Success message
Error message
GDPR – PRIVACY : What it means for You and Us
What is GDPR?
GDPR is a new Data Protection Regulation coming in to effect 25th May 2018. It is a further extension and tightening up of the Data Protection Act (1998). It ensures that any personal data held by any organisation is processed in a secure and transparent way.
GDPR will apply to all organisations which have EU “establishments”, where personal data are processed “in the context of the activities” of an establishment. This applies irrespective of whether the actual data processing takes place in the EU or not.
Non-EU organisations will be subject to the GDPR where they process personal data about EU citizens in connection with:
The “offering of goods or services” (payment is not required); or “Monitoring” their behaviour within the EU.
The impact of this for companies which market internationally is that they will have to apply GDPR rules to the processing of personal data of individuals within the EU even if the processing takes place elsewhere.
Where can I learn more detail about GDPR?
The Information Commissioner’s Office has full and complete details. https://ico.org.uk/
Our Declaration. Your Data on this Website
This website www.mh-ctag.org does not hold any individually identifiable data and we do not use cookies on this site, except in relation to general site statistics. Your contact is with the Data Controller at the ‘company’, in this case please contact info@mh-ctag.org who may hold your name, email and phone details in order that they can provide services to you as a legitimate business interest or as part of an existing contract.
Within the regulation the following definition of personal data is given.
“Any information relating to an identified or identifiable natural person ('data subject‘); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.’ (Article 4)”
In Summary; GDPR explained.
Individuals have the following rights with all companies that you interact with, and those companies must clearly and transparently adhere to the regulations, so for both parties . . .
“The right to be informed "
This ‘right to be informed’ concerns the obligation of an organisation to provide ‘fair processing information’, which will typically manifest itself in the form of a privacy notice. It strongly emphasises the need for transparency over how you use personal data, and insists that such information should be: "free of charge".
The right of access
The GDPR clarifies that the reason for allowing individuals to access their personal data “is so that they are aware of, and can verify the lawfulness of, the processing”. The guidance states that where such a request is not ‘manifestly excessive or unfounded’, information should be provided without delay, and within one month at the latest.
The right to rectification
An individual has the right to have personal information altered if it is inaccurate or out of date. Where possible, if you have disclosed the data to any third parties, you must inform them of the changes, and make sure the individual is aware of those third parties.
The right to erasure
More commonly known as ‘the right to be forgotten’, this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This may include, for instance, where the information held is no longer necessary in relation to the purpose for which it was collected originally, the individual withdraws their consent, or when the individual objects to the processing and there is no overriding legitimate interest for continuing to process the information.
The right to restrict processing
Individuals have the right to request that the processing of their information is restricted, meaning that data can be stored, but not processed further. An example could be where an individual contests the accuracy of the personal data. In this instance, you should restrict the processing until you have verified the accuracy of it.
The right to data portability
The ‘right to data portability’ allows individuals to obtain and reuse their personal data for their own purposes across different services. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without hindrance to usability. This is so that they may, for example, take advantage of applications and services which can use this data to find them a better deal, or help them understand their spending habits.
The right to object
Individuals have the right to object to;
· processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
· direct marketing (including profiling); and
· processing for purposes of scientific/historical research and statistics.
The GDPR provides that “the right to object must be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information”. It must also be notified “at the first point of communication” and in the privacy notice.
If an objection is received to the processing of data that is carried out for the legitimate interests of your organisation, or the performance of a legal task, then you must stop the processing unless you can demonstrate compelling legitimate grounds for overriding the interests of the individual, or that it is necessary regarding a legal claim.
If an objection is received in relation to direct marketing, you must cease all processing immediately upon receipt as there are no grounds to refuse or exemptions.
Rights of the individual in relation to automated decision making and profiling
The GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention. Individuals have the right not to be subject to a decision when:
· it is based on automated processing; and
· it produces a legal effect or a similarly significant effect on the individual.
You must ensure that individuals are able to:
· obtain human intervention;
· express their point of view; and
· obtain an explanation of the decision and challenge it.
“
If you have any concerns related to GDPR and this website please contact the ‘company’ for further information