AUGUST 2018CIOAPPLICATIONSEUROPE.COM9Various data processors have readjusted their system to better comply with the GDPR allowing the data controllers that use their service to have better control over the personal datathem facilitate the phase of asking questions regarding the processing activities by providing various pre-prepared questions and preparing reports based on the responses given to those questions. Some of the tools claim to be able to sort out the personal data within a large cluster of big data and thereby help in preparation of a data inventory. However developed such tools are, they still require human input in order to finalize the data inventory; the questions posed by the tools must be responded by the employees or the consultants of the data controller and the employees or the consultants of the data controller must give input in relation to the parameters to be used by the tools that automatically sort out the personal data from the servers of a data controller or to analyse the output generated by that input. It would not be a far-fetched estimate to say that these tools will be supported with artificial intelligence and machine learning in the close future, which will bring them closer to being self-sufficient for generating data inventories. For the moment, a data controller needs to employ its own officers or consultants in addition to the available tools to prepare a data inventory. Data Protection by Design and by DefaultData Protection by Design and Data Protection by Default are concepts that are considered good practices in the privacy spheres for a long time. The GDPR accepts these concepts and requires the controllers to adhere to these concepts with its Article 25.According to Article 25 of the GDPR, the data controller implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the GDPR and protect the rights of data subjects and keep the data secure. Data controllers shall also implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. These are important and high level standards; these principles require the data controllers to review their processing structures in whole and readjust them in a way that -by default- the personal data is collected and processed only to the extent required for the purpose of processing and is accessed by third parties only to the extent required for the purpose of the processing.This is also an area where human input is used together with newly developed software. There are now a number of software that allows the data controllers to pseudonymize or anonymize personal data. Furthermore, various data processors have readjusted their system to better comply with the GDPR allowing the data controllers that use their service to have better control over the personal data, providing them with a number of options including but not limited to the ability to delete or modify and to have access to the personal data of the data subjects and to log the activities related to personal data so that the accountability obligation is met. Some of the data processors also allow for the option to inform the data subjects and getting consent where necessary. Furthermore, data processors are also increasing the level of security and providing more options for data breaches. The level of compliance with the GDPR will also be a decisive factor for the data controllers when choosing their data processors. A Final WordThe GDPR sets forth very high standards for data protection which can be challenging for data controllers. This is due to the technological developments which allow easier procession of personal data in high scales. The same technological developments also provide some solutions for responding to these high standards. For the time being, human input is also required for most of these solutions. However, together with the developments in the AI and machine learning, we will also see technological solutions which do not require human input for some of these solutions.
< Page 8 | Page 10 >