{"id":23018,"date":"2018-05-22T11:29:22","date_gmt":"2018-05-22T10:29:22","guid":{"rendered":"https:\/\/digileaders.com\/?p=23018"},"modified":"2019-05-08T14:22:26","modified_gmt":"2019-05-08T13:22:26","slug":"gdpr-what-means-public-sector","status":"publish","type":"post","link":"https:\/\/digileaders.com\/gdpr-what-means-public-sector\/","title":{"rendered":"GDPR and what it means to the Public Sector"},"content":{"rendered":"

On the 25th May the General Data Protection Regulation, GDPR, will enter law. At that point we will see the biggest, and arguably most important, change to the way in which personal information is handled.<\/p>\n

We will see more power given to the individual (the data subject in GDPR parlance) to control who has their information, what those third parties can use it for, remove consent for third parties to use their data and most importantly tell them (not ask!) to delete the data they hold – the \u2018right to be forgotten\u2019.<\/p>\n

Failure to comply with these new rules may result in companies inappropriately holding or processing personally identifiable information to be fined.<\/p>\n

In the UK the ICO (Information Commissioner’s Office) has long had the power to fine business that don\u2019t comply with the Data Protection Act (DPA) – up to a maximum of \u00a3500,000 (see recent ICO notice<\/a>\u00a0where they fined TalkTalk \u00a3400,000).<\/p>\n

Under GDPR this maximum increases significantly – up to \u20ac20M or 4% global turnover. Think about that for a second. That\u2019s enough to wipe out companies.<\/p>\n

What\u2019s important to remember is that GDPR isn\u2019t about fines. It\u2019s about empowering the individual to have control over their data. For too long we\u2019ve all suffered with nuisance cold calls about PPI, car crashes we haven\u2019t been in, been on the receiving end of spurious mobile offers to name a few.<\/p>\n

How did these people get your information? Through organisations who bought and sold personal data, phone lists, mailing lists etc. all procured because you may have ticked a box on a website allowing them to share your data with third parties. Yes, that\u2019s right, you consented to this.<\/p>\n

Consent<\/h4>\n

Consent is one of the significant changes when comparing GDPR to the DPA.<\/p>\n

Specifically consent is something that must be given, not assumed – so no preticking opt-in boxes etc. – and must state clearly what the data subject is agreeing to. Specific details of what will be done with the personal information collected must be presented, the ambiguous statements like \u2018we may share your details with 3rd parties or other affiliates\u2019 are no longer allowed. You must be clear and accurate.<\/p>\n

However for many of our customers, that are local government organisations, the need for consent and whether it is the right mechanism is something that has to be considered – especially when legislative and other requirements demand that personal information e.g. name, address, contact details have to be supplied and there is no option to say no. It is impossible, after all, to approve a planning application for something like an extension to a home without knowing the details of the individual (notwithstanding the obvious legal requirements etc. that trump GDPR).<\/p>\n

Looking at what the ICO have to say about consent there are a few key points that are relevant to public authorities:<\/p>\n