CMCP Diversity Matters - May/June 2018

degree of risk posed to the
rights and freedoms of data
subjects, and the breadth and
scope of the processing. For
example, some organizations
are required to develop a
Data Protection Information
Assessment (“DPIA”) and consult
with the local supervisory
authority (and potentially third
party organizations) regarding
their internal technical and
organizational measures to
ensure the proper handling
and security of personal data.
Further, certain organizations
will be required to employ
the services of a data privacy
officer who is under the specific
mandate to ensure that the
organization is compliant with
the GDPR and serves in the
capacity as quasi-internal
regulator within the organization.
These requirements, however,
are not limited to EU-based
organizations, and therefore
may require a complete overhaul
of practices within US-based
companies whose practices may
fall under the scope of the GDPR.
Derived from a historical
evolution of data privacy
protection from WWII, GDPR
promotes various fundamental
principles such as Transparency,
Fairness, and Lawfulness in
processing personal data,
including data minimization
and proportionality to ensure
that organizations only collect,
use, share, combine, organize,
adapt, transfer, retain, etc.
personal data only to the
extent necessary to fulfill the
lawful purposes prescribed
under the GDPR. Companies
must be strategic about under
what “lawful purposes” they
are acquiring personal data,
and may have different “lawful
purposes” depending on the
type of personal data they
collect (i.e. employee data vs.
customer data). Additionally,
one must understand if one
is acting in the capacity of a
“controller” or “processor”
as each characterization has
specific legal obligations
under the GDPR (and in some
cases, an organization may be
characterized as both).
To illustrate a key element
of the fairness requirement,
organizations collecting data
directly from data subjects are
required to provide clear and
easy-to-understand privacy
notices at the time of collection
(or if collecting indirectly from a
third party, within one month of
collection), specifying:
• the identity and contact
details of the organization
and, if applicable, its data
protection officer
• the types of personal data
being collected and the
specific purposes and legal
basis for processing each
type of personal data
• the recipients of the
personal data
• the organization’s intention
to transfer the personal
data to a third country or
international organization,
and whether such territory
has been issued an
adequacy determination by
European Commission
• the legitimate interests
of the organization if
this is the legal basis for
processing the personal
data
• retention periods for storing
personal data
• disclosure of a data
subject’s rights to withdraw
consent at any time (if
the lawful basis is derived
from consent), or otherwise
request access, and object
to, rectify, block, restrict or
demand permanent erasure
of their personal data
• disclosure of the data
subject’s right to lodge a
complaint with their local
supervisory authority
• the specific nature of
organization’s use of
automated decision making
with respect to personal
data and consequences
thereof
• if there are any statutory or
contractual requirements
to which the data subject
is required to provide their
personal data, and the
implications for failing to
do so
16 | California Minority Counsel Program