the recipient, or categories of recipients, of the data the fact that the organisation intends to transfer data to a third country or international organisation, if applicable the period for which the data will be stored, or the criteria used to determine that period the individual’s rights in respect of the data, including the right to withdraw consent where applicable the individual’s right to lodge a complaint with a supervisory authority whether the provision of data is a statutory or contractual requirement, or necessary to enter into a contract, as well as whether the individual is obliged to provide the data and of the possible consequences of failure to provide it the existence of any automated decision-making, including profiling, and meaningful information about the logic involved and the envisaged consequences of such processing The information must be provided to the individual in writing, or by other means (including electronically) at the time when the data is obtained. It must be in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed to a child. Where the organisation is obtaining personal data from a third party, the information it needs to provide to the individual is very similar, and it must be provided within a reasonable period after obtaining the data, but at the latest, within one month. If the data is to be used to communicate with the individual, the information must be provided by the time of the first communication. If data is to be disclosed to another recipient, the information must be provided at the latest when the data is first disclosed. Data Protection Impact Assessments (DPIAs) When an organisation is preparing to process information in a new way, in particular using a new technology, and where this is likely to result in a high risk to the rights and freedoms of individuals, it must carry out an assessment of the impact of the envisaged processing on the protection of the data (DPIA). This is required in particular in the case of any systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing, including profiling processing on a large scale of ‘Special Category’ data (see above) , or of data relating to criminal convictions systematic monitoring of a publicly accessible area on a large scale (CCTV) The DPIA should contain a description of the processing and its purpose, an assessment of the necessity and proportionality of the processing, an assessment of the risks to individuals in relation to their data, and details of the measures in place to address the risk. Contracts with data processors
the recipient, or categories of recipients, of the data the fact that the organisation intends to transfer data to a third country or international organisation, if applicable the period for which the data will be stored, or the criteria used to determine that period the individual’s rights in respect of the data, including the right to withdraw consent where applicable the individual’s right to lodge a complaint with a supervisory authority whether the provision of data is a statutory or contractual requirement, or necessary to enter into a contract, as well as whether the individual is obliged to provide the data and of the possible consequences of failure to provide it the existence of any automated decision-making, including profiling, and meaningful information about the logic involved and the envisaged consequences of such processing The information must be provided to the individual in writing, or by other means (including electronically) at the time when the data is obtained. It must be in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed to a child. Where the organisation is obtaining personal data from a third party, the information it needs to provide to the individual is very similar, and it must be provided within a reasonable period after obtaining the data, but at the latest, within one month. If the data is to be used to communicate with the individual, the information must be provided by the time of the first communication. If data is to be disclosed to another recipient, the information must be provided at the latest when the data is first disclosed. Data Protection Impact Assessments (DPIAs) When an organisation is preparing to process information in a new way, in particular using a new technology, and where this is likely to result in a high risk to the rights and freedoms of individuals, it must carry out an assessment of the impact of the envisaged processing on the protection of the data (DPIA). This is required in particular in the case of any systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing, including profiling processing on a large scale of ‘Special Category’ data (see above) , or of data relating to criminal convictions systematic monitoring of a publicly accessible area on a large scale (CCTV) The DPIA should contain a description of the processing and its purpose, an assessment of the necessity and proportionality of the processing, an assessment of the risks to individuals in relation to their data, and details of the measures in place to address the risk. Contracts with data processors