GDPR What (Identity Stuff) is it GOOD for?

GDPR – What [IDENTITY stuff] is GOOD for?

Tuesday 1F

Convener: Dazza G.

Notes-taker(s): Tiemae H. Roquerre

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

GDPR Session Report Out:

Tip – Skip the first 38 pages 

Website: gdpr-info.eu

Interesting App to Use - EDPS

Key Roles: Data Subject, Data Controller, Data Processor, DPO, DPA

Who does this apply to – Any person or any organization

Privacy vs. Data Protection

Key Takeaways:

• Article 7 - Will be as easy to give / revoke consent
• There are many layers to what consent is –must prove that the consent was intentional [clarify]
• Plain language requirement to make all relevant info to data subject easily understandable (Article 12)
• When Data Controller (party who determines the purpose and mean of processing) outsources the role of Data Processor then the accountability changes
• Article 13 – put a lot of the values of the HUE report into practice – pretty much whatever is done to personal data has to be communicated to the data subject by the data controller
• Article 13 (cont.) – Data controller must facilitate how the data subject has the right to request a copy of their data, correct their data, delete their data, and restrict the processing of your data
• TBD – trust services
• Paypal has published paper on what our data is used for and someone has made a map of this
• Article 14 – Data subjects must be notified when data provided by third-parties is used
• Article 15 – one of the most important mechanisms for a fair ecology for use of personal data
  • You can ask a company if they have your data and ask for the company to provide it
  • Huge Issue: A gaping hole is that the company needs to make sure that an individual proves that the data subject is who they say they are – there are easy endpoints now for identity thieves to access personal info from GDPR compliant companies
• Lots of opportunity to facilitate notification requirements for GDPR
• Article 20 – Right to data portability – data subject has the right to move data around to other providers
• Sensitive personal data – very careful management about how this type of data is displayed
  • There are layers of rules around different data categories
• Article 21 – Shifts burden of proof to prove necessity of algorithms onto the controller and changes income model of the commercial internet (point 2)
• Article 22 – Profiling happens only if the data subject consents to it and is made clear to the data subject
• Opinion – GDPRs purpose is to be a proponent of the data subject’s rights and perspective
• GDPR provides the opportunity for companies to shift their business models to accommodate these new values
• Cloud Act??

Further Discussion Topics:

• What are the economic consequences for GDPR
• Who will be affected?
• Engineering parts of the GDPR

Add to John Fontana’s notes – jfontana@yubico.com