and will need to obtain user consent each time they data-share. The US monsters do not have this constraint because they are not reliant on third parties. Nice one guys! You have been trying to give control of data back to John and Janet T Public and, whoops, managed to do the precise opposite. Oh, but thereʼs more!
How will consumers use the new regulations, and that is ʻuseʼ in the unpleasant sense? There are predictions being kicked around that claims for
| 22 | April 2018
misuse of personal data could exceed the £30 billion compensation for mis-selling of payment protection insurance. That figure applies to the UK alone. Presumably the rest of Europe would be proportionately aggrieved and legally entitled to the same extent. The law firm, Collyer Bairstow, has suggested that customers could weaponise the new regulations by inundating organisations with requests for
The GDPR is a step change for data protection. It’s still an evolution, not a revolution. – Elizabeth Denham, the UK information commissioner
personal data from large groups of people. That could cripple them because they would be legally required to spend all their time dealing with non-productive actions. There is also a crowd-funded non-profit organisation called NOYB (None of Your Business) the purpose of which is to take consumer privacy cases to court under the new rules. Anyone who has read Arthur Haileyʼs book The Moneychangers (first published 1975) will know how it works and that story applied to a bank in one American city long, long before social media was even thought of.
Consider then the idea of a steadily increasing proportion of the billion
Facebook members sharing their dislike of, let us say, a major international bank. Or for that matter, Facebook. All who have has spent time on social media could instantly see how this might be turned from a small event with the benefit of local media coverage into a worldwide calamity for a major organisation. Plus of course itʼs totally legal.
Right to confirmation
Everyone will have the right to confirmation that an organisation holds information about them, access to that information and other supplementary information. A virtue has been made of the fact that the mega corporations will have to give users more control over their data. Unfortunately, the same applies to small companies which donʼt have the financial muscle to defend themselves as robustly as, say, Google.
Private individuals will have the right to have their personal data erased. This will apply where the purpose for which it was collected has ceased to exist, where consent is withdrawn, where the data was unlawfully processed (see above reference to Facebook in Belgium.) For the small business there are a couple of rules of thumb: one, donʼt just send virtuous signals, actually be virtuous; two, be open and state that when people give you personal detail, itʼs going on your database; tell people that they can be erased from said database any time they like. I predict that some businesses will start putting that information in larger type, as in ʻhey look, weʼre the good guysʼ.
www.printwearandpromotion.co.uk
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72 |
Page 73 |
Page 74 |
Page 75 |
Page 76 |
Page 77 |
Page 78 |
Page 79 |
Page 80 |
Page 81 |
Page 82 |
Page 83 |
Page 84
