this video I want to take a look at something that's coming up in 2018 in
May 2000 18 which is gonna have serious implications for organizations and
employers in particular is to do with data protection a new data protection
law is basically coming into Ireland it's coming into all of europe but is
having direct effect in ireland on I think it's the 25th of May 2018 so this
is what this video is gonna be about if you are an employer or a data controller
in an organization you should I think final helpful if you're a subject or
data subject for example an employee in an organization you may find that
helpful as well because the new legislation the new law coming in on
front of this general data protection regulation from Europe it's going to
give Donna subjects enhanced rights so as I say it has direct effect in Ireland
from 25th of May 2018 the effect will be to replace the existing data protection
frame up in Ireland so currently we've got - I think it's data protection acts
on our statute books in 1998 Act and the 2003 amendment act this is going to lead
to a new Act being brought in which is currently I believe in a published bill
with the with the government wherever possible come in yet but the broad
thrust of what's in this GDP or regulation will have to be given effect
in any legislation that's passed in Ireland essentially it involves new
obligations for data controllers and new rights for data subjects there are three
principles one security security of data - accountability data controllers will
need to be much more accountable for the gathering and processing of data and
three transparency extra enhanced rights for data subjects to obtain the data
that's held on them and to have that amended and even the right to be
forgotten to have data extinct the leases so I will change for you well
are you a data controller if you are a data controller then you're going to be
looking at big changes the number there's a number of changes and I'm
gonna go through them here but you know well if the video might seem
intimidating to you and there's a lot of information in it this is really an area
that could cause you serious difficulty if you are a data controller for example
if you're an employer financial penalties there are going to be severe
financial penalties for breaches of the general data protection rating
regulation and the broader data protection law penalties can reach 4
percent of our organizations worldwide turnover or 20 million euros for
breaches of the data protection law so it clearly does that's a very very
significant the right of an individual then whose rights have been breached
with respect to data and legislation and data protection have been greatly
increased enhanced currently an individual if there's a breach of your
data protection rights as for example an employee all you can really do is make a
complaint to the Data Protection Commissioner Data Protection
Commissioner can then investigate an issue sort of a recommendation a warning
against the data controller however you cannot again financially unless you can
show financial loss the new scenario is going to allow you to recover for non
material damage so any damage just caused to you currently you need to show
loss you need to show either physical damage or psychological or psychiatric
damage or financial damage then you may be able to recover but broadly it's a
rap over the knuckles for the data controller in the new scenario the new
situation from next May you can us in a Dallas subject as an employee for
example recover for non material damage so that good example for example include
stress caused to you as a result of the breach of your rights greater
transparency the GDP or no blades the data cuts over to address a list of
questions and what a gathering at questions would include the legal basis
for processing the data how long it will be retained and detailed information for
the data subject about their data protection rates must be given to the
data subject questions would also include what's the purpose of gathering
the data and essentially if you're a data controller if you're gathering data
and it's not gathered for the purpose that the stated purpose of the data
processing well then really shouldn't be gathered an organization must be able to
show complaints with the principles of the GDP or as well so that's a burden of
proof that shifts to the data controller so applied to the data controller to
show compliance with the data protection law the new data protection law to the
greater obligation now in terms of record-keeping there's no requirement to
register with the Data Protection Commissioner if you have less than 250
employees there's no record-keeping part however you do need if even if you're a
small organization appropriate data protection policies for example a
generator data protection policy a website cookie a privacy statement
policy a policy for the use of CCTV but policies for the use of email internet
interaction with social media sites and so on and so forth you know from the
workplace so greater record-keeping obligation consent then is a huge issue
in the new GDP our regime is it enough for a legal basis for processing in
other words if you're a data controller and your data subject has consent that
is that enough for a lawful basis for processing probably not it's vital that
the consent that is given though is given freely and it can be freely
withdrawn at any time Schumi is easy to a draw as it needs to
give us as I said the consent needs to be freely given specific informed and
unambiguous the organization must be able to prove
that they obtained the consent it's unlikely that the consent will be
regarded as freely given if there's a huge inequality or imbalance between the
parties for example and applauded employee situation so if you consider
many many companies many employers issue conflicts of employment and in it there
be a probationary the Data Protection and that would state
basically that the diner's objecting is consenting to the use by the employer of
data protection or personal data that type of consent that's bundled in with a
contract of employment may not necessarily be certainly not advisable
it because the the consent is not that freely given or own ambiguous or
specific it's broadly about something else and there is an imbalance between
an employer's powers and employees cause let's face it if an employee is getting
a new job he or she is likely to sign anything you know so it's not until the
data protection thing the employer needs to be careful that the consent is a
genuine consent so it's unlikely that the mere giving of consent gives an
organization and legal basis a lawful basis for a collection of data a more
reasonable legal basis for collection rather the consent would be for example
the performance of the employment contract or compliance with legal
obligations for example tax obligations or record-keeping for employment law
purposes these are legal basis for gathering data or another one could be
the legitimate interest of the employer but it needs to be a legitimate interest
the consent must not be born too late with all the terms and conditions of a
contract between the parties for example a contract of employment
it must be separated in a separate consent declaration and the burden of
proof proving that a valid consent was obtained is on the employer the gdpr
makes provision for data protection office of a DP or some organizations
will need to designate a person as a data protection officer these
organizations would include public bodies large organizations if you are a
data controller in an organization you need to consider the way you need a data
protection office in your organization other organizations that will need DPO
will be public authorities and organizations who systematically and
regularly monitor data subjects on a large scale or also organizations who
process sensitive personal data on a large scale or data in relation to
criminal offenses these will organizations will need a dedicated data
protection officer this officer make from the internal from the organization
itself or even appoint an external person to the role and it is envisaged
does organizations may well be set up to provide this type of service they start
a Protection Officer service to organizations to a number of
organizations the Data Protection Officer must inform and advise the
organization of its obligations under gdpr
it must provide advisory or she must provide advice and act as a point of
contact with the supervisory authority that's the data protection commissioner
and monitor the organization's complaints with the law reporting data
breaches that the most ensuring certain procedures in place to detect report and
investigate and a data protection breach this new law will introduce mandatory
data breach reporting obligations to the data protection commissioner and failure
to result or failure to report a breach will result in a fine in addition to the
fine for the breach if a fine is opposed and breaches will typically have to be
reported within 72 hours so the no meeting around the bush or sitting on
your hands in relation to days however if there's no risk to the employees data
rates there's no obligation to report the breach to the Data Protection
Commissioner data subjects then are going to have enhanced rights to have
for example inaccurate data rectified her personal data arrays without delay
this is a new right a right to be forgotten data subject you'll also have
the right to restrict the processing of their personal data and they'll also
have the opportunity to object to its processing altogether although this
should be on a compelling legitimate grounds they also have a right to data
portability and this is the right to obtain and use their own data for their
own purposes across different services this could occur for example if you're
moving jobs or indeed moving banks or something of that nature maybe moving a
medical provider advisors and so on and also the right not to be evaluated on
the basis of our of natus processing of data
data subjects these data subject rates however are not absolute for personal
data to be raised it must no longer be required for a purpose for which it was
acquired so if an employer for example has data and needs to retain us to be
compliant with the law in relation to record-keeping and so on and so forth
the data subject and does not have the right to have that data
erased so obviously the new rights create new obligations on headaches
quite frankly for data consolers but that's the way it's going to be the GDP
are also introduces the concept of a data protection impact assessment this
basically involves an assessment to carrying out systematic consideration of
how a particular issue initiatives that and might be kind of impact on the
privacy of individuals assessment may involve discussions of groups and
stakeholders and the whole thrust of this dpi is to identify potential
problems with an initiative involving the gathering of personal data and look
at ways to mitigate those problems so if you need a data protection impact
assessment who carries out who needs to be involved will be run locally or
centrally an example is where employer will is gonna start monitoring employees
use of the internet also where a hospital mr. in processing its patient
has data in a particular way so a data protection impact assessment should
entertain subscription a purpose of the processing an assessment of the
necessity for the processing operation an assessment of the risks to the rights
of the data subjects and what steps are going to be taken to reduce or mitigate
these risks data portability is a new right for a data subject it's a new
concept and allows the data subject to transmit his personal data to another
data controller he can be done by the data Civic receiving the data and giving
it to the new data controller or having the first one transferred to the new
data controller the right is not an absolute one and only applies to a
automated data which was effectively unknowingly provided by the employee to
the employer and the personal data more simple processed by
the employer with the employees consent it would not apply therefore to data
which was held by the employer a processed based on the legal ground of
legitimate interest or for a specific legal obligation connected with the
employment relationship for example payment or statutory obligations such as
tax for up here as I data subject access request and they must be complied with
within a shorter timeframe of one month however employers can extend it to two
months it's as complexity involved in fulfilling the request if request is
manifestly unfounded or excessive the employer can refuse the request or
charge a fee demonstrated compliance this is the burden of proof the data
controller will need to be able to demonstrate how they comply with the
data protection principles so the burden of proof is on the data controller and
this would mean that employers for example would need to be able to assure
the Concentra given and that there are compelling legitimate grounds for
processing the data where the data subject objects in conclusion GTB PR is
a far-reaching piece of secondary legislation emanating from an EU
directive it should be a particular concern to data controllers and
employers data controllers will need to look very very carefully as an existing
data protection policies they need to look at how they gather data while they
gather data and they'll have need to look at the procedures for responding to
data protection of quests in the future and when they need to carry out data
protection assessments they also need to look at whether they need to appoint a
data protection controller or other protection officer to need to review
their existing data privacy policies and nurses if you need advice or training in
this area my name is Terry Gauri I'm a solicitor Lancefield and you can give me
a call or you can send me an email email is probably the best way to reach me
thanks for watching I hope you find this video useful if you do you might give
the thumbs up down below if you're watching it on YouTube or Facebook or
wherever thank you