European Data Protection Day: Technology advances using our data and must do so by guaranteeing our rights and freedoms

European Data Protection Day: Technology advances using our data and must do so by guaranteeing our rights and freedoms

The Catalan Data Protection Authority (APDCAT) organized a conference aimed at the community of data protection experts and professionals on the occasion of the celebration of European Data Protection Day. The event took place in the Aula Europa (Passeig de Gràcia, 90), the headquarters of the European institutions in Barcelona, and was attended by the director of the APDCAT, Maria Àngels Barbarà, and the director of the Delegation of the European Commission in Barcelona, Ferran Tarradellas. 

Under the title Update and experiences on key points of the GDPR, the meeting served to delve into key aspects of the General Data Protection Regulation (GDPR) such as transparency and the right to information, the legitimacy of processing of special categories of data, and notification of security breaches. 

Data protection in digital and democratic societies

Maria Àngels Barbarà, director of the APDCAT, stated that, in the current context of technological innovation, it is necessary to remember the centrality that the right to data protection has acquired as a right, as on it pivots the guarantee of principles, values, rights and freedoms that make up European democratic societies.

Barbarà also stressed that technology advances using our data and must do so by guaranteeing our rights and freedoms, and she stated that reality shows us that society and people are very unaware of the potential impact that technologies have on us, and that technologies are redefining our way of being and living as individuals and as a society.

Entities have difficulty integrating proactive responsibility and a focus on risk in the data processing they carry out, principles that guide compliance with the new obligations in terms of data protection, and that force us to think about the processing from the point of view of the affected person.

The day also featured presentations by Joana Marí, data protection delegate and head of Strategic Projects at the APDCAT; Santiago Farré, head of the Legal Department at the APDCAT; and Blanca Peraferrer, head of the Inspection and Technical Area of the APDCAT.

Transparency and the right to information

Transparency as a principle which should inspire the fulfilment of all the obligations established in the GDPR requires that entities put themselves in the place of the person from whom the personal data is collected and which they want to process. Given the principle of proactive responsibility and the focus on risk, it is necessary to adapt the information to the "audience", to the complexity of the processing and to the mechanism through which personal data is collected.

Legitimation of the processing of special categories of data

Throughout 2019 there were several developments in the processing of special categories of data. That is, that personal information which reveals diverse issues such as ethnic or racial origin, political opinions, religious or philosophical convictions, or union affiliation; genetic and biometric data intended to uniquely identify a natural person; and data relating to the health or sexual life or sexual orientation of an individual. In this way, the conference analysed the modifications derived from the approval of the organic Law 3/2018, of 5 December, on protection of personal data and guarantee of digital rights, and also some of the latest judicial decisions most relevant to this matter.

Notification of data security breaches

Finally, the new GDPR incorporated, among other things, a new obligation for those responsible for the processing of personal data: the notification of security breaches to control authorities. In this sense, the Inspection Area of the APDCAT has found that at the moment there is still some confusion when determining on what occasions it is mandatory to notify these security breaches to the APDCAT and those possibly affected; and most importantly, the point at which to identify and assess the risk to people’s rights and freedoms and their seriousness.