The fundamental principles underpinning all data protection requirements set out in the Regulation (EU) 2016/679 (the ’GDPR’). The principles are explicitly declared in article 5 but they have been gradually developed and established in European law.
The right to privacy was first proclaimed in the United Nation’s Universal Declaration of Human Rights but the beginnings of modern data protetion principles were initially included in the European Convention on Human Rights.
Subsequent developments in European data protection law have brought up and distilled the principles, laying the groundwork for their further refinement with the GDPR.
While the principles are listed in Article 5 of the GDPR, they form the underlying goal and ultimate aim of the regulation’s subsequent provisions which provide a detailed implementation of the principles. Understanding the principles allows us to know why specific requirements or restrictions have been put in place.
The regulation recognizes the follwing principles:
1. Lawfulness, fairness and transparency
The central principle, which the controller must observe before collecting of processing personal data. It stipulates that personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject. This principle consists of three core elements:
Lawfulness of processing means that personal data may only be processed when the data controller has appropriate legal grounds for the processing. Data processing, in other words, can be carried out only within the limits set by applicable laws. Article 6 of the GDPR provides the possible legal grounds that can make data processing lawful.
Fairness requires that the data subject is aware of the processing, and that it does not unjustifiably impact the rights and interests of the individual.
Transparency is closely linked to Fairness and means that data controllers must be open and transparent towards data subjects, providing individuals with information in a clear and concise way and in a timely manner, allowing them to make informed decisions and to exercise their rights.
2. Purpose limitation
The notion that personal data is not further processed in a manner that is incompatible with the purposes for which it was collected.
Any secondary or additional processing is in line with the principle only if it is compatible with that original purpose. A careful assessment must be carried out prior initiating any additional data processing as to whether it is compatible with the purpose. If such compatibility is not established, the data controller must have a separate legal basis, or the further processing would be considered unlawful in breach of the Lawfulness principle.
3. Data minimisation
Data minimisation requires that personal data must be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. What this means, is that the data controller must process only the personal data that is necessary to accomplish the purpose(s), and not any additional or excessive data.
For example, when collecting data for …
Controllers should minimize both the types of personal data being processed, as well as the volume of such data – to what is necessary to attain their lawful purpose(s).
4. Accuracy
This is the principle that personal data must be maintained accurate and up to date. Data controllers must implement and maintain measures to collect accurate data and update it when needed.
This princple corresponds to the right to rectification, which is available to data subjects, and allows individuals to request the correction of their personal data.
5. Storage limitation
This principle requires that personal data is processed for no longer than necessary for the purposes for which it is processed. Data controllers must determine the appropriate data retention periods, and have adequate procedures for securely erasing personal data which is no longer needed.
The storage limitation principle corresponds to the right to erasure or (’Right to be forgotten’) which allows data subjects to request the deletion of their personal data which is no longer needed for the purposes for which it was collected.
6. Integrity and confidentiality
The GDPR requires data controllers to process personal data in a manner that ensures appropriate security of the personal data, including protection agains unauthorised or unlawful processing, and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
There are two general ’threats’ to the integrity and confidentiality of personal data, both of which can potentially lead to personal data breaches resulting in harm to individuals, and regulatory risk to data controllers.
The first involves the access, handling or processing of the data by unauthorised persons, or in by authorised ones, but in an unlawful manner. The second involves the loss or destruction, usually caused by damage to physical media or digital erasure, corruption, or damage (either malicious as in the case of computer hacks or viruses, or incedental).
This is the “technical” part of data protection as it provides the basis for all technological and organisational measures that need to be implemented to protect personal data. Data breaches can have significant consequences both for individuals and for controllers, and could lead to sizeable sanctions and loss of trust in the business, depending on their severity.
7. Accountability
Finally, the accountability principle established that the data controller is ultimately responsible for compliance with all other principles of data protection. Not only that, but controllers are expected to document and be able to demonstrate their compliance.
Observing the data protection principles are a strong start on the way to full GDPR compliance. Get in touch now to make sure your business is prviacy-compliant.
One Response