Secure additional consent from P3 & P6 Consumers when sending personal information outside the eco-system When sending Behavioural Atom P6 information outside the eco-system, This ensures that information that remove the ConsumerID and replace has left the eco-system can be with DIPI clearly identified. Ensure that their Operators follow the P6 specification For any one purpose and at any one Avoids potential data loss for the time, have only one Data Engine consumer and ensures the complete audit map of the eco-system. On a request from a Consumer, supply P2 (or require associated Operator to do Basic tenet of EU data protection. so) all DIPI, Segment Data, Behavioural and any stored Report Data On a request from a Consumer to be Basic tenet of EU data protection. forgotten, remove or render DIPI to be non-personal On a request from a Consumer to be P2 & P3 forgotten, instruct their Data Engine to remove or render data to be On a request from an Operator or P7 Consumer, provide the identity of the Data Engine Notify Consumers (via Operators) of P7 any mergers and acquisitions or other changes that would result in a change of control over the Consumers’ data Check the credentials of an Operator Security. every time a request is made to release data for a ConsumerID Ensure that all Operators within a P7 specific embodiment are working under equivalent terms (e.g. consent, purpose, retention periods etc.). Use different passwords to interact with Security. different actors in the ecosystem (within the same service embodiment). Use a different ServiceProviderID for Security. every instance of a service embodiment in which they are an actor Receive Behavioural Atoms directly P1 NOT Send DIPI to a Data Engine P1
Secure additional consent from Consumers when sending personal information outside the eco-system P3 & P6 When sending Behavioural Atom information outside the eco-system, remove the ConsumerID and replace with DIPI P6 This ensures that information that has left the eco-system can be clearly identified. Ensure that their Operators follow the specification P6 For any one purpose and at any one time, have only one Data Engine Avoids potential data loss for the consumer and ensures the complete audit map of the eco-system. On a request from a Consumer, supply (or require associated Operator to do so) all DIPI, Segment Data, Behavioural and any stored Report Data P2 Basic tenet of EU data protection. On a request from a Consumer to be forgotten, remove or render DIPI to be non-personal Basic tenet of EU data protection. On a request from a Consumer to be forgotten, instruct their Data Engine to remove or render data to be P2 & P3 On a request from an Operator or Consumer, provide the identity of the Data Engine P7 Notify Consumers (via Operators) of any mergers and acquisitions or other changes that would result in a change of control over the Consumers’ data P7 Check the credentials of an Operator every time a request is made to release data for a ConsumerID Security. Ensure that all Operators within a specific embodiment are working under equivalent terms (e.g. consent, purpose, retention periods etc.). P7 Use different passwords to interact with different actors in the ecosystem (within the same service embodiment). Security. Use a different ServiceProviderID for every instance of a service embodiment in which they are an actor Security. NOT Receive Behavioural Atoms directly P1 Send DIPI to a Data Engine P1
RPE-v1.0-wd01.docx