Les 18 oktober data protection
PRINCIPLES OF DATA PROTECTION
Demonstrating Compliance: The GDPR requires data controllers to show that they
comply with data protection principles, rather than requiring prior approval from
authorities for every action.
PRINCIPE 1 LAWFULLNESS Article 5.1 en 6 GDPR
Debunking GDPR Myths: One common misconception about the GDPR is that data
processing is only lawful if the data subject gives consent. However, this is not true.
Niet altijd toestemming nodig van data subject (is 1 grond van de 6)
6 LAWFUL GROUNDS for Lawful Processing: als er geen van deze 6 gronden
aanwezig is dan in strijd met GDPR!!!
1. Consent: The data subject explicitly agrees to the processing of their data (e.g.,
setting up an account or subscribing to a service)
A central principle of the GDPR is that data subjects (the individuals whose personal data
is being processed) should have control over their data. This means they not only have
the right to give consent for their data to be processed, but they also have the right to
withdraw consent at any time (je moet altijd terug kunnen intrekken)!
Data Controller’s Responsibility: If a data subject withdraws their consent, the
data controller (the organization processing the data) must stop processing that
individual’s personal data unless there is another lawful ground for processing
(e.g., performance of a contract, legal obligation).
Right to Control: The idea behind this right is to give individuals more control
over their personal data. If the individual no longer wishes to participate in a
service or have their data processed, they can revoke their consent, and the data
controller must comply.
Consent Given by Children = children under the age of 18 are generally seen as
legally incompetent to make binding decisions, including consent for data processing.
This raises a question of whether children can lawfully consent to their personal data
being processed, particularly in online environments.
BUT Article 8 of the GDPR allows children to consent to data processing when
they are over the age of 16. However, EU member states can set a lower age
limit, ranging from 13 to 16. For example:
In Belgium, the age is 13, meaning children over 13 can give consent
themselves dus onder 13 toestemming ouders nodig OF ANDERE LAWFULL
GROUND, controller moet ervoor zorgen dat effectief ouders zijn die consent
geven en niet kind zelf
In France, the age is 15.
In the Netherlands, the age is 16.
Parental Consent: If a child is under the set age in a country, the child’s parent or legal
guardian must give consent on the child’s behalf. The data controller is also required to
make reasonable efforts to verify that the person providing consent is indeed the
parent or guardian.
Verification Challenges: One common challenge with verifying parental consent is that
children can sometimes bypass age-gating mechanisms by falsifying their age. While
services might request parental email addresses or mobile phone verification, these
methods may not be foolproof.
, Potential Problems with Age-Gating: The GDPR requires data controllers to know
when they are processing a child’s data. However, many online services rely on self-
reported age (where users input their birth year), and research suggests that children can
easily manipulate this information to appear older than they are. This can complicate the
enforcement of the GDPR’s provisions on children’s consent.
Toestemming is maar geldig als aan 4 voorwaarden voldoet (controller moet bewijzen dat
toestemming geldig is gegeven)
- Must Be Freely Given (u niet verplicht voelen om toestemmen)
For consent to be valid, the data subject (i.e., the individual whose data is being
processed) must not feel pressured or coerced into giving consent. The choice must be
genuine, and the individual must be able to refuse consent without facing any harm or
negative consequences.
Example of Invalid Consent: The European Data Protection Board (EDPB) provides an
example involving a photo-editing app that asks users to consent to tracking their
location and using this data for behavioral advertising. If the user cannot use the app
without agreeing to these extra data uses (location tracking and advertising), then
consent is not considered freely given.
Power Imbalance: Consent might not be freely given when there is a power imbalance,
such as between an employer and employee or between a doctor and patient. For
instance, if an employer asks an employee to consent to being filmed in a workplace, the
employee might feel pressured to agree due to the employer’s authority. However, if
safeguards are in place (e.g., the employee can opt out without consequences), then the
consent might still be valid.
Case-by-Case Assessment: Each situation is assessed on its own, and extra safeguards
can help ensure that consent is freely given even when there is a power imbalance (e.g.,
allowing employees to choose not to be filmed without negative consequences).
- Consent Must Be Specific (ik moet weten waarvoor mijn data processed zal
worden) bv we gebruiken data om account te maken voor jou
Consent must be given for specific purposes, and cannot be broad or vague. For instance,
a company cannot ask for consent to process personal data for all future activities. The
data subject must clearly understand what their data will be used for.
Example of Specific Consent: If a TV provider asks for consent to use subscriber data
for providing movie recommendations, and later wants to use that data for personalized
advertising, the provider must ask for additional consent for this new purpose. The new
consent request must be specific to this additional purpose (personalized advertising) and
cannot be inferred from the original consent (movie recommendations).
Not Automatically Transferable: If data was originally consented for one purpose, the
controller cannot later use it for an unrelated purpose without obtaining new consent.
- Consent Must Be Informed (bepaalde info krijgen)
The data subject must be provided with all necessary information regarding the data
processing, including the purpose of the data processing, the type of data being
processed, and the rights of the data subject.
Example: When a service asks for consent, they should provide clear and easily
understandable information about how personal data will be processed, what the
potential risks are, and how the individual can exercise their rights (such as withdrawing
consent).
PRINCIPLES OF DATA PROTECTION
Demonstrating Compliance: The GDPR requires data controllers to show that they
comply with data protection principles, rather than requiring prior approval from
authorities for every action.
PRINCIPE 1 LAWFULLNESS Article 5.1 en 6 GDPR
Debunking GDPR Myths: One common misconception about the GDPR is that data
processing is only lawful if the data subject gives consent. However, this is not true.
Niet altijd toestemming nodig van data subject (is 1 grond van de 6)
6 LAWFUL GROUNDS for Lawful Processing: als er geen van deze 6 gronden
aanwezig is dan in strijd met GDPR!!!
1. Consent: The data subject explicitly agrees to the processing of their data (e.g.,
setting up an account or subscribing to a service)
A central principle of the GDPR is that data subjects (the individuals whose personal data
is being processed) should have control over their data. This means they not only have
the right to give consent for their data to be processed, but they also have the right to
withdraw consent at any time (je moet altijd terug kunnen intrekken)!
Data Controller’s Responsibility: If a data subject withdraws their consent, the
data controller (the organization processing the data) must stop processing that
individual’s personal data unless there is another lawful ground for processing
(e.g., performance of a contract, legal obligation).
Right to Control: The idea behind this right is to give individuals more control
over their personal data. If the individual no longer wishes to participate in a
service or have their data processed, they can revoke their consent, and the data
controller must comply.
Consent Given by Children = children under the age of 18 are generally seen as
legally incompetent to make binding decisions, including consent for data processing.
This raises a question of whether children can lawfully consent to their personal data
being processed, particularly in online environments.
BUT Article 8 of the GDPR allows children to consent to data processing when
they are over the age of 16. However, EU member states can set a lower age
limit, ranging from 13 to 16. For example:
In Belgium, the age is 13, meaning children over 13 can give consent
themselves dus onder 13 toestemming ouders nodig OF ANDERE LAWFULL
GROUND, controller moet ervoor zorgen dat effectief ouders zijn die consent
geven en niet kind zelf
In France, the age is 15.
In the Netherlands, the age is 16.
Parental Consent: If a child is under the set age in a country, the child’s parent or legal
guardian must give consent on the child’s behalf. The data controller is also required to
make reasonable efforts to verify that the person providing consent is indeed the
parent or guardian.
Verification Challenges: One common challenge with verifying parental consent is that
children can sometimes bypass age-gating mechanisms by falsifying their age. While
services might request parental email addresses or mobile phone verification, these
methods may not be foolproof.
, Potential Problems with Age-Gating: The GDPR requires data controllers to know
when they are processing a child’s data. However, many online services rely on self-
reported age (where users input their birth year), and research suggests that children can
easily manipulate this information to appear older than they are. This can complicate the
enforcement of the GDPR’s provisions on children’s consent.
Toestemming is maar geldig als aan 4 voorwaarden voldoet (controller moet bewijzen dat
toestemming geldig is gegeven)
- Must Be Freely Given (u niet verplicht voelen om toestemmen)
For consent to be valid, the data subject (i.e., the individual whose data is being
processed) must not feel pressured or coerced into giving consent. The choice must be
genuine, and the individual must be able to refuse consent without facing any harm or
negative consequences.
Example of Invalid Consent: The European Data Protection Board (EDPB) provides an
example involving a photo-editing app that asks users to consent to tracking their
location and using this data for behavioral advertising. If the user cannot use the app
without agreeing to these extra data uses (location tracking and advertising), then
consent is not considered freely given.
Power Imbalance: Consent might not be freely given when there is a power imbalance,
such as between an employer and employee or between a doctor and patient. For
instance, if an employer asks an employee to consent to being filmed in a workplace, the
employee might feel pressured to agree due to the employer’s authority. However, if
safeguards are in place (e.g., the employee can opt out without consequences), then the
consent might still be valid.
Case-by-Case Assessment: Each situation is assessed on its own, and extra safeguards
can help ensure that consent is freely given even when there is a power imbalance (e.g.,
allowing employees to choose not to be filmed without negative consequences).
- Consent Must Be Specific (ik moet weten waarvoor mijn data processed zal
worden) bv we gebruiken data om account te maken voor jou
Consent must be given for specific purposes, and cannot be broad or vague. For instance,
a company cannot ask for consent to process personal data for all future activities. The
data subject must clearly understand what their data will be used for.
Example of Specific Consent: If a TV provider asks for consent to use subscriber data
for providing movie recommendations, and later wants to use that data for personalized
advertising, the provider must ask for additional consent for this new purpose. The new
consent request must be specific to this additional purpose (personalized advertising) and
cannot be inferred from the original consent (movie recommendations).
Not Automatically Transferable: If data was originally consented for one purpose, the
controller cannot later use it for an unrelated purpose without obtaining new consent.
- Consent Must Be Informed (bepaalde info krijgen)
The data subject must be provided with all necessary information regarding the data
processing, including the purpose of the data processing, the type of data being
processed, and the rights of the data subject.
Example: When a service asks for consent, they should provide clear and easily
understandable information about how personal data will be processed, what the
potential risks are, and how the individual can exercise their rights (such as withdrawing
consent).
