GDPR Data Collection | Jeremy Eveland

In the ever-evolving world of technology and digital commerce, protecting personal data is of paramount importance. As businesses navigate the intricacies of data collection and usage, the General Data Protection Regulation (GDPR) stands as a comprehensive framework to safeguard individuals’ information. This article explores the complexities surrounding GDPR data collection, shedding light on its purpose, legal implications, and the steps companies must take to ensure compliance. By understanding the intricacies of GDPR, businesses can effectively address their obligations and mitigate the risk of penalties. As you delve into this article, you will gain valuable insights into this vital aspect of data protection and discover how working with a knowledgeable and experienced lawyer can safeguard your business’s interests.

Buy now

Overview of GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that was implemented in May 2018 by the European Union (EU). Its purpose is to protect the privacy rights of individuals and ensure the lawful and transparent collection, processing, and transfer of personal data. The GDPR applies to any organization that collects and processes the personal data of individuals within the EU, regardless of whether the organization is located within the EU or not.

Purpose of GDPR

The primary purpose of the GDPR is to empower individuals by giving them control over their personal data. It aims to protect individuals from privacy breaches and establish trust between data subjects and the organizations that collect their data. The GDPR also aims to harmonize data protection laws across the EU member states and create consistent standards for data protection.

Click to buy

Scope of GDPR

The GDPR applies to the processing of personal data, which includes any information relating to an identified or identifiable natural person. It covers a wide range of activities related to personal data, including its collection, storage, use, and disclosure. The regulation applies to both automated and manual processing of personal data, as well as to data controllers and data processors operating within the EU.

Key Principles of GDPR

The GDPR is based on a set of key principles that organizations must adhere to when collecting and processing personal data. These principles ensure that personal data is collected and processed lawfully, fairly, and transparently. The key principles of the GDPR include:

Lawfulness, fairness, and transparency: Organizations must have a lawful basis for collecting and processing personal data, and must communicate the purpose and processing activities to the data subjects in a clear and transparent manner.
Purpose limitation: Personal data should only be collected and processed for specified, explicit, and legitimate purposes. It should not be further processed in a manner incompatible with these purposes.
Data minimization: Organizations should only collect and process personal data that is necessary for the intended purpose. The data collected should be limited to what is proportionate to achieve that purpose.
Accuracy: Personal data should be accurate and kept up to date. Organizations must take reasonable steps to ensure that inaccurate or incomplete data is erased or rectified without delay.
Storage limitation: Personal data should not be kept for longer than necessary for the purposes it was collected. Organizations should establish retention periods and criteria for erasing or anonymizing data.
Integrity and confidentiality: Personal data should be processed in a manner that ensures its security, including protection against unauthorized access, loss, destruction, or damage.
Accountability: Organizations are responsible for complying with the GDPR and must be able to demonstrate their compliance with data protection principles. They should implement appropriate policies, procedures, and measures to ensure compliance.

Definition of Data Collection

Data collection refers to the process of gathering and obtaining personal data from individuals. Personal data includes any information that can be used to directly or indirectly identify a natural person, such as names, addresses, contact information, financial data, and online identifiers.

Types of Data Collection

There are various methods and channels through which personal data can be collected. Some common types of data collection include:

Online forms: Organizations often collect personal data through online forms on their websites, such as registration forms, contact forms, or survey forms.
Customer interactions: Personal data can be collected during interactions with customers, such as when they make a purchase, request a service, or engage in customer support activities.
Cookies and tracking technologies: Personal data can be collected through the use of cookies and tracking technologies, which track users’ online activities and collect data such as IP addresses, browsing behavior, and preferences.
Employee data: Organizations collect personal data from their employees for various purposes, such as payroll management, human resources administration, and performance evaluations.

Importance of Data Collection

Data collection is a crucial aspect of business operations, as it enables organizations to understand their customers, provide personalized services, and make informed business decisions. By collecting and analyzing data, organizations can gain valuable insights into customer preferences, market trends, and emerging opportunities. However, it is essential for organizations to collect and process personal data in compliance with the GDPR to protect the privacy rights of individuals and maintain the trust of their customers.

Legal Framework for Data Collection under GDPR

The GDPR provides a legal framework for the collection and processing of personal data. Organizations must have a lawful basis for collecting and processing personal data, and must comply with the consent requirements, legitimate interests, contractual obligations, and legal obligations outlined in the regulation.

Lawful Basis for Data Collection

Organizations must identify a lawful basis for collecting and processing personal data under the GDPR. The lawful bases include:

Consent: The data subject has given explicit consent for the processing of their personal data for specific purposes.
Contractual obligations: The processing of personal data is necessary for the performance of a contract to which the data subject is a party.
Legal obligations: The processing of personal data is necessary for compliance with a legal obligation to which the organization is subject.
Legitimate interests: The processing of personal data is necessary for the legitimate interests pursued by the organization or a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject.

Consent Requirements

Consent is one of the lawful bases for processing personal data under the GDPR. For consent to be valid, it must be freely given, specific, informed, and unambiguous. Organizations must ensure that individuals have a genuine choice and control over the use of their personal data, and must obtain their explicit consent for each processing activity. Consent can be withdrawn at any time by the data subject.

Legitimate Interests

Organizations can process personal data based on legitimate interests, provided that the interests are not overridden by the rights and freedoms of the data subject. Legitimate interests may include fraud prevention, direct marketing, network and information security, or internal administrative purposes. Organizations must conduct a legitimate interest assessment to evaluate the necessity and proportionality of processing personal data based on legitimate interests.

Contractual Obligations

If the processing of personal data is necessary for the performance of a contract with the data subject, organizations can collect and process the data without explicit consent. This includes processing activities that are necessary to take steps at the request of the data subject prior to entering into a contract.

Legal Obligations

Organizations may process personal data if it is necessary for compliance with a legal obligation to which they are subject. This includes obligations imposed by laws and regulations, such as tax reporting, employment laws, or regulatory requirements.

Rights of Data Subjects under GDPR

The GDPR grants several rights to individuals, known as data subjects, to ensure that they have control over their personal data and can exercise their privacy rights. These rights include:

Right to be Informed

Data subjects have the right to be informed about the collection and use of their personal data. Organizations must provide transparent information about their identity, the purpose and legal basis of the processing, the recipients of the data, the retention period, and the rights of the data subjects.

Right to Access

Data subjects have the right to access their personal data held by organizations. They can request confirmation of whether their data is being processed, and if so, obtain a copy of the data and information about the processing activities.

Right to Rectification

Data subjects have the right to request the rectification of inaccurate or incomplete personal data. Organizations must make the necessary corrections within one month, unless there are legitimate reasons for not doing so.

Right to Erasure

Data subjects have the right to request the erasure of their personal data, also known as the right to be forgotten. This right applies in certain circumstances, such as when the data is no longer necessary for the purposes it was collected, when the data subject withdraws consent, or when the processing is unlawful.

Right to Restrict Processing

Data subjects have the right to request the restriction of processing of their personal data in certain situations. This right applies, for example, when the accuracy of the data is contested, when the processing is unlawful, or when the organization no longer needs the data but the data subject requires it for legal claims.

Right to Data Portability

Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format, and have the right to transmit the data to another organization. This right applies when the processing is based on consent or contract, and is carried out by automated means.

Right to Object

Data subjects have the right to object to the processing of their personal data, including for direct marketing purposes and processing based on legitimate interests. Organizations must cease processing the data, unless they can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject.

Rights in Relation to Automated Decision Making and Profiling

Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, if these decisions produce legal or significant effects on them. Organizations must provide meaningful information about the logic involved and the possible consequences of the processing.

Responsibilities of Data Controllers and Processors

The GDPR distinguishes between data controllers and data processors, and imposes specific responsibilities on each party.

Difference between Data Controller and Data Processor

A data controller determines the purposes and means of the processing of personal data, while a data processor processes personal data on behalf of the data controller. The controller has primary responsibility for the lawful and fair collection and processing of personal data, and must ensure that the processor complies with the GDPR requirements.

Obligations of Data Controllers

Data controllers have several obligations under the GDPR, including:

Demonstrating compliance with the GDPR principles and ensuring that personal data is processed lawfully and transparently.
Implementing appropriate technical and organizational measures to ensure the security of personal data.
Conducting data protection impact assessments for processing activities that are likely to result in high risks to individuals’ rights and freedoms.
Appointing a data protection officer (DPO), if necessary, and ensuring their independence and expertise in data protection matters.

Obligations of Data Processors

Data processors have specific responsibilities when processing personal data on behalf of a data controller, including:

Processing personal data only on the documented instructions of the data controller, unless required by law to process the data.
Implementing appropriate technical and organizational measures to ensure the security of personal data.
Assisting the data controller in fulfilling its obligations, such as responding to data subject requests and ensuring compliance with data protection requirements.
Informing the data controller immediately if they believe that the controller’s instructions violate the GDPR or other data protection laws.

Data Protection Impact Assessments

Data controllers are required to conduct data protection impact assessments (DPIAs) for processing activities that are likely to result in high risks to individuals’ rights and freedoms. A DPIA is a systematic evaluation of the potential impact of the processing on the privacy and data protection rights of individuals. It helps organizations identify and mitigate risks, and ensures that privacy considerations are embedded into their data processing operations.

Data Collection Principles under GDPR

The GDPR sets out a set of principles that organizations must follow when collecting and processing personal data.

Lawfulness, Fairness, and Transparency

Organizations must have a lawful basis for collecting and processing personal data, and must communicate the purposes and processing activities to the data subjects in a clear and transparent manner. They must also provide information about the lawful basis for the processing, the recipients of the data, and the rights of the data subjects.

Purpose Limitation

Personal data should only be collected and processed for specified, explicit, and legitimate purposes. Organizations should clearly define the purposes for which they collect personal data and should not use the data for any other purpose that is incompatible with these purposes.

Data Minimization

Organizations should only collect and process personal data that is necessary for the intended purpose. They should limit the data collected to what is proportionate to achieve that purpose and should not collect excessive or irrelevant data.

Accuracy

Personal data should be accurate and kept up to date. Organizations must take reasonable steps to ensure that inaccurate or incomplete data is erased or rectified without delay. They should also establish processes to regularly review and update the data to ensure its accuracy.

Storage Limitation

Personal data should not be kept for longer than necessary for the purposes it was collected. Organizations should establish retention periods and criteria for erasing or anonymizing data. Once the retention period is over or the purpose of the processing is fulfilled, the data should be securely and permanently deleted.

Integrity and Confidentiality

Personal data should be processed in a manner that ensures its security and protection against unauthorized access, loss, destruction, or damage. Organizations must implement appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, alteration, and unauthorized disclosure.

Accountability

Organizations are responsible for complying with the GDPR and must be able to demonstrate their compliance with data protection principles. They should implement appropriate policies, procedures, and measures to ensure compliance, such as appointing a data protection officer, conducting regular audits, and maintaining records of processing activities.

Lawful Consent for Data Collection

Consent is one of the lawful bases for processing personal data under the GDPR. It plays a crucial role in ensuring that individuals have control over their personal data and gives organizations the legal basis to collect and process the data.

Definition of Consent

Consent, as defined by the GDPR, is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of their personal data.

Conditions for Valid Consent

For consent to be considered valid under the GDPR, it must meet certain conditions:

Freely given: Consent must be given voluntarily without any coercion, undue influence, or negative consequences for the data subject if they refuse to give consent. Organizations must ensure that individuals have a genuine choice and can withhold or withdraw consent without adverse effects.
Specific: Consent must be specific to the processing activity and the purpose for which the data is collected. Organizations must clearly explain the scope of the processing and obtain separate consent for each distinct purpose.
Informed: Consent must be based on clear information provided to the data subject about the processing activities, such as the purposes, the types of personal data collected, the recipients of the data, and the data subject’s rights. Organizations must ensure that data subjects understand the implications of giving their consent.
Unambiguous: Consent must be given by a clear affirmative action, such as a written statement, an electronic form, or a tick box. Silence, inactivity, or pre-ticked boxes are not considered a valid form of consent.

Withdrawal of Consent

Data subjects have the right to withdraw their consent at any time. Organizations must inform data subjects about their right to withdraw consent and provide an easy and accessible way for them to do so. Once consent is withdrawn, organizations must stop processing the personal data, unless there is another lawful basis for the processing.

Data Protection Officer

A data protection officer (DPO) is a designated person within an organization who is responsible for overseeing data protection and ensuring compliance with the GDPR. The appointment of a DPO is mandatory for certain organizations, such as public authorities, organizations that carry out large-scale systematic monitoring of individuals, or organizations that process sensitive data on a large scale.

Appointment of DPO

Organizations that are required to appoint a DPO must do so based on their professional qualities, expertise in data protection laws, and ability to fulfill the tasks assigned to them. The DPO can be a staff member of the organization or can be outsourced from a specialized service provider.

Responsibilities of DPO

The DPO plays a crucial role in ensuring compliance with the GDPR within the organization. Some of the key responsibilities of a DPO include:

Advising the organization on its obligations under the GDPR and other data protection laws.
Monitoring organizational compliance with the GDPR and conducting internal audits to assess data protection practices.
Acting as a contact point for data subjects and supervisory authorities on data protection matters.
Providing guidance and training to employees involved in data processing activities.
Cooperating with the supervisory authority and facilitating their efforts in carrying out their tasks.

DPO’s Relationship with Supervisory Authority

The DPO acts as a point of contact for the organization with the supervisory authority, which is the data protection authority responsible for overseeing compliance with the GDPR. The DPO provides advice and assistance to the organization in relation to data protection issues, responds to supervisory authority inquiries, and cooperates with them in fulfilling their regulatory obligations.

International Data Transfers

The GDPR imposes restrictions on the transfer of personal data from the EU to countries outside the European Economic Area (EEA) that are not considered to provide an adequate level of data protection. Organizations can transfer personal data to such countries only if appropriate safeguards are in place to ensure the protection of the personal data.

Transfer Mechanisms under GDPR

The GDPR provides several mechanisms for organizations to transfer personal data outside the EEA in a lawful manner. These mechanisms include:

Adequacy decisions: The European Commission can determine that a third country, territory, or a specific sector within a country has an adequate level of data protection, making transfers to that country lawful.
Standard contractual clauses: Organizations can use standard contractual clauses (also known as model clauses) approved by the European Commission to establish appropriate safeguards for the transfer of personal data.
Binding corporate rules: Multinational organizations can adopt binding corporate rules (BCRs) to ensure that personal data is protected when transferred between different entities within the organization.
Certification mechanisms: Organizations can adhere to approved codes of conduct or certification mechanisms that provide safeguards for the protection of personal data.

Standard Contractual Clauses

Standard contractual clauses are pre-approved contracts that include contractual obligations between the data exporter and the data importer to provide appropriate safeguards for the transfer of personal data. Organizations can use the standard contractual clauses provided by the European Commission or use their own clauses, subject to the approval of the supervisory authority.

Binding Corporate Rules

Binding corporate rules are internal rules adopted by multinational organizations that regulate the transfer of personal data between different entities within the organization. BCRs must be approved by the relevant supervisory authorities and provide sufficient safeguards for the protection of personal data.

Certification Mechanisms

Certification mechanisms, such as approved codes of conduct and certification schemes, can provide organizations with a way to demonstrate their compliance with the GDPR requirements for international data transfers. By adhering to an approved code of conduct or obtaining a certification, organizations can ensure that appropriate safeguards are in place for the transfer of personal data.

FAQs

What is the purpose of the GDPR?

The purpose of the GDPR is to protect the privacy rights of individuals and establish consistent data protection laws across the EU member states. It aims to give individuals control over their personal data and create trust between data subjects and the organizations that collect and process their data.

Who does the GDPR apply to?

The GDPR applies to any organization that collects and processes the personal data of individuals within the EU, regardless of whether the organization is located within the EU or not. It applies to both automated and manual processing of personal data, and to data controllers and data processors operating within the EU.

What are the lawful bases for data collection?

The lawful bases for data collection under the GDPR include consent, contractual obligations, legal obligations, and legitimate interests. Organizations must have a lawful basis for collecting and processing personal data and must ensure that they meet the conditions for valid consent or other lawful bases.

What are the rights of data subjects under the GDPR?

Data subjects have several rights under the GDPR, including the right to be informed, the right to access their personal data, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights in relation to automated decision making and profiling.

What are the penalties for non-compliance with GDPR?

Non-compliance with the GDPR can result in severe penalties, including fines of up to €20 million or 4% of the global annual turnover of an organization, whichever is higher. Supervisory authorities also have the power to impose other corrective measures, such as issuing warnings, ordering data erasure, or imposing temporary or permanent bans on data processing activities.

Get it here