The Digital Privacy Landscape
Data privacy is a topic that affects all of us, whether we are consumers, businesses, regulators, or policymakers. Data privacy is not only a legal right, but also a social value, a competitive advantage, and a global challenge.
In the digital age, data is everywhere. It is generated by our online activities, our smart devices, our biometric sensors, and our social interactions. It is collected, stored, analyzed, and shared by various entities, such as governments, corporations, platforms, and hackers. It is used for various purposes, such as innovation, personalization, security, and surveillance. It is also subject to various risks, such as breaches, misuse, discrimination, and manipulation.
How do we protect our data privacy in this complex and dynamic environment? How do we balance the benefits and risks of data use? How do we ensure that data is used in a fair, transparent, and accountable manner? How do we foster trust and cooperation among different stakeholders? How do we harmonize the diverse legal frameworks and cultural norms across the world?
The Pillars of Data Privacy
Data privacy is the right of individuals to control how their personal data is collected, processed, stored, and shared by organizations and individuals. It is a fundamental human right that protects our dignity, autonomy, identity, and security. It also affects our social, economic, political, and cultural participation in the digital age.
However, data privacy is also under constant threat from various sources, such as cyberattacks, surveillance, identity theft, discrimination, manipulation, censorship, and exploitation. These threats can have serious consequences for our personal lives, our professional careers, our public services, our democratic institutions, our national security, and our global peace.
Data privacy principles are the guidelines that govern:
(i) how personal data should be handled in a responsible and respectful manner.
(ii) how personal data should be collected, processed, stored, and shared by organizations and individuals.
They aim to protect the rights and freedoms of data subjects, especially their right to privacy, and to ensure accountability and transparency in data processing. They also help us to ensure that our personal data is used for legitimate purposes only; that it is accurate and relevant; that it is protected from harm; and that we have a say in how it is used.
General Data Protection Regulation (GDPR)
There are different sources of data privacy principles, such as national laws, international agreements, and organizational policies. One of the most influential and comprehensive sources is the General Data Protection Regulation (GDPR), which is a legal framework that applies to the European Union and its partners. The GDPR defines seven data privacy principles that are based on the following concepts:
- Lawfulness, fairness, and transparency: Data processing must be done in a legal, fair, and clear manner.
- Purpose limitation: Data must be collected for specific, explicit, and legitimate purposes and not used for other incompatible purposes.
- Data minimization: Data must be adequate, relevant, and limited to what is necessary for the purposes of processing.
- Accuracy: Data must be accurate and kept up to date. Inaccurate or outdated data must be corrected or deleted.
- Storage limitation: Data must be kept for no longer than necessary for the purposes of processing. Disposed and anonymized once purpose has been fulfilled.
- Integrity and confidentiality: Data must be protected from unauthorized or unlawful access, use, alteration, disclosure, or destruction.
- Accountability: Data controllers and processors must be able to demonstrate compliance with the data privacy principles and take responsibility for any breaches or violations.
These data privacy principles are not only important for legal compliance, but also for ethical conduct and social responsibility. They reflect the values of respect, dignity, autonomy, and justice that underpin human rights. They also help to foster trust, confidence, and loyalty among data subjects, customers, partners, and stakeholders.
Six lawful bases for processing of personal data
According to the General Data Protection Regulations, there are six lawful bases for the processing of personal data:
- Contractual Obligations: the processing is necessary for a contract you have with the individual / organization, or because they have asked you to take specific steps before entering into a contract (Performance of a contract)
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect the data subject’s life
- Public Interest: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for the legitimate interests of the organization unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. This is the most flexible lawful basis for processing but will not always be the most appropriate. In fact, there are three elements to the legitimate interest basis. It helps to think of it as three-part test.
The organization needs to
(i) identify a legitimate interest. It needs to be more specific. Common examples are health & safety; to protect the property; fraud or crime prevention; network and information security; etc. Note: You must include details of your legitimate interests in your privacy information;
(ii) show that the processing is necessary and proportionate to achieve the purpose above;
(iii) balance the organization’s interest against the data subject’s interests and rights and freedoms. The legitimate interests can be the organization’s own interests or the interests of third parties. They can include commercial interests, individual interests, or broader societal benefits.
To evaluate the balance between the organization’s/third party’s interest and the interest of the individual(s) affected, the organization needs to undertake a Balancing test / LIA (Legitimate Interest Assessment). It must keep a record of this assessment to demonstrate compliance if required.
⦁ Consent: the individual has given clear and explicit consent for you to process their personal data for a specific purpose.
Good to note that there is an additional lawful basis under the Mauritius Data Protection Act under Section 28 – Lawful Processing – which relates to the processing of data for historical, statistical and research purposes which is not under GDPR.
Remember that you must determine your lawful basis before you begin processing, and you should document it. You should also inform the individual about the purpose and the lawful basis of the processing in your privacy notice. You cannot change your lawful basis later without a valid reason.
Data Privacy as a fundamental right
Data privacy is a complex and evolving issue that affects individuals, organizations, and societies. As the use of data and technology increases, so does the need for effective and ethical data protection and governance. The challenges and opportunities of data privacy in various contexts can be discussed in length. We can also examine the legal and ethical frameworks that regulate data privacy, such as the GDPR, DPA and the Universal Declaration of Human Rights. However, we do agree that data privacy is not only a matter of compliance, but also a matter of human dignity and social justice.
We believe that data privacy is a fundamental right that should be respected and protected by all stakeholders. To achieve this goal, we recommend that data privacy should be integrated into the design and development of data systems and applications, as well as into the education and awareness of data users and subjects. We also suggest that data privacy should be monitored and evaluated regularly, to ensure that it meets the changing needs and expectations of the data community. Furthermore, we propose that data privacy should be fostered through collaboration and dialogue among different actors, such as governments, businesses, academics, civil society, and individuals.
By adopting these measures, we hope that data privacy can become a common standard of achievement for all people and all nations, as envisioned by the UN. We also hope that data privacy can enable the responsible and beneficial use of data for the advancement of humanity and the planet. Data privacy is not a barrier or a burden, but an opportunity and a responsibility. Let us embrace it with courage and creativity.
Our commitment to Data Privacy at BDO Solutions
At BDO Solutions, your data privacy is our top priority. We adhere to the highest international standards, including ISO 27001 certification and compliance with GDPR and the Mauritius Data Protection Act, ensuring your personal information is protected.
Let's Talk Data Privacy
We invite you to engage with us on the importance of data privacy. Share your thoughts or inquire about our data protection practices. Together, we can uphold the highest standards of data privacy.
Contact us to continue the conversation.