Data protection glossary (part 2)

After over a month when E-Crime Expert presented the most important Case Law and Rulings on the applicability of both Directive 95/46 (private sector) and Regulation 45/2001 (public sector) to the processing of personal data, today’s post will bring more useful information: A Glossary of the most common terms from the Directive 95/46.

The information will be delivered during three blog posts and  aims to make the readers and data subject aware of the most common terminology in order to better understand and protect their personal data and privacy.

You could read the first post here.

(F) Further processing

A further processing operation, as defined in the implementing decree of 13 February 2001, involves personal data initially collected for an explicit purpose and re-used at a later time for historical, statistical or scientific purposes that are incompatible with the initial purpose. In other words, these processing operations constitute a specific form of secondary data collection.

(I) Impact (Information Security)

The consequences of an incident on one or more assets constitute the impact (for instance personal data who are no longer accurate).

In information security usually a difference is made between direct consequences (damage to the information system, such as file modifications, changes in the accessibility of confidential data or an inappropriate system shutdown) and the indirect impact (the damage the organization or third parties have incurred, such as abuse of confidential information, wrong decisions as a result of incorrect data).

There is not always an immediate relation between an incident’s direct consequences and its indirect impact on an organization or on third parties: the loss of fundamental data can have enormous consequences for the person involved whereas a system that was erased completely can already be restored with a good back-up.

Incident (Information Security)

An incident is an unexpected or unwanted event that can have serious consequences.
An information security incident is any unexpected event that might cause a compromise of an organization’s activities or information security (system malfunction or overload, human error, software or hardware malfunction). An incident in itself is not good nor bad.

Integrity (Information Security)

Integrity covers two different aspects: information integrity, and system and process integrity.
Information integrity means that information cannot be changed or destroyed intentionally or unintentionally.
System or process integrity means that the desired function is fully achieved according to expectations. Without an authorized intervention it is not possible to make intentional or unintentional changes.

Intermediary organization

An intermediary organization is defined as any natural person, legal person, un-associated organization or public authority encoding personal data, other than the controller of the processing of non-encoded data.

(L) Legitimate interest

An interest is called legitimate when the controller’s interest in processing the data overrides the registered person’s interest in not processing the data. In case of doubt, the Commission or a judge will decide whose interest has the highest priority.

(M) Management System (Information Security)

There are several models for management systems regarding information security (ISMS – Information Security Management System). The best-known system is based on a PDCA structure (Plan-Do-Check-Act) and permanently improves security. This permanent improvement is linked to changing factors, for example modifications in the organization and related risks, changes in the information system, technological novelties, both for operational systems and security rules.

Manual filing system

A manual filing system is a structured set of personal data that are accessible according to certain criteria, the yellow pages on paper for example.

(N) Non-repudiation (Information Security)

Non-repudiation is the ability to prove that an operation or event has taken place, so that it cannot be repudiated later. For e-mails, for example, non-repudiation is used to guarantee that the recipient cannot deny that he received the message, and that the sender cannot deny that he sent is.

Notification

A notification is an action carried out by the controller to inform the Commission that he will be processing data. A notification is not intended to request permission or authorization, but only to notify a processing operation. The notification mainly consists of a description of the data processing operation.

(O) Opt in

In this system, you give somebody your prior consent to send you commercial messages. The opt-in system is valid for all forms of communication and allows you to give your free, specific and informed consent, as required by the Privacy Law.
The opt-in system is mainly used when somebody regularly wants to send a massive number of e-mails, for example a newsletter, electronic magazines, promotional offers. You can register by filling in your e-mail address on a specific online form. The idea behind the opt in is to know in advance exactly what you are registering for, so that there are no unpleasant surprises afterwards.

Opt out

As opposed to opt in, the opt-out system allows you to object to any data processing operation with a view to direct marketing, as required by the Privacy Law.
This involves receiving an unwanted message containing the possibility to unsubscribe in order to stop receiving messages. This system is only authorised provided that the sender obtained your (e-mail) address directly from you while purchasing a product or service from him, that this (e-mail) address is only used to offer similar products or services the sender delivers himself, and that you are given the possibility to object easily and free of charge when you give the sender your e-mail address. In addition to this system, the direct marketing sector has organized the Robinson lists.

(P) Personal data

Personal data reveal information about an identified or identifiable natural person (called the “data subject” in the Privacy Law). In other words, personal data are all data allowing for the identification of an individual.

Personal data include an individual’s name, a picture, a phone number, even a professional phone number, a code, a bank account number, an e-mail address, a fingerprint, …

They do not only include data having to do with individuals’ privacy, but also data having to do with an individual’s professional or public life.

Only data about a natural (physical) person are taken into account, excluding data about a legal person or an association (civil or commercial corporations or non-profit organizations).

Processing personal data

Processing personal data is defined as any operation or set of operations performed on personal data. These operations are extremely varied and relate, among others, to the collection, storage, use, modification, disclosure of the data.

A few examples:

• a hotel offering the possibility of online bookings processes data when registering the customer’s name, the dates of his stay and his credit card number.
• a municipality transmitting the names of persons requesting a building permit to a contractor who wants to send them publicity, also processes data.

The law applies as soon as the data are processed, even partially, using automatic means. Automatic means include all information technologies, computer technology, telematics, telecommunication networks (the Internet).

For example, the Privacy Law is applied to:

• a company’s computerized database containing customer or supplier data;
• the electronic list of transactions on a bank account;
• the computerized file of a company’s members of staff or of the children enrolled in a school;
• etc.

The Privacy Law also applies, however, as soon as one processing operation is carried out using automatic means. For example:

• a temporary employment agency keeping applicants’ hand-written curricula vitae but sending them to employers by fax, has to observe the rules in the Privacy Law for all operations it performs on the curricula vitae (such as storing, filing or sending them).

If data are not processed using automatic means (for example on paper or on microfiche) the Law still has to be observed if the data are included or will be included in a manual filing system that can be accessed according to specific criteria (for example people’s names in alphabetical order).

Processor

This is any natural person, legal person, un-associated organization or public authority processing data on behalf of the controller, not including individuals who are under the direct authority of the controller and who have been authorized to process the data).

Public register

The public register is a list of notifications of personal data processing operations notified to the Commission. Anyone can consult this list, for example via the Internet.

Purposes: historical, statistical or scientific

• historical research involves the processing of personal data with a view to the analysis of an earlier event or in order to make that analysis possible. This is possibly but not necessarily also a processing operation with a scientific purpose (in other words, a genealogist can appeal to this provision);
• statistical purposes are achieved through any action with a view to collecting and processing personal data when this is necessary for statistical surveys or to produce a statistical result;
• scientific research involves establishing patterns, rules of conduct and causal relations exceeding all individuals they relate to.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Are you used to this terminology? Do you find it useful?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Partnership

I am glad to announce that E-CRIME EXPERT and IMPACT are engaged in a strategic alliance to exchange information and technologies, thus helping partner countries against cyber threats, malicious attacks and to provide advance warning and vulnerability data. 

For more information please visit: www.e-crimeexpert.com/home/partners