This Privacy Notice informs you about the different personal and sensitive data types that fall under the General Data Protection Regulation (GDPR). The GDPR is a regulation designed to protect the processing of personal data and uphold the fundamental rights and freedoms of individuals in the European Union (EU) and the European Economic Area (EEA). 

Personal Data (Article 4):

According to the GDPR, personal data refers to any information that relates to a natural person who can be identified directly or indirectly. This individual is a “data subject.” It can be distinguished by different criteria, including their name, identification number, location data, online identifier, or particular qualities related to their physical, physiological, genetic, mental, economic, cultural, or social identity.

“Genetic Data” refers to personal data about a person’s inherited or acquired genetic characteristics. This type of data provides unique insights into the physiology or health of the individual and results from analyzing biological samples taken from the person.

 “Biometric Data” refers to personal data resulting from specific technical processes that relate to a natural person’s physical, physiological, or behavioral characteristics. These characteristics enable or confirm the unique identification of the individual, such as facial images or dactyloscopy (fingerprint) data.

“Data Concerning Health” encompasses personal data connected to a person’s physical or mental health. It includes information about health status and the provision of healthcare services that reveal insights into an individual’s health condition.

Special Categories of Personal Data (Article 9):

The GDPR recognizes special categories of personal data, previously referred to as sensitive personal data. These categories include data that reveal:

• Racial or Ethnic Origin
• Political Opinions
• Religious or Philosophical Beliefs
• Trade Union Membership
• Genetic Data
• Biometric Data (for uniquely identifying an individual)
• Data Concerning Health
• Data Concerning a Natural Person’s Sex Life or Sexual Orientation

Key Considerations:

• Personal data might consist of multiple pieces of information, such as a combination of job title and workplace, which could identify an individual together.

• Pseudonymized data still falls under the scope of personal data if it can be feasibly reversed, allowing for the re-identification of individuals by possessing the necessary information.

• The GDPR’s data protection principles apply to information about identified or identifiable natural persons. Anonymous information that does not relate to or identify an individual falls outside the scope of this Regulation.

Data Controllers and Data Processors play distinct roles in processing personal data as defined by the General Data Protection Regulation (GDPR). Their responsibilities are outlined as follows:

Data Controllers:

Data Controllers have the authority to determine the purpose and methods of data processing. For instance, if you influence work design or maintain a list of potential respondents, you are considered a Data Controller.

Responsibilities of Data Controllers include:

• Demonstrating compliance with GDPR and maintaining records.
• Acting as the primary point of contact for data subjects.
• Assessing and conducting Privacy Impact Assessments as required.
• Conducting audits of Data Processors.
• Ensuring that contracts contain appropriate details.
• Incorporating privacy measures by design and by default.
• Establishing a legitimate basis for data processing.
• Appointing a Data Protection Officer if necessary.

Data Processors:

Data Processors handle data processing activities on behalf of Data Controllers. If you solely act according to the instructions of others, such as a market research or fieldwork agency, you are classified as a Data Processor.

Obligations of Data Processors include:

• Obtaining approval to appoint sub-processors.
• Enforcing GDPR obligations within sub-processor contracts.
• Seeking permission to transfer personal data outside the EU.

Shared Responsibilities:

Both Data Controllers and Data Processors are required to:

• Implement technical and organizational measures to safeguard data.
• Ensure that contracts contain requisite details regarding data processing.
• Appoint a Data Protection Officer if obligatory.
• Maintain comprehensive records of processing activities.
• Incorporate privacy considerations into the design and default settings.
• Maintain a valid legal basis for data processing.
• Safely store and manage data and associated records.

The ICO stands for the Information Commissioner’s Office. It serves as the supervisory authority and regulator for data protection in the United Kingdom. Operating as an autonomous entity, the ICO is tasked with safeguarding information rights within the UK. 

GDPR requirements for processing secondary data in data analytics align closely with primary data in market research. ARP suggests the following steps for those handling secondary data in data analytics:

• Audit systems to identify personal data processing.
• Assess risks and consider privacy impact assessments if necessary.
• Review contracts with third parties to clarify roles and expectations.

Contracts under GDPR should encompass the following:

• Specific processing details: scope, duration, nature, purpose, data types, and subjects.
• Risk assessment and DPIA inclusion.
• Compliance information provision.
• Safeguards: technical, organizational, confidentiality.
• Data retention, return, and deletion procedures.
• Data breach notification guidelines.
• Inspection, auditing provisions.
• Liabilities, assurances, indemnities for legal actions.
• Responsibilities in joint controller scenarios.

Data processors require written consent from sub-processors (e.g., freelancers), adhering to GDPR. The inclusion of processor clauses in contracts is shared between controllers and processors as per GDPR, ensuring clarity.

Following GDPR, individuals possess a novel entitlement known as the right to erasure or be forgotten. This empowers individuals to request the deletion or elimination of their personal data when no compelling reason justifies its ongoing processing.

Furthermore, individuals have the right to restrict the processing of their personal data. When processing is restricted, you can store the data but refrain from further processing. Minimal data retention is permissible to ensure compliance with the restriction in the future.

If an individual opts not to be contacted for market research, they exercise their right to restrict processing, distinct from the right to erasure. It is crucial to differentiate between these two different rights. Honoring a request not to be contacted for market research necessitates retaining some personal data for operational compliance.

In a general context, the impact of GDPR on personal data processing for individuals is comparable to its effect on organizations. Although variations might exist in record-keeping and risk assessment (relevant notes below), the overall requirements remain consistent regardless of the organization’s size.

ARP offers guidance to individual members to:

1. Understand their roles and audit their data processing activities.
2. Implement necessary processes.
3. Document their actions; organizations <250 employees must maintain records for higher risk processing, and suppliers in the chain might also have such obligations.

Begin by understanding or reviewing your current position to identify necessary GDPR adjustments.

• Review data processing details:
  • Role and responsibilities
  • Data sources and types
  • Processing type and purpose
  • High-risk data processing
  • Legal basis for processing
  • Record-keeping
  • Data sharing and cross-border transfers
  • Access, storage, and security

Formulate a GDPR action plan to become compliant, considering risk-based prioritization. 

Potential changes may involve:

• Modifying contracts/MSA templates.
• Updating policies and processes, such as data retention and breach procedures.
• Revising consent statements and privacy notices.
• Integrating privacy by design and default in new projects.

Please note that the information provided above is for informational purposes only. The responses are not intended to be taken as regulatory or legal advice and should not be construed as such.