Data Privacy and GDPR Handbook

SANJAY SHARMA, PHD, is the founder and chairman of GreenPoint Global – a data privacy, risk advisory, education, and technology services firm headquartered in New York with over 350 employees and a global footprint.Sanjay is a 30-year veteran of the financial services industry and has held C-level positions in banking, technology, and risk management at firms including Royal Bank of Canada, Goldman Sachs, Merrill Lynch, Citigroup, Moody's, and Natixis. He teaches graduate courses at four universities in New York City, London, and Nice, France. He has extensive experience in data privacy and management of risk associated with large data frameworks.He holds a PHD in finance and international business from New York University and an MBA from the Wharton School of Business, and has undergraduate degrees in physics and marine engineering. He lives with his family in Rye, New York.

• 1 Origins and Concepts of Data Privacy 11.1 Questions and Challenges of Data Privacy 21.2 The Conundrum of Voluntary Information 31.3 What is Data Privacy? 51.4 Doctrine of Information Privacy 61.5 Notice-and-Choice versus Privacy-as-Trust 91.6 Notice-and-Choice in the US 91.7 Enforcement of Notice-and-Choice Privacy Laws 111.8 Privacy-as-Trust: An Alternative Model 131.9 Applying Privacy-as-Trust in Practice: The US Federal Trade Commission 141.10 Additional Challenges in the Era of Big Data and Social Robots 161.11 The General Data Protection Regulation (GDPR) 181.12 Chapter Overview 192 A Brief History of Data Privacy 232.1 Privacy as One's Castle 232.2 Extending Beyond the "Castle" 242.3 Formation of Privacy Tort Laws 242.4 The Roots of Privacy in Europe and the Commonwealth 252.5 Privacy Encroachment in the Digital Age 262.6 The Gramm-Leach-Bliley Act Tilted the Dynamic against Privacy 282.7 Emergence of Economic Value of Individual Data for Digital Businesses 292.8 Legislative Initiatives to Protect Individuals' Data Privacy 312.9 The EU Path 332.10 End of the Wild West? 372.11 Data as an Extension of Personal Privacy 372.12 Cambridge Analytica: A Step Too Far 392.13 The Context of Privacy in Law Enforcement 393 GDPR's Scope of Application 453.1 When Does GDPR Apply? 453.2 The Key Players under GDPR 523.3 Territorial Scope of GDPR 543.4 Operation of Public International Law 574 Technical and Organizational Requirements under GDPR 614.1 Accountability 614.2 The Data Controller 624.3 Technical and Organizational Measures 694.4 Duty to Maintain Records of Processing Activities 724.5 Data Protection Impact Assessments 734.6 The Data Protection Officer 804.7 Data Protection by Design and Default 844.8 Data Security during Processing 924.9 Personal Data Breaches 944.10 Codes of Conduct and Certifications 1074.11 The Data Processor 1125 Material Requisites for Processing under GDPR 1255.1 The Central Principles of Processing 1255.2 Legal Grounds for Data Processing 1325.3 International Data Transfers 1615.4 Intragroup Processing Privileges 1825.5 Cooperation Obligation on EU Bodies 1835.6 Foreign Law in Conflict with GDPR 1846 Data Subjects' Rights 1936.1 The Controller's Duty of Transparency 1946.2 The Digital Miranda Rights 1976.3 The Right of Access 2016.4 Right of Rectification 2036.5 Right of Erasure 2056.6 Right to Restriction 2146.7 Right to Data Portability 2166.8 Rights Relating to Automated Decision Making 2216.9 Restrictions on Data Subject Rights 2267 GDPR Enforcement 2337.1 In-House Mechanisms 2337.2 Data Subject Representation 2407.3 The Supervisory Authorities 2417.4 Judicial Remedies 2537.5 Alternate Dispute Resolution 2587.6 Forum Selection Clauses 2657.7 Challenging the Existing Law 2668 Remedies 2718.1 Allocating Liability 2718.2 Compensation 2738.3 Administrative Fines 2758.4 Processing Injunctions 2798.5 Specific Performance 2839 Governmental Use of Data 2879.1 Member State Legislations 2879.2 Processing in the "Public Interest" 2919.3 Public Interest and the Rights of a Data Subject 2949.4 Organizational Exemptions and Responsibilities 2979.5 Public Documents and Data 3019.6 Archiving 3049.7 Handling Government Subpoenas 3059.8 Public Interest Restrictions on GDPR 3059.9 Processing and Freedom of Information and Expression 3069.10 State Use of Encrypted Data 3089.11 Employee Data Protection 30910 Creating a GDPR Compliance Department 31910.1 Step 1: Establish a "Point Person" 31910.2 Step 2: Internal Data Audit 32110.3 Step 3: Budgeting 32210.4 Step 4: Levels of Compliance Needed 32310.5 Step 5: Sizing Up the Compliance Department 32510.6 Step 6: Curating the Department to Your Needs 32610.7 Step 7: Bring Processor Partners into Compliance 32710.8 Step 8: Bring Affiliates into Compliance 32810.9 Step 9: The Security of Processing 32810.10 Step 10: Revamping Confidentiality Procedures 32910.11 Step 11: Record Keeping 32910.12 Step 12: Educate Employees on New Protocols 33010.13 Step 13: Privacy Policies and User Consent 33110.14 Step 14: Get Certified 33110.15 Step 15: Plan for the Worst Case Scenario 33110.16 Conclusion 33211 Facebook: A Perennial Abuser of Data Privacy 33511.1 Social Networking as an Explosive Global Phenomenon 3351.2 Facebook is Being Disparaged for Its Data Privacy Practices 33511.3 Facebook Has Consistently Been in Violation of GDPR Standards 33611.4 The Charges against Facebook 33611.5 What is Facebook? 33711.6 A Network within the Social Network 33711.7 No Shortage of "Code of Conduct" Policies 33811.8 Indisputable Ownership of Online Human Interaction 33911.9 Social Networking as a Mission 33911.10 Underlying Business Model 34011.11 The Apex of Sharing and Customizability 34111.12 Bundling of Privacy Policies 34111.13 Covering All Privacy Policy Bases 34211.14 Claims of Philanthropy 34311.15 Mechanisms for Personal Data Collection 34411.16 Advertising: The Big Revenue Kahuna 34611.17 And Then There is Direct Marketing 34711.18 Our Big (Advertiser) Brother 34711.19 A Method to Snooping on Our Clicks 34811.20 What Do We Control (or Think We Do)? 34911.21 Even Our Notifications Can Produce Revenue 35211.22 Extent of Data Sharing 35311.23 Unlike Celebrities, We Endorse without Compensation 35411.24 Whatever Happened to Trust 35511.25 And to Security of How We Live 35511.26 Who is Responsible for Security of Our Life Data? 35611.27 And Then There Were More 35911.28 Who is Responsible for Content? 35911.29 Why Should Content Be Moderated? 36011.30 There are Community Standards 36111.31 Process for Content Moderation 36911.32 Prospective Content Moderation "Supreme Court" 37011.33 Working with Governmental Regimes 37011.34 "Live" Censorship 37111.35 Disinformation and "Fake" News 37211.36 Conclusion 38012 Facebook and GDPR 39312.1 The Lead Supervisory Authority 39312.2 Facebook nicht spricht Deutsch 39312.3 Where is the Beef? Fulfilling the Information Obligation 39412.4 Data Processing Purpose Limitation 39512.5 Legitimate Interests Commercial "Restraint" Needed 39612.6 Privacy by Design? 39812.7 Public Endorsement of Personalized Shopping 39812.8 Customizing Data Protection 39912.9 User Rights versus Facebook's Obligations 40012.10 A Digital Blueprint and a GDPR Loophole 40112.11 Investigations Ahead 40212.12 Future Projects 40313 The Future of Data Privacy 40713.1 Our Second Brain 40713.2 Utopian or Dystopian? 40913.3 Digital Empowerment: Leveling the Playing Field 410Notes 412Appendix: Compendium of Data Breaches 413About the Authors 467Index 469