Dillistone Group Plc · LSE:DSG
Dillistone — TRANSEARCH GDPR Webinar (April 2018)
26 slides from Dillistone's conference presentation, Apr 26, 2018
Slide 1: GDPR and Executive Search
GDPR and Executive Search GDPR - It’s Imminent fd GATEDTALENT Sg FileFinder
Slide 2: Webinar provided for information, not legal advice
▪ This webinar is provided for information purposes and is NOT intended to be legal advice pertaining to the subject matter ▪ If you have specific questions on how this may affect your organisation you should consult a legal professional ▪ Guidance and member state regulator interpretation is ongoin
Slide 3: Days left until GDPR
Days left until GDPR: ©, c>’ ©, > * c> . > ro ON: ©
Slide 4: Agenda
▪ The basics and some definitions ▪ Liability and Fines ▪ Legal processing of data ▪ Legitimate Interest and Consent ▪ A data inventory ▪ Next Steps
Slide 5: GDPR basics and scope
▪ Adopted May 2016 ▪ Comes into force May 25th 2018 ▪ Applies to: • Any organisation which has an office or processes data in EU • Any organisation offering goods and services to EU Residents • Applies to all data subjects that reside in the EU, irrespective of nationality • It is therefore not limi
Slide 6: Key changes under GDPR
▪ Increased rights for data subjects ▪ Tightening up of data breach reporting ▪ You need to have and be able to justify a legal basis for processing personal data ▪ Ensure the security of personal data ▪ Increased emphasis on record keeping ▪ Need a defined data retention policy – you cannot keep da
Slide 7: Definitions: processing, controllers, processors
▪ Processing: Operation or set of operations performed on personal data ▪ Data Controllers: Person, body or agency that determines the purposes and means of the processing of personal data ▪ Data Processors: Person, body or agency which processes personal data on behalf of the controller.
Slide 8: Definitions: data subjects and personal information
▪ Data Subjects: Natural persons who can be directly or indirectly identified by the controller or a third party using reasonably likely means ▪ Personally Identifiable Information: Means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natur
Slide 9: Do you hold candidate data?
▪ Do you hold candidate data? • You are a Data Controller ▪ If Dillistone hosts your database we are a data processor ▪ If you host your data then you are also the data processor
Slide 10: What counts as personal data
▪ All personal data of data subjects that fall under the regulation. ▪ It is someone’s personal data irrespective of when you collected that data ▪ Therefore the fact it was collected prior to GDPR is irrelevant
Slide 11: Controller obligations
Controller obligations include: ▪ Comply with GDPR ▪ Implement appropriate technical and organisational measures ▪ Implement data protection policies ▪ Demonstrate compliance ▪ Adhere to relevant codes of conduct ▪ Only appoint processors that guarantee GDPR compliance
Slide 12: Administrative fines
▪ Supervisory authorities can impose significant administrative fines on both data controllers and data processors. ▪ Can be imposed for a wide range of contraventions, including purely procedural infringements. ▪ Some contraventions will be subject to administrative fines of up to €10 Million or 2%
Slide 13: Regulator enforcement approach
▪ The supervisory authority is responsible for “policing” the GDPR. They have a responsibility to ensure that any fine is fair, proportionate and dissuasive. ▪ A minor infringement from an organisation that can demonstrate its efforts to comply and co-operate with an investigation are unlikely to be
Slide 14: Principles of processing personal data
▪ 6 Principles of Processing personal data 1. Processed fairly and lawfully 2. Adequate, relevant and limited to what is necessary 3. Accurate, and where necessary, kept up to date 4. Collected for specified, explicit and legitimate purposes 5. Kept for no longer than is necessary 6. Processed in a
Slide 15: Lawfulness of processing
▪ Lawfulness of processing • The reality is that there are really only 6 ways in which lawful processing of personal data can be undertaken: 1. It’s necessary for the performance of a contract 2. It’s necessary to protect the vital interests of the subject 3. It’s in compliance with a legal obligati
Slide 16: Consent
▪ Consent is an affirmative opt-in. ▪ Taking this approach for all personal data will very likely shrink your database significantly. ▪ BUT It is only one of six legal basis to process personal data ▪ For candidate data Legitimate Interest is gaining favour
Slide 17: Legitimate interest
▪ Processing is necessary for the legitimate interest pursued by the controller ▪ Except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject. ▪ Opt-out no opt-in
Slide 18: Legitimate interest assessment steps
▪ Identify a Legitimate Interest • What is purpose? • Why is it important to you as a controller? ▪ Carry out a Necessity Test • Is there another way of achieving the identified interest? • Would the subject expect the controller to be processing the data? ▪ Carry out a Balancing Test • The nature o
Slide 19: Right to be informed
▪ Under the “right to be informed” you must tell the subject that you have their data and provide them with: • A privacy notice • As well as or including transparency information • And their rights to be forgotten or object within a reasonable time.
Slide 20: DPN guidance on informing individuals
“Under the GDPR individuals have the right to be informed about how their Personal Data is being processed. The Regulation clearly stipulates that this must be done in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information a
Slide 21: Source: GatedTalent Standard Template
Source: GatedTalent Standard Template
Slide 22: Data inventory
▪ Data Inventory looks at all the data you hold • Type of data • How secured • Data retention legal basis etc.
Slide 23: Data inventory example
defnivon exomple ies? | DATA INVENTORY EXAMPLE Sample Data Inventory for GDPR oe ~ — tention Who is Third party Third party | How is data | Legal basis to reriod F | How disposed | responsible involved compliant transferred process Proof Date Controller Processor Third Party Who iis Is there any Wha
Slide 24: If you haven't yet started, prioritise this
▪ If you haven’t yet started, prioritise this: • Update your privacy policy. People will see this. • Work out how you are going to contact people. You need to start this now ➢ You’ll need to decide on Consent versus Legitimate Interest • Complete the Data Inventory – It may be too late to “fix every
Slide 25: Authorities may be lenient if you show effort
▪ Many authorities have indicated that they will be lenient is the deadline is missed…. So long as you show you are trying! https://www.siliconrepublic.com/enterprise/gdpr-compliance-fines- tips
Slide 26: Time for Questions!
Time for Questions! FileFinder Ed GATEDTALENT we
Dillistone Group — TRANSEARCH GDPR Webinar (April 2018) on 6ix