This Privacy Notice aims to educate you on the categories of personal and sensitive information governed by the General Data Protection Regulation (GDPR). This regulation ensures data processing and individual rights within the European Union (EU) and European Economic Area (EEA).

Personal Data (Article 4):

Under the GDPR, personal data refers to information linked directly or indirectly to an identifiable individual, known as a “data subject.” This includes details such as names, identification numbers, location data, online identifiers, and characteristics related to physical, genetic, mental, economic, cultural, or social identity.

– Genetic Data: Includes inherited or acquired genetic traits that provide insights into physiology or health through biological sample analysis.

– Biometric Data: Derived from technical processing of physical, physiological, or behavioral traits, facilitating unique identification (e.g., facial images, fingerprints).

– Data Concerning Health: Encompasses information about an individual’s physical or mental health and healthcare provision, revealing their health status.

Special Categories of Personal Data (Article 9):

The GDPR identifies special categories of personal data, including:

– Racial or Ethnic Origin

– Political Opinions

– Religious or Philosophical Beliefs

– Trade Union Membership

– Genetic Data

– Biometric Data (for unique identification)

– Data Concerning Health

– Data Concerning Sex Life or Sexual Orientation

Key Considerations:

Personal data may include combined information, such as job titles and workplaces, which collectively identify an individual. Pseudonymized data is still considered personal data if it can feasibly be re-identified. GDPR principles aim to protect identifiable individuals, while anonymous data falls outside its scope.

Data Controllers:

Data Controllers determine the purpose and manner of data processing. If you influence the design of work or maintain lists of potential respondents, you act as a Data Controller.

Responsibilities include:

– Demonstrating GDPR compliance and maintaining detailed records

– Serving as the primary contact for data subjects

– Conducting Privacy Impact Assessments

– Auditing Data Processors’ activities

– Ensuring contracts contain essential GDPR provisions

– Integrating privacy measures by default

– Establishing a lawful basis for data processing

– Appointing a Data Protection Officer when required

Data Processors:

Data Processors handle data processing activities on behalf of Data Controllers. If you operate based solely on instructions, such as a research or fieldwork agency, you are a Data Processor.

Responsibilities include:

– Obtaining authorization for sub-processors

– Ensuring GDPR compliance in contracts with sub-processors

– Securing consent for transferring personal data outside the EU

Shared Duties:

Both Data Controllers and Data Processors must:

– Implement technical and organizational measures to safeguard data

– Include relevant data processing details in contracts

– Appoint a Data Protection Officer when necessary

– Maintain comprehensive records of processing activities

– Ensure a lawful basis for data processing

– Securely manage and store data

The ICO, or Information Commissioner’s Office, is the independent authority in the UK responsible for upholding information rights and overseeing data protection.

GDPR regulations for secondary data in data analytics are similar to those for primary data in market research. Trend Opinion suggests the following steps for managing secondary data:

– Perform system audits to identify personal data processing

– Assess risks and conduct privacy impact assessments as necessary

– Update third-party agreements to clarify responsibilities and expectations

GDPR-compliant contracts should include:

– Detailed processing information: extent, duration, purpose, data categories, and involved individuals

– Risk evaluation and Data Protection Impact Assessment (DPIA)

– Communication of compliance-related information to stakeholders

– Implementation of technical and organizational safeguards

– Transparent data retention, retrieval, and erasure protocols

– Procedures for reporting data breaches

– Provisions for inspection and auditing

– Legal responsibilities, warranties, and indemnities

– Defined roles in shared control situations

– Requirements for data processors to secure written consent from sub-processors

– Inclusion of processor clauses to ensure clarity between controllers and processors

Opting Out of Communication:

Involves choosing not to receive further communications from a company (e.g., marketing emails). It does not entail the deletion of personal data from company records.

Requesting Data Erasure:

Involves asking the company to delete all personal data held about an individual. This action aims to remove personal data entirely from the company’s databases.

As GDPR approaches, freelancers and individual members must understand its impact on personal data management. Trend Opinion provides guidance in:

– Understanding roles and assessing data processing activities

– Establishing necessary protocols and procedures

– Documenting actions; entities with fewer than 200 employees must maintain records for higher-risk processing

Steps include:

– Reviewing data processing details: roles, data sources, purposes, processing types, legal basis, and high-risk processing

– Developing a GDPR action plan, prioritizing tasks based on risk assessment

– Updating contracts, policies, and procedures, including data retention and breach response

– Refining consent language and privacy notifications

– Incorporating privacy-centric design in new initiatives