hello and welcome to today's session on data protection on the GDP are in today session. We're going to be discussing the concepts of data protection on what kind of data is protected, and we're also going to be discussed in the G d. P. R and the changes that was made to the data protection regime in the UK The data protection regime in the UK was amended by the General Data Protection Regulation, which is the GDP are, and that's what we're gonna be discussing in today's session. So let's have a look at the format of today session. We're going to use an approach to discussing this called must Should Could. Would on this is an approach to business prioritization. It could be helpful when thinking about compliance in some cases. Okay, so it's helpful for us to remember the essentials. So we think about the musts. Okay, these are the things that we must do in order to comply with regulation. There's also things that sometimes that we should do so best practice in certain areas. There's things that we possibly could do so ideas, perhaps from different organizations, or which the regulator might have come up with a what you have seen in the newspaper. Those kinds of things then there might be, would you might think you would do this if your business was structured in that way over there. But maybe it's not suitable for your business or you would do if you have the resources. In some cases, you can break down those different solutions on the different requirements in compliance to those kinds of things. We're gonna have a go at that were talking about data protection. This is both in order to try and help you remember the kinds of things that absolutely keep, but also to understand the the different ways in which you can comply with the law in different circumstances and that compliance, sometimes on we're talking about ethics, is about understanding. Different ideas, subjects, those kinds of things on what's required on what's not required on also where different ideas and innovation come into place. Well, so when we're thinking about data protection, as we've already said, data protection has changed under the GBR. What happens now is that you need more affirmative action in order to gain client consent to process their personal data on clients need more information about the data that's been gathered on also what's being done with it. His very much enhanced the existing protections that were already in place under the Data Protection Act. Break goes further now on What we're seeing is people being told more information about how their data is being handled on what's being done with it. For example, in your client care letter, you need to make it clear how people's personal data is being collected was being done with it, how it's being handled and what kind of lawful basis you have for processing them. As a result of that, we expect people to become more conversant underwear of the concept of personal data so that clients would then come to you and say, for example, you know, I'm aware of the data protection regulations. You know, let's have a track about how you gonna hand of my personal data, and they might start to become more savvy about what kinds of personal data is being collected on what's being done with it. Now on. The information commissioner's office is the regulator for dealing with data protection on the penalties were not complying with the data protection requirements are stiff, so penalties of up to 20 million euros, or 4% of turnover. So there are some very stiff penalties when we're dealing with data protection. There is a link, of course, across the confidentiality of information. So usually we're working in a solicitous pearl or then you go services as a whole. You may already have experience of this. You're thinking about protecting the confidentiality of information on taking measures in order to do them. So it's really important to be aware that this link is already there and in some cases, Solicitor's office is under there. Within the legal services, settle well set up in order to safeguard information. Be aware that that is confidential. If you're thinking about becoming a self employed paralegal is very important to bear in my deregulation off the I C e o and register, if necessary on. Think about how you're going to safeguard information in this very similar ways to you. The way you would think about confidentiality. Let's move on into thinking about looking at thes the key part off the data protection regulation, which is a personal data. Okay, so which of these are personal data. Well, we've got an example on the screen there, and it's important to remember that when we're thinking about safeguarding protecting personal data, this is a must. Okay, we must do this in order to comply with the requirements under the GDP are under the amended data protection. Okay, so we've got an example there on the screen. This is Oliver James. He took panic Northumberland. And he is a member of a trade union. Now, we might be able to have a look and see if we can find a better Oliver Jane's around that area. There might be other people who are members of a trading, but we've got a picture of Oliver Jones just now. What this means is we can identify this person. It's highly likely that we're going to be able to identify this individual person. Okay. From the information we've been present, you've got a name. So that is information on which is personal data. If we combine that with the picture and we link the two things together, got a name and a picture, both of those, then personal data. But also they're making that. And we're getting closer than all of those things become personal data. Personal data is information relating to natural persons who could be identified all here, identifiable directly from the information in question. So, for example, and name or who can be identified from that information in combination with other information? Okay, so it's really important then, to protect information. Negate. Want to think about the way in which you're going to safeguard information so that we're not disclosing information? We're not disclosing people's personal data. Some people's personal. Some categories of personal data is more sensitive than for this. Okay, so people might get upset. For example, if you disclose information about their health, or if you came into contact with information about somebody's help on, then that got disclosed, I would be upset. Somebody did that to me. Okay, this also is a must. OK, It's absolutely essential that we take additional layers to make sure we're safeguarding special category personal data on if you process or use a lot of special category data within your professional life. So within the family work for or, you know that's the way that you go down there. Self employed paralegal. It's something really important to bear in mind what is a special category personal data, which is more richest? The category of data which is more sensitive than others. Data relating to, for example, people's race, ethnic origin, politics, religion, trade, union membership, genetics by metrics, health, sex, life and sexual orientation. In this case, we're looking at all of the Jones. Okay, he's a member of a trade union. It says That's we've got special category personal data straight away. Okay, we can identify that. That is their do. We need to process this information about Oliver if he's come into defend that we work for? Well, it's a question we'll, you know, we have to think about making sure that you only process the data, which is absolutely necessary. Do we need to process the fact that he's a member of a trade union now? There might be, as we've seen from other videos, legal funding associated with being a member of trading, so not quite useful. We want actually need to process that information, but in order to do so, we have to make sure that we have the appropriate measures in place in order to process that personal data on that we take extra care to protect it as well. Now there's something in the law which requires you to have a lawful basis for processing personal data. We're gonna have a look at that on the next line. Just to be aware that when we're talking about special category or sensitive personal data, you have to have additional lawful basis for processing as well. And the most likely one of those is going to be explicit consent. We have the person's explicit consent to process that there are other categories which include legal actions as well. Just a bear in mind that there also additional requirements. If you're processing personal data which relates to criminal convictions or the data off Children, you must register with the icy Oh, the information Commissioner's office. If you're handling personal data, you must also establish a lawful basis for handling personal data. There are six lawful basis for handling personal data, and that is the basic level of personal data. If you go on to a special category, more sensitive data there are additional lawful basis for processing that data as well the lawful basis for her handling and processing personal data, which are most likely to be relevant to you working in a firm or as a paralegal in practice, our consent, contractual obligation, legal obligation or legitimate interests. So if you have somebody's consent to process their personal data, that's it's also okay if you have a contractual obligation. So if you're setting up a situation where you're performing a service for somebody, it's highly likely have a contractual obligation on that includes giving some day quote. You also may be in situation where you have a legal obligation to act in certain circumstances on again. That falls into the category of saying, Yes, you can process this personal data. Legitimate interest is a bit more ridicule on. This is where you have to balance out the legitimate interests of the person with a legitimate interest off the firm in order to say whether or not it's something that you know should go ahead. OK, you have to balance those two things out, and it's quite a tricky measure to do in that situation, And the person you know you might think about whether or not you can make that call and make that justification one of the other. After years of personal data on processing lawful basis for processing so it would might be more appropriate because you might very easy to be able to obtain consent. All established that, for example, you'll have a contractual basis for processing that processing that data on that might be better suited to what you're doing. Let's have a look at the rights when we're talking about data protection. So there are different bites, and they must be a kid to people half the vibes they have. These enhance protections under the GDP are there is divide to be informed on. So this is what we're talking about somewhere saying, You know, um Ender client care letter half the discussion with apply and provide information to kind. But what you're going to do with that personal data on people, clients in particular have the right to be informed about that information and how it's being processed. What you going to do with their personal data now? A lot of plant care lettuce would already have this in on. It would be part parcel of the climb experience for them to be told this information clients also have the right of access to their personal dates they combined to you anytime on request copies of data disassociated with them, and this is called a subject. Access requests. There is also the marked rectification. If they think you're holding personal data about them, which is incorrect, they can ask you to put it Onda. Also in some second sentence, there is the right to a raise your personal data as well. In some situations, plants would also have divide to ask you to restrict the person processing of personal data on the right to object to some data being processed. There are also well, it's for individuals related to automated decision making. And what that means is that there should be a process where people can come out of automated decision making. So if you're in a telephone system, for example, writes making automated decision, or if you're going through a process that would allow a legal matter to be handled in a technological way that results in automated decision making, there are bites associated to that as well. It's intended to avoid, you know, strange outcomes for people that they can't get out of the loop. For example, that kind of computer says no type situation where you can't somehow come out of that loop. So let's think about the kinds of things that you could do in order to meet some of these obligations. Now we've already talked about that. There are rights there for people to be informed about processing personal data on one of the ways that you can give that information across appliances in the client care. Let. But you could also produce a privacy noticed on the information Commissioner's office has examples of that on their website. One of the other ideas that they have so I could within within, you know that that that formula that I've sort of set there one of the other options that you can do is a layer of privacy notice. They can give information in different ways in order to ensure that people take it in. It's a bit like providing videos two people in order to provide the opportunity for information to be communicated in a different way. You could do a video alongside client Caroline, for example, that sets out some of the information that could be provided to kind. If you are, um, this is might be one of your Woods. If you are working with people overseas and bricks and pull, some law firms outsource some of their work overseas on your sending personal data overseas, you have to have a think about restrictions in relation to that on the icy. Have some further information in relation to that, including so sample contracts going to swell when you're thinking about your privacy notice. You can do different things in order to meet their obligations to the car, and this might be contained a subset within the client Canada. You have to explain the lawful basis for processing that you've chosen. You have to explain the kinds of things that you're going to be doing with the personal data. So it might be, for example, dealing with In respect of this legal transaction, you have to also provide. You have to also think about gathering that consent or thinking about what's necessary for that lawful basis. You have to, um, have the discussion with the college, or you should be thinking about having a discussion with kind about how long your gun told the personal information for the personal data and that might be related to how long you're going to have the file for. You have to think about whether you are transferring that data to anybody else. So is there any way for her is in place, For example, on you have to think about what you're going to do. Any profiling off the client on, Do you know those are the kinds of things that come in people starting increasingly to think about using profiling within their firms in order to give a better client experience? So this might be something you could do or you wouldn't do. You would, for example, tell the blind about providing. It was something you're going to do. People have to be given the opportunity to exercise their rights in different ways. Okay, so thinking about how you're going to communicate that to the client, if they have any concerns, where can they go? And if you have a data protection officer within your organization, some of large organizations are more likely to have these in place, but some people appoint them on voluntarily as well. Can they go to them with any queries to raise any concerns on? You may also want to discuss people's works in relation to their personal data with them as well within the prophecy notice all providing the information somewhere else, for example, on the website, off via on video. So let's think about how that looks from a process kind of perspective. We start from the basis that all data is confidential, as we've discussed in the for the videos and that includes personal data. We are also in the position where firms should have policies and procedures in order to support what happens with personal data. This is a most but the how they're set out is perhaps an issue of best practice. What suitable for the size of firm, those kinds of things, thinking about establishing, moving on from that that you have the appropriate lawful basis to process the personal data on consent can be one of those. But there can also be other lawful basis for processing personal data as well. So, for example, contractual obligation. Once you've established all of that, you can provide that privacy notice to the client on. Then you get on with, um, the processing of the personal data. OK, there is, um, you can't have a, uh, data protection officer in place. If that is something that you, you know for the organization requires it. Clients have the right to exercise their right. So you may, for example, receive subject access requests. Or they can also request their Daytona portable form as well. So they can say to you, Well, actually, I would like to be able to take my data in a portable on electronic form to somebody else. So if you have it on a computer system, for example, you might be able to make that available to kind in order to for them to go to another phone if they were unhappy with the service and they wanted to transfer, no matter. You're in a situation where breaches related to data protection have to be reported to the information commissioner's office. If they meet certain criteria, so do also be a well, that's well, if you're working within a firm, you would Mike, Your first port of call might be the data protection of himself or one of the partners. Over time, you think about the destruction of the file. And again, there are requirements for keeping files related to, for example, regulator requirements on also insurance requirements, and you can see what I've done around that child there is to put some cakes. Okay, Now it's the kinds of things where people say you try and baked data protection in at every stage. There's gonna be policies and procedures that you have in place all over the firm. Okay, so they're being quite extensive. Policies and procedures not have a whole office money. Getting data protection in as part of that is a big job. That's what they say is to try to bake it in. OK, every time you review a policy of procedure, have I think about the impact in terms off data protection. And if you get into the habit of doing that can be really helpful. There's also something on the slide there, which is thinking about the impact off data protection. So coming up the consent process there, that kind of beginning part before you even getting into processing personal data, what's the impact going to be of the action old project I want to undertake? And if you're doing it large project, you should think about doing a data protection impact assessment before taking on. Are you gonna handle personal data differently or work in a different way, in which case you need to undertake a data protection impact assessment before taking her off undertaking. That should highlight whether there's any problems to you or how you going to handle the various challenges that might come up in processing data. That brings us to the end of this session on data protection. What I would like you to do is to have a think about The second is exercises on doing to throw the reading. Have a look at the information commissioner's office. They have sample policies and procedures, privacy notices on different times of information, which is really helpful all kinds of resources. They also have a YouTube channel as well, with lots of different videos on them about data protection. Can you find all of this information that's on them? What do you think? Do you think that's useful and helpful? It's helpful to sort of see the different ways in which those things can be structured on also, what the latest information about data protection is. If you're working in a firm, have a look your office manual on client care letters, what do they say about data protection? Have you got all the bases covered. Can you see the lawful basis can for processing data? Can you see when people are being asked for consent? Are you thinking about contractual obligations? What information are you providing to decline to my personal data? Half. Has all of this been updated in light of the GDP are Okay, So all of this needs to be thought about being updated in launching the cuticle on baking. The GDP are into the processes that brings us to the end of this session. Thank you very much for watching.
Webinar
Slides
4483 Users
102 Courses
165 Reviews
