Personal Data Processing Principles (Chapter 1, Section 4) — Guide to the GDPR

Article 5 GDPR lays down the fundamental personal data processing principles. This makes direct reference to Article 5 of Convention 108 of the Council of Europe on Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28 January 1981 (Journal of Laws of 2003, item 25), and to Article 6 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

The direct specification in the GDPR of the main personal data protection principles is the basis for new data protection standards, illustrates the areas in which protection of privacy is developing, and creates a framework for the remaining, detailed GDPR provisions. In addition, inclusion in the personal data protection system of a uniform catalogue of principles gives rise to new obligations for processors. These rules are fundamental to the entire regulation and lay down a framework for personal data protection.

The fact that these are overriding principles is demonstrated among other things by the fact that in many cases they cannot be modified, even with the consent of the data subject. For instance, in many situations the maximum permissible scope of data that can be collected in a particular case (principle of proportionality and minimisation) may not be extended, even on the basis of a consent of the data subject.

Article 5(1) GDPR provides for eight personal data processing principles contained in six points, and these are:

The burden of proof that the controller and the processor meet all GDPR obligations when processing data lies with the controller and processor themselves. This is due to the principle of accountability provided for in Article 5(2) GDPR.

‘Accountability’ means not only the obligation to comply with the principles described above but also to demonstrate that actions and the methods employed comply with the GDPR and achieve the desired effect. Compliance with the GDPR has to be accounted for.

Observance of the principle of accountability requires that the appropriate procedures be introduced and accurate documentation be maintained describing both the guarantees that have been put in place to ensure that data processing is lawful and the method by which they are put in place.

In practice, the only known method of accounting for anything is documentation. Therefore it will be difficult to account for compliance with the GDPR without the appropriate documentation, in particular internal by-laws, even if a specific obligation to have these rules is not expressly provided for in the GDPR. By the same token, the principle of accountability requires active measures and initiative on the part of the controller and the processor.

Individual data processing principles are related and interdependent in various ways, and these include conflict, and for this reason none of them can be analysed without reference to the others.

Essentially, the principles of lawfulness, fairness, and transparency are three principles in one.

Lawfulness means that personal data have to be processed in compliance with the law and the GDPR above all.

The obligation of lawfulness of data processing means above all that there have to be grounds for the processing (legal basis for processing). These grounds, depending on the data category, are defined in Articles 6 and 9 GDPR. For data on criminal convictions and offences, the grounds are practically laid down in Article 10 though formally Article 10 GDPR just adds extra requirements to Article 6 GDPR.

Also, lawfulness means compliance with the other provisions in the GDPR (such as conditions for consent – Article 7 GDPR) and acts currently in force, and the acts passed to implement them.

For example, if no preparations have been made to execute an individual’s rights and as a result there is no technical capacity or resources to execute requests from individuals in a timely and effective way, this is a breach of the principle of lawfulness. A similar situation exists if the kind of security measures (data protection) to be employed is not determined, or they are not employed.

The principle of fairness means that personal data must be used in an honest and fair way and requires loyalty in relationships with data subjects.

For example, it would not be fair and honest to call on the phone people we do not know and state that no personal data processing takes place because we do not know the person called and it was not known whether the number dialled would be answered.

The simplest way in which the principle of fairness can be explained is in colloquial, everyday language. The processor is not permitted to ‘con’ the data subject.

Processing must be transparent for data subjects, and communication must be legible and comprehensible.

Transparency of processing means, for example, that if a controller asks a data subject to provide the serial number and number of their personal identification card or their official individual identification number, the data subject is entitled to request that the grounds for that request be specified clearly, and the party requesting the data has to comply with the request.

Legibility means that communication with the data subject (e.g., a consent clause, information clause) should be in plain and legible language, i.e. comprehensible to the individual whose data is processed. Complicated, vague, and overly complex forms can prove to be defective, and consent given on that basis will not be considered effective.

Communication must be simple and legible, and not contain legalese. If a typical recipient of particular information in connection with GDPR obligations does not understand the message conveyed, this means that the legibility test has been failed. Of course, there is a clear conflict between the principle of legibility and the amount of notification obligations. This leaves a great deal of discretion for an administrative supervisory authority. The EDPB responds recommending a so-called layered approach to the information obligation.

Next principle for lawfulness of data processing is the principle of purpose limitation/specific purpose provided for in Article 5(1)(b) GDPR. The concept of specific purpose is that collection of personal data must be for purposes that are identified and lawful, and further processing cannot take place for other purposes … unless pre-informed and legal.

For a controller, this means among other things that it cannot omit or conceal any purpose for which it intends to use the data. The purpose of data processing cannot be specified in a general way. This would be a breach of both the principle of specific purpose (specificity) and the principle of fairness. Data processing for unspecified purposes or purposes specified in such an imprecise way that the purposes are unrestricted or unclear renders the processing unlawful. In practice, trying to implement GDPR, organisations learn for how many purposes personal data are being processed. This is an interesting exercise.

The principle of collection of data for strictly defined purposes is directly connected with the notification obligation provided for in Articles 12–14 GDPR, because a controller is required to inform an individual of the purposes for which their data are processed.

At this point, the principle of accountability comes into play because it has to be proven that the individual was informed of the purposes of data processing.

The principle that the purpose is binding means that data cannot be processed for purposes other than those for which they were originally collected. However, this has to be interpreted reasonably. First, data can be processed for purposes that are aligned with the original purpose – collection of data for the purpose of concluding a contract enables the performance of that contract and payment to be claimed for performance of the contract. Second, it is allowed to amend or add a purpose of data processing, provided the data subject is informed of this new purpose and there is a legal basis for this new type of processing (e.g., consent to the marketing of third-party products). EU lawmakers determined first that data must be collected for lawful purposes, and second that data collected for one purpose cannot be used for a different purpose unless additional requirements are fulfilled, in particular notification is given of the intended new purpose of processing.

For example, an applicant for a position as business analyst for an international financial corporation cannot receive a newsletter the day after she applies, unless she has freely given separate and informed consent to use of their data for marketing or information (e.g., as a minimum by ticking a corrected formulated checkbox).

According to the principle of data minimisation, data must be proportional, appropriate, and limited to that essential for the purposes for which the data are processed. A controller can only process data, and the data can only be of content, necessary in view of the purpose for which the data is collected. The relevance of data must be assessed no later than the moment they are collected. This means that the controller is required to conduct an assessment and analysis of whether the data processed data are excessive. Data processing other than that essential to achieve the purpose will be a breach of the GDPR.

The principle of data minimisation is woven into the GDPR in a number of forms, in a number of places, under a number of names, and this can be deceiving. The GDPR requires minimisation of the volume and scope of data, of the period of storage (principle of limitation in time), and of access to data (privacy by default). It thus adopts the position that the less you know about a citizen, the better.

The principle of data minimisation is closely linked to the purpose of processing (the principle of purpose limitation). Depending on the purpose defined by the controller, the scope of data will have to be aligned with that purpose. For this reason, the collection of data that are not necessary now but maybe might prove useful in the future is not permitted. A review of the personal data collected may reveal that a large amount of the data is held unlawfully. We only need to ask ourselves the simple question ‘what do we need the data for?’

To avoid the problem of an excessive amount of data, internal procedures and methods providing for periodical review of the current practices (in particular forms) have to be devised. It is also necessary to define the procedure and specify the individuals involved in the process of drawing up and assessing new documents in terms of proportionality and the specific purpose of data processing.

Obtaining data about qualifications and marital status when concluding thirdparty insurance agreements for owners of vehicles, collection by a bank of customers’ personal data regarding former registered addresses, the category and date of issue of a driving licence, and data on an employment certificate concerning a bank’s customer’s employment history may also be considered disproportionate.

Accuracy of data requires implementation of data quality verification procedures and attention to quality of personal data. The possibility of execution of the right to have data rectified and updated must also be assured (Article 16 GDPR).

Accuracy of data presents a practical problem, which is that data become outdated. When combined with disregard for requests that data be updated or lack of skill in processing data, data becoming outdated can lead to a serious breach of the GDPR.

Updating data can also cause problems related to the correctness of data. For this reason, procedures need to be applied to limit discrepancies, for example verification via two channels (information about a change of an email contact address can be sent to the old and new email address or mobile telephone number in order to rectify an error where necessary or prevent a deliberate attempt at identity theft).

A controller is required to determine in advance the period for which it will store personal data and as a minimum the manner in which it verifies whether the data continues to be useful. The controller is required to inform the data subject of this (Articles 13 and 14 GDPR).

The limitation in time of storage, or ‘retention time’, is essentially another form of the principle of data minimisation – in this case, minimisation of the period for which personal data are stored.

A controller has an obligation to analyse, internally, the data processing purposes and the storage periods corresponding to them. Determining the period of storage of personal data or the criteria for further need of the data is not a simple task, as more and more organisations implementing the GDPR are finding.

Even if the maximum retention (storage) period is specified by currently applicable law (usually a prescription period), this is not obvious. First, provisions specifying retention/prescription periods are spread across various legal acts. Second, the prescription period does not necessarily mean the appropriate period; for example, storage of information for a period longer than the prescription period set by law might be necessary to protect the vital interests of an individual, and at the same time storing personal data for the whole prescription period may help to secure evidence for rare cases started at the end of a prescription period, but at the same time it generates a risk for confidentiality of data of all people whose data are till stored.

It is even more difficult to determine the data storage period if the purposes for which personal data are processed are not regulated by law. In such a case, a controller has to determine by itself the periods of personal data storage, while maintaining the correct balance between the rights of an individual under currently applicable law and its own needs with regard to data processing and achieving the defined purposes for which processing takes place. Moreover, where there are multiple purposes for which processing takes place, theoretically has to be an individual storage period, or at least criteria for verifying it, for each of them. We believe that practical problems with managing many different retention periods for different kind or purposes of processing of personal data allow for unifying retention periods to some limited number of those, say three or four general situations.

When the GDPR comes into force, the practice of many bodies, for instance international law firms, of indefinite storage of data and information (e.g., eternal storage of email correspondence) will probably no longer be possible. For this reason, the purposes for which processing takes place and legal provisions will have to be analysed, and procedures for data storage, monitoring periodical data usefulness, and scheduled erasure of data will have to be developed.

Finally, for the sake of thoroughness, we need to mention that Article 5(1)(e) GDPR provides for a derogation from the principle of limitation in time for storage of data in a form enabling identification. Data in a form enabling identification may be stored for longer than necessary for the purposes for which those data are processed, provided that they are furthered stored and processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, provided that appropriate technical and organisational measures are implemented to protect the rights and freedoms of the data subjects. The security measures described in the preceding sentence should take the form of implementation of technical and organisational measures ensuring in particular compliance with the principle of data minimisation. Further data processing for archiving purposes in the public interest for the sake of scientific or historical research or for statistical purposes is possible if the controller concludes that these purposes cannot be attained by processing personal data that from the outset, or at that point no longer, enable identification of data subjects, provided that the appropriate safeguards are in place (such as pseudonymisation of personal data, which is discussed separately in greater detail below).

Data must be processed in a manner that ensures appropriate security, including, for instance, protection against unauthorised or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organisational means. The principle of security is linked to Articles 24, 28, 32 and 39 GDPR.

The GDPR requires that the appropriate level of security of personal data be provided, including integrity and confidentiality of personal data.

Personal data protection laws incorporate into the legal system terms and requirements known in information security. This occurs in fragmentary fashion, and therefore to explain them some backtracking is needed. Typically, information security has three attributes, which can be remembered by using the abbreviation CIA (confidentiality, integrity, availability). There is another, which is accountability, which is the possibility of attributing a specific task to a specific person with regard to particular information. Confidentiality means the prevention of unauthorised access to information. Integrity means prevention of unauthorised change to the information, including damage. Availability means that the information can be accessed by authorised persons.

Confidentiality is intuitive. This is ensuring that unauthorised persons do not gain access to data, i.e. that the data are not leaked (e.g., by loss of a mobile telephone on which there is a file containing two thousand business contacts and one year’s worth of emails) and that no unauthorised person gains access to the data in their normal location (e.g., by peaking at telephone records on a computer monitor of a telecommunications operator employee).

Put simply: The GDPR requires measures to ensure that data are not changed or damaged deliberately or by accident.

As mentioned, availability means that the data can be accessed at any given time (by authorised persons). Lack of availability occurs when the data are destroyed (erased) or when they cannot be accessed (e.g., they are on a hard disk on a computer on which the processor has burnt out; there is a breakdown of the customer service system; production system computers have been destroyed, for example by a NotPetya virus; and opening a backup copy requires lengthy repairs to the system because someone has taken the files home with them and is currently away).

For reasons that are not entirely clear, stress has been placed as a rule only on confidentiality and integrity, and accessibility of information is not mentioned in the name of the rule. This is detrimental to legibility and consistency of the GDPR because the problem of not ensuring availability of personal data is subsequently also treated as a breach of personal data security (the typical example given in various guidelines is lack of access to medical records before and during an operation), while naturally, under Article 32 GDPR, ensuring continuity and resilience of systems is an element of data security. This eventually leads to recurrence of an error and the principle of security being referred to as the ‘principle of integrity and confidentiality’, instead of possibly the ‘principle of information security’.

Unlike the personal data protection laws still in force, the GDPR does not define a strict information security framework. A closer description of the functional requirements and conditions that IT systems are required to fulfil to protect processed data from unauthorised disclosure, change, or destruction is sought in vain. EU lawmakers intended to produce rules that would remain relevant for a long period and a framework into which other content could be inserted at any time, as times required.

Another keyword is the word ‘appropriate’. Security and compliance measures should be ‘appropriate’. An analysis of the recitals and provisions within the GDPR shows that (i) data security measures should be appropriate to the risk for the rights and freedoms of data subjects (Article 32(1) GDPR) and (ii) measures (technical and organisational) taken to ensure data protection compliance and to demonstrate data protection compliance should be ‘appropriate’ to the risk for the rights and freedoms of data subjects. This means that the level of security as well of compliance procedures and other measures should be suited to the damage or harm that can be done to individuals due to (i) breach of security of their data and (ii) risk generated by mere processing (e.g., if legality of processing is questionable or scope of data is broad).

Observing the principle of an appropriate level of security and compliance is therefore closely linked to assessment of the risk related to data processing. Depending on the type of data held, the manner in which they are processed, or the size of the business being the controller, the appropriate security and compliance measures will have to be employed to minimise the risk of loss of control over the processed data. For the reasons described above, the measures employed following the risk analysis by one controller are not necessarily effective for another controller. Yet, in the end, for micro and small and medium businesses risk analysis is repetitive and can be standardised. The principle of appropriate level of security, combined with the principle of accountability, means that if the risk of breach is not analysed and classified, and this does not include assessing the risk and consequences of breach of individuals’ rights and freedoms, then it cannot be demonstrated that the appropriate security measures were applied. As the measures must be appropriate in relation to risk, the risk has to be assessed for the appropriate measures to be taken.

A controller (as well as processor) has to concentrate on security issues, having regard for the threat presented both from outside and inside the organisation. The crucial factor is analysis of and increasing the level of security. Digitisation of resources and universal use of modern technology means that attaining business objectives efficiently depends upon information and services, and information and communication technology infrastructure enabling use of cyberspace, being secure. Use by controllers of data leak prevention systems (so-called DLP systems) to secure data which could expose an organisation to criminal or civil liability or loss of some other kind if disclosed is becoming more and more common. Technology of this kind is not cheap. Unfortunately, a business’ financial capabilities as regards implementing appropriate security measures are of secondary importance, and thus this will not constitute mitigating circumstances and will not be considered, should a supervisory authority have cause to set a penalty in cases of incidents caused due to inadequate security measures. To complicate the matter further, the principle of security sometimes has to be reconciled with the principles of lawfulness and minimisation. The issue of erasure of data from backup copies is a typical example, which is discussed when describing the right to have data erased and is mentioned in the context of the right to have data rectified.

As mentioned, the principle of accountability provided for in Article 5(2) GDPR means that a controller is responsible for demonstrating compliance with data protection rules with regard to substantive issues. The principle of accountability transfers the burden of proof that the GDPR is complied with to controllers. The principle of accountability, being in practice a presumption of guilt, is incorporated throughout the GDPR, in various provisions. It is mentioned in Article 24, requiring a controller to implement the appropriate technical and organisational measures to ensure, and be able to demonstrate, that processing complies with the GDPR. Under Article 82(3) GDPR, a controller or a processor is exempt from liability for damage caused by processing contrary to the GDPR ‘if it proves that it is not in any way responsible’ for the event giving rise to the damage.

Considering that the primary substantive principle is that data processing has to be lawful, the principle of accountability means that a controller is required to account for the performance of all obligations under the GDPR, which is no easy task.

#4.1 Preliminary Remarks

#4.1.1 Material Principles

#4.1.2 Formal Principle: Accountability

#4.1.3 More about Data Protection Principles

#4.2 The Principles of Lawfulness, Fairness, and Transparency (Legal Compliance)

#4.2.1 Lawfulness

#4.2.2 Fairness

#4.2.3 Transparency

#4.3 Principle of Purpose Limitation

#4.4 Principle of Data Minimisation (Proportionality)

#4.5 Principle of Accuracy

#4.6 Principle of Storage Limitation

#4.7 Principle of Security (Data Integrity and Confidentiality)

#4.7.1 Confidentiality

#4.7.2 Integrity

#4.7.3 Availability

#4.7.4 Appropriate

#4.8 Principle of Accountability