GDPR - Relating to Processing of Personal Data - Public Privacy Notice

Recital - 39.
Principles of Data Processing
Executive Summary
Data should be collected in an open and obvious way, the individual that is the subject of the collection should be told what is being collected, why and how long it will be kept. The consent of the individual must be obtained, and the collected data cannot be used for any additional purpose. Individuals must be given the information needed to withdraw their consent at a later date.
Quick Wins
Create a form (Paper or electronic) to capture the consent and intent. Use these forms as an inventory report for your data. Include on the form a general clause for "consent to contact for business purposes related to this data collection and form".
Recital Text
Any processing of personal data should be lawful and fair.It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed.The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used.That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed.Natural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing.In particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data.The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum.Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means.In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted.Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.
, 40
Recital - 40.
Lawfulness of Data Processing
Executive Summary
Your organization can share data if it is part of fulfilling a contract to which the individual data subject is party.
Quick Wins
Include a "sharing to fulfil" clause in your contracts and addendums.
Recital Text
In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
, 58
Recital - 58.
The Principle of Transparency
Executive Summary
Explain to your data subject: What you collect, how you collect it, why you collect it, how it is used, and how long you keep it. It is also advisable to give them your DPO contact information if they have questions or want to review their data.
Recital Text
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used.Such information could be provided in electronic form, for example, when addressed to the public, through a website.This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising.Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand.
, 60
Recital - 60.
Information Obligation
Executive Summary
Explain to your data subject: What you collect, how you collect it, why you collect it, how it is used, and how long you keep it. It is also advisable to give them your DPO contact information if they have questions or want to review their data.
Recital Text
The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes.The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed.Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling.Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data.That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing.Where the icons are presented electronically, they should be machine-readable.
, 73
Recital - 73.
Restrictions of Rights and Principles
Executive Summary
Explain to your data subject: What you collect, how you collect it, why you collect it, how it is used, and how long you keep it. It is also advisable to give them your DPO contact information if they have questions or want to review their data.
Recital Text
Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes.Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.
Executive Summary
A public privacy practice notice should be communicated with data subjects regarding the purpose for collecting personal information, type of information collected, method of collection, retention period for the data, their access and rights to the data, if the data is shared with any 3rd parties, implementation of security methods to safeguard their data, as well as monitoring and communication of unauthorized disclosures. Additionally contact information should be provided for any requests from data subjects.