Data Protection and GDPR

Personal data is defined in law as any information that refers to a living, identifiable individual. That includes information like name, address or telephone number, but also PPS number, medical information, IP address or preferences. By law, organisations must protect personal data.

In May 2018 a new EU-wide regulation, known as the EU General Data Protection Regulation (GDPR), was introduced to govern how citizen’s data is used by organisations. It increases emphasis on accountability, security and transparency for organisations processing personal data and gives citizens enhanced rights over their data.

Under the GDPR, all organisations in Ireland that process the personal data of living individuals must work to protect that data, only use it for specific named purposes and account to those individuals for the organisation’s use of their data.

Under the GDPR many community and voluntary organisations, charities and social enterprises have new obligations.

Adhering to these required standards means organisations need to be aware of the personal data that they collect and make sure that they put systems in place to manage the way that they use personal data. For some organisations this is a complex task requiring specialist skills on staff, for other organisations, with less complex data management needs, they still need to be able to account for and manage their data use in a compliant manner.

Either way organisations need to ensure they are up-to-speed with the requirements of the General Data Protection Regulation and consider which elements apply to their operations. In order to support our members in this area we have published Preparing for the General Data Protection Regulation (GDPR): A Guide for Nonprofits. This guide will give you a straightforward overview of the legislation and particular issues that arise for nonprofit organisations, including:

An overview of the 7 Principles of the GDPR
Top 10 Tips for Preparing for Compliance
Explanation of the Requirements for Consent
The Role of the Data Protection Officer
The Subject Access Request
Do’s and Don’ts for Compliance

The Seven Principles

The General Data Protection Regulation is based on seven principles:

Lawful, Fair and Transparent Processing
Specified and Lawful Purpose
Minimisation of Processing
Accuracy
Storage Limitation
Security and Confidentiality
Liability and Accountability

All of your organisation’s use of personal data needs to be aligned with these principles.

Accountability

Not only do your practices need to be compliant but, under the GDPR, your organisation needs to be able to demonstrate compliance. Therefore you need to document your practices and be able to track the processing that happens to personal data in your organisation. Ultimately the organisation’s board needs to take responsibility to ensure that the organisation is meeting its obligations and has documented how it goes about this.

The authority for policing the regulations in Ireland lies with the Data Protection Commission. You can visit their website and read their guidance on GDPRandYou.ie.

Issues to Consider

Some questions that the board may wish to consider: