for many many of us the first step
towards learning something that is
actually going to change our lives at
least professionally because this is it
it has happened whether we were
skeptical about it or not we have a
revelation which will be officially
adopted and published in the next few
months but it is already there and we
can say you have to provide contact
details but your data protection officer
I think that would be unwelcome for some
organizations you have to state the
legal basis for your processing and at
what as Eduardo mentioned if your legal
basis is legitimate interests you have
to explain what the interests are which
you're relying on you have to explain if
you are transferring data outside the
EEA
if you are what's the legal basis for
that so are you relying on consent
standard contractual clauses or another
delegation you have to explain to the
individual how they can obtain more
information about that so they know what
safeguards are in place you have to
explain the retention periods and if you
can't do that you have to say how you
are going to determine them you have to
explain the rights that the individual
has the right have complained to a data
protection officer and finally if you
have obtained the information indirectly
you have to explain the source of the
data as well and remember that you have
to do all this clearly and concisely and
in sort of plain English there was a lot
to get through at the moment we all know
this the law is twisted the law is
national subject to all sorts of
interpretations and if there was one
thing that the Commission wanted to
achieve was one set of rules for
everybody exactly the same and if there
is one thing you learn
in the next couple of days is that this
whole process of changing the legal
framework is driven by this number one
priority having this single set of rules
this is going to pose a challenge to
everybody just the sheer volume of
information that has to be shared with
individuals and it's going to be
difficult for everyone those of us who
have been working across the ocean the
key thing to explain if there's one
concept you can explain across the ocean
and get it right and then it will save
you a lot of trouble is the fact that
personal data of course goes beyond this
idea of PII personally identifiable
information and when you look at the
reciters of the regulation the recitals
try to make it really really clear there
is no room for hesitation it's an IP
address personal data is cookie data
personally no worries it is personal
data
so to recap whenever you are engaging
with individuals whether it's providing
information responding to access
requests or responding to objections you
have to be clear prompt careful and you
have to do it for free