IEEE Technology and Society Magazine - December 2020 - 63

allow or confirm the unique identification of that natural
person, such as facial images or dactyloscopic data [art.
4 (14)]. Genetic data means personal data relating to the
inherited or acquired genetic characteristics of a natural
person, which give unique information about the physiology or the health of that natural person and which
result, in particular, from an analysis of a biological
sample from the natural person in question [art. 4 (13)].

GDPR compliance is not post hoc:
if a person thinks that they are GDPR
compliant but cannot show how, then
they are not GDPR compliant.

Data Subject's Rights
When it comes to the data subject's rights, the GDPR
recognizes a list of new privacy rights for them. Their
aim is to give individuals greater control over the personal data they loan to organizations. Generally speaking, the data subject has the rights:
1)
2)
3)
4)
5)
6)
7)
8)

To be informed
Of access
To rectification
To erasure
To restrict processing
To data portability
To object
And the rights in relation to automated decision
making and profiling [19].

d)
e)

Data Processing Principles
Anyone who processes data must do it according to
seven data protection and accountability principles that
Article 5.1-2 outlines:
a) Lawfulness, fairness and transparency: Processing
of the data must be lawful, fair, and transparent to
the data subjects. Importantly, this rule has been
mentioned in the preamble to GDPR text. According
to point 39: " Any processing of personal data
should be lawful and fair. It should be transparent
to natural persons that personal data concerning
them are collected, used, consulted or otherwise
processed and to what extent the personal data
are or will be processed. The principle of transpar-
ency requires that any information and communi-
cation relating to the processing of those personal
data be easily accessible and easy to understand,
and that clear and plain language be used. That
principle concerns, in particular, information to
the data subjects on the identity of the controller
and the purposes of the processing and further
information to ensure fair and transparent pro-
cessing in respect of the natural persons con-
cerned and their right to obtain confirmation and
communication of personal data concerning them
which are being processed (...). Moreover, the per-
sonal data should be adequate, relevant and lim-
DECEMBER 2020

∕

ited to what is necessary for the purposes for
which they are processed.
Purpose limitation: Data must be processed for legitimate purposes. The purposes must be specified
explicitly to the data subject at the moment personal
data is being collected.
Data minimization: Only as much data as absolutely
necessary for the specified purposes should be collected and processed.
Accuracy: The personal data kept must be accurate
and up to date.
Storage limitation: Personally identifying data may
only be stored for as long as necessary for the specified purpose.
Integrity and confidentiality: Data must be processed
in such a manner that ensures appropriate security,
integrity, and confidentiality, for example by using
encryption. Data should be processed in such a way
that it no longer can be attributed to a specific data
subject; not without the use of additional information, which is to be kept separately.
Accountability: The data controller's responsibility is
to be able to demonstrate GDPR compliance with all
of these principles.

Achieving GDPR Compliance - The
Requirements Brought by the GDPR
Under the GDPR, data controllers must be able to show
they are GDPR compliant. It is crucial to remember
GDPR compliance is not an action that can be carried
out after the fact. The article [16] claims that if a person
thinks that they are GDPR compliant but cannot show
how, they are not GDPR compliant. Some general principles of ensuring the GDPR compliance include:
Designating data protection responsibilities to the
company's staff.
■ Maintaining detailed documentation of the data the
organization collects, including the information on
how it is used, where it is stored, who is responsible
for it, etc.
■ Training the employees.
■ Implementing technical and organizational security
measures.
■

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020