<img src="https://certify.alexametrics.com/atrk.gif?account=b2hlr1ah9W20em" style="display:none" height="1" width="1" alt="">
    Login
    Get started

    sensitive personal data

    Data regulators in France, Spain and the Netherlands appear to be flexing their muscles in readiness for GDPR:

    • In Spain, Facebook has been fined by the data privacy regulator for its "generic and unclear" privacy policy which it claims did not "adequately collect the consent of either its users or nonusers, which constitutes a serious infringement". The company collected special category data (sensitive personal data) on gender, religious beliefs, etc without obtaining express consent and tracked users on third-party sites. AdobeStock_71509750_8x4.jpg
    • In France, the social media firm was also fined €150k by CNIL, the data protection regulator, for collecting user data without their consent or without a legal basis.
    • The Dutch data regulator also found evidence that Facebook had used sensitive personal data on sexual preferences to target adverts but chose not to impose any financial penalty.

    Use this checklist to stay compliant when using special category data (sensitive personal data):

    1. Make sure you're clear about what is classed as sensitive personal data (special category data) - Broadly, as previously under the Data Protection Act, it includes any data relating to race or ethnic origin, religious or political beliefs (including trade union membership), data on health, sex life or sexual orientation. However, under GDPR, it also includes genetic and biometric data (see Article 9).
    2. Gather information - Find out what special category personal data is currently collected and special categories of personal dataprocessed by your firm. Is it legitimate and lawful?
    3. Be clear about the legal basis for processing - For example, whether you have explicit consent, whether it is required for the performance of specific contracts, or for other specific purposes (such as the public interest or the vital interests of an individual).
    4. Conduct a Data Protection or Privacy Impact Assessment - We all have a duty to do so where there is a high risk to the rights or freedoms of data subjects. Remember, individual consent may not be enough and you may also need processing to be sanctioned by the data protection authority where risks are high.
    5. Take extra care with health data - The definition is broad under GDPR and includes past, present or future physical or mental health, information from testing or examination of a body part or bodily substance, genetic and biological samples, information on diseases or risk, disability, medical history, clinical treatment, and so on. Be aware that different Member States may also have separate regimes.
    6. Check the rules on criminal convictions and offences - These are dealt with separately under GDPR (see Article 10) and this type of data is now subject to greater restrictions.

    Leave a comment

    Tick

    eBook: Essential Uncovered

    Skillcast Essentials is our best-selling library and there's a reason for that. Essentials library provides comprehensive coverage of the key compliance / conduct issues that companies in the UK face today.

    Request now

    9 ways to reduce the risk of bribery and corruption

    Corruption affects all countries, rich and poor. It causes instability, inequality, and poverty, eroding national wealth. Despite the UK Bribery Act coming into force in 2011 as one of the toughest ...

    Read More
    Highlights from the GDPR 2019 Summit

    Almost a year on from the implementation of the GDPR, Skillcast held a breakfast forum for its clients at South Place Hotel. During this session, Skillcast gave a breakdown of the new GDPR Library of ...

    Read More
    Compliance Essentials News - May 2019

    Here's a selection of the most informative compliance news stories this month - regulatory announcements, market studies, and stories about compliance lapses and downright disregard of ...

    Read More
    FCA Compliance News - May 2019

    Here's a selection of news stories from the last month that touch upon the people dimension of regulatory compliance. Select the links or scroll down for more details. 3 firms and 5 individuals are ...

    Read More