EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
assessments where processing is likely to result in high risk (Article 35), appoint a data protection officer where required (Articles 37–39) and ensure appropri - ate technical and organisational security measures proportionate to risk (Article 32). Processors may process data only on documented instructions from the controller (Article 28), must implement appropriate security measures (Article 32) and assist controllers in fulfilling data subject rights and compliance duties. Organisations acting as controllers or processors must operationalise the accountability principle (Articles 5 (2) and 24, GDPR) through documentation, internal governance structures and demonstrable risk man - agement practices. Chapter 3 (Articles 12–23) also grants data subjects a broad catalogue of enforceable rights. These include the right to transparent information at the time of col - lection (GDPR, Articles 12–13); the right of access (Article 15); rectification (Article 16); erasure (“right to be forgotten”) (Article 17); restriction of processing (Article 18); data portability (Article 20); and objection, including an absolute right to object to direct market - ing (Article 21). Individuals also have rights relating to automated decision-making and profiling (Article 22). Requests must generally be answered within one month (Article 12 (3)), and data subjects may lodge complaints with a supervisory authority (Article 77) and seek judicial remedies (Articles 78–79). The CJEU has played a central role in interpreting these rights (for example, Google Spain , C-131/12; Schrems II , C-311/18). Key “to dos” include: • maintaining a record of processing activities (Arti - cle 30); • conducting data protection impact assessments where processing is likely to result in high risk (Article 35), and consulting supervisory authorities where residual high risk remains (Article 36); • implementing appropriate technical and organisa - tional security measures (Article 32);
• establishing procedures for detecting and manag - ing personal data breaches, including notification within 72 hours where required (Articles 33–34); • appointing a data protection officer where manda - tory (Article 37); and • ensuring lawful transfer mechanisms for interna - tional data flows (Chapter V GDPR). These obligations operate cumulatively with relevant sectoral instruments such as the e-Privacy Directive (Directive 2002/58/EC) and, where applicable, Direc - tive (EU) 2016/680. 1.3 Special Categories of Personal Data As a principle, Article 9 (1), GDPR prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union mem - bership, genetic data, biometric data used for unique identification, health data, and data concerning sex life or sexual orientation. By exception, such processing is permitted only where one of the exhaustively listed grounds in Article 9 (2) applies, namely: • explicit consent (Article 9 (2)(a)); • employment, social security and social protection obligations under EU or Member State law (Article 9 (2)(b)); • vital interests (Article 9 (2)(c)); • legitimate activities of certain non-profit bodies (Article 9 (2)(d)); • data manifestly made public by the data subject (Article 9 (2)(e)); • legal claims (Article 9 (2)(f)); • substantial public interest (Article 9 (2)(g)); • preventive or occupational medicine and health care management (Article 9 (2)(h)–(3)); • public health (Article 9 (2)(i)); and • archiving, scientific or historical research and sta - tistical purposes subject to safeguards (Article 9 (2) (j) and Article 89 (1)). Automated decision-making based on special catego - ries of data is further restricted by Article 22 (4) of the GDPR. Member states may introduce additional con - ditions for genetic, biometric and health data (Article 9 (4), GDPR).
89 CHAMBERS.COM
Powered by FlippingBook