an Australian business that tracks individuals in the EU on the internet and uses data processing techniques to profile individuals to analyse and predict personal preferences, behaviours and attitudes. What information does the GDPR apply to? The GDPR applies to data’. This means information relating to an identified or identifiable ‘personal ‘any natural person’ (Article 4). Additional protections apply to the processing of categories’ of personal data, which includes personal ‘special data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (Article 9). Example: The GDPR makes clear that a wide range of identifiers can be data’ including a name, an ‘personal identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. What are some of the new requirements in the GDPR? Accountability and governance The GDPR sets out expanded accountability and governance requirements. These include that data controllers must: demonstrate that they comply with the relating to the processing of personal data’ this is ‘Principles – referred to as the principle’ (Article 5). ‘accountability ensure and demonstrate through the implementation of appropriate technical and organisational measures, including data protection policies, that processing activities comply with the GDPR (Article 24). implement technical and organisational measures to show that they have considered and integrated data protection into their processing activities this is referred to as protection by design and by default’ – ‘data (Article 25).
an Australian business that tracks individuals in the EU on the internet and uses data processing techniques to profile individuals to analyse and predict personal preferences, behaviours and attitudes. What information does the GDPR apply to? The GDPR applies to ‘personal data’. This means ‘any information relating to an identified or identifiable natural person’ (Article 4). Additional protections apply to the processing of ‘special categories’ of personal data, which includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (Article 9). Example: The GDPR makes clear that a wide range of identifiers can be ‘personal data’ including a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. What are some of the new requirements in the GDPR? Accountability and governance The GDPR sets out expanded accountability and governance requirements. These include that data controllers must: demonstrate that they comply with the ‘Principles relating to the processing of personal data’ – this is referred to as the ‘accountability principle’ (Article 5). ensure and demonstrate through the implementation of appropriate technical and organisational measures, including data protection policies, that processing activities comply with the GDPR (Article 24). implement technical and organisational measures to show that they have considered and integrated data protection into their processing activities – this is referred to as ‘data protection by design and by default’ (Article 25).
consultation-draft-australian-businesses-and-the-eu-general-data-protection-regulation.docx