At the end of this module you will be able to:

• Familiarise with the GDPR

Background, scale and scope…

• Gain awareness on your (digital) rights

The right to be forgotten 

• Comprehend what cookies are what is their scope

When they are harmful and when they are not…

Have you ever noticed that whenever you try to access a website, a big disclaimer pops up requesting you to read carefully (and accept eventually) their cookie policy?

What is a cookie and what is this disclaimer about? Why the WWW is so concerned about terms and conditions of your privacy and (digital) identity?

While surfing on the Internet, you might have come across – or read about – something known as GDPR…

The GDPR (General Data Protection Regulation) is an EU Parliament and EU Council regulation of April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504

Together with Directives, Decisions, Recommendations and Opinions, Regulations represent of the types of EU legislation – legal acts of different binding degrees to which all (or some) Member States should comply with.

Regulations are the ones with at higher binding degree and they must be applied in their entirety across EU.

To know more about the types of legislation: https://european-union.europa.eu/institutions-law-budget/law/types-legislation_en

In the formal policy document, it is stated that:

The whole point of this regulation is to protect EU’s citizens personal data. As such, any organisation operating in EU territories must comply with GDPR.

The regulation applies to ALL organisation, regardless of their juridical status (public institutions, private sectors’ representatives and third sector) and their country of origin, as long as they operate in EU territories (this is the case of tech giants from US such as Facebook, Google, Amazon, etc.). 

In order to have a comprehensive understanding of GDPR, it is important to pinpoint a couple of terms around which the regulation revolves. These includes:

• Personal data → Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• Processing → Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• Controller → The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

• Processor → A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

There are some specific scenarios in which organisations – upon full compliance with GDPR – are allowed to process your data (processing in the sense of Art. 4).

Article no. 6 of the Regulations lists all instances in which organisations can in fact “look into” your personal data.

These conditions fall under six domains…

Any other case in which there is legitimate interest by the organisation

Scenario no. 6 is more susceptible to free interpretation than all the others. If the given interest is legitimate or not, depends on its explicit conflict (or not) with fundamental rights and freedoms of data subjects.

The label of legitimate interest can gain also other shapes and forms in “sensitive” cases: people with criminal records, children and other vulnerable categories…

The most typical example in which you agree on to the processing of your (digital) data is when you accept cookies before browsing any website you want access to.

Cookies are designed to improve your browsing experience and allow website’s owner(s) to keep you signed in, store your preferences, and provide you with locally relevant content that is thematic to your interests.

Due to the clear conflict of interest, after GDPR website’s owners become increasingly concerned about your awareness on this tool.

This depends on:

Technically speaking, you’re not forced to accept cookies. The GDPR is designed to make you aware of their existence and usage by website’s owner(s) and third parties.

This helps you to make better informed decisions on who you’re giving your data and what for…

…however, if that is the case, website’s owner(s) might retain the right to block you from accessing their website or to limit its functionalities and your overall browsing’s experience.

Source: What should I do if I think that my personal data protection rights haven’t been respected?, EU Commission

1. Submit a complain to your national Data Protection Authority (DPA)

2. Take legal action against the “offender”

Definitely a more direct approach than the previous one…

You can be assisted by a professional (i.e., lawyer) if your think that a company or an organisation “mistreated” your personal data = non-compliance with any of the seven principles of data protection

3. Take legal action against the DPA

If you have a genuine belief that the DPA failed to represent your interests, you have the right to settle the case before a court. This is the case when: