Head of policy and engagement at the Information Commissioner’s Office, Jo Pedder, points to useful guidance on the new EU General Data Protection Regulation that is set to come into force come May 2018.<\/p>\n
The regulation will bring in some major changes as to how organisations are expected to look after personal data and the responsibilities in disclosing them to the authorities and affected individuals. The changes could mean huge punishments for organisations who fail to take their data protection responsibilities seriously.
\n<\/p>\n
As the U.K.’s representative for the EU’s Article 29 Working Party, the ICO has provided a lot of useful tips about the changes, including a publication of 12 steps to take right now<\/em><\/strong> ahead of the GDPR coming in effect on 25 May 2018:<\/p>\n The GDPR is set to change profiling, which is where an individual’s personality, behaviour, interests, habits and other characteristics are identified, analysed and predicted. Organisations may gather information like education, browser history, financial data, purchase history etc… in order to market\u00a0goods and services they think an individual wants or needs.<\/p>\n Profiling has grown exponentially in the last few years to the stage where the presence of online personal data is rife. The GDPR is, however, set to increase the rights for data subjects and raise the bar on obligations for data controllers, which may result in huge changes<\/strong> to the way companies are advertising on the internet.<\/p>\n After 25th<\/sup> May 2018, organisations will need to show that the personal data they obtain is minimised, rather than gathering masses and masses of information in case it can be used for various purposes later. This information will need to be accurate given that inaccurate information can lead to organisations making the wrong classifications and decisions. The GDPR also calls for proper retention of obtained personal data by regularly reviewing the data to make sure it is still “relevant for the purpose.”<\/p>\n If an organisation is relying on consent for the legal basis of obtaining personal data, that consent is only valid if it is “freely given, specific, informed and unambiguous.” <\/p>\n However, there are some circumstances when such consent may not be needed:<\/p>\n\n
Changes to profiling<\/h3>\n
Changes on consent<\/h3>\n