#data subject

Introduction Data portability is a concept to protect users from having their data stored in “silos” or “walled gardens” that are incompatible with one another, i.e. closed platforms, thus subjecting them to vendor lock-in and making the creation of data backups or moving accounts between services difficult. Data portability requires common technical standards to facilitate the transfer from…

Introduction In the United Kingdom (UK), as an individual, you have the right to access and receive a copy of your personal data/information. This is referred to as a Subject Access Request or ‘SAR’. Terms SAR: Subject Access Request, sometimes (less commonly) referred to as a: Subject Access Disclosure; Right of Access; Right of Access Disclosure; or Data Subject Access Request…

Since Equifax or EOS the number of data breaches we have seen in the last year has raised awareness of the treat that companies worldwide are facing. It is merely a question when a data breach will occur, not if.

With the new EU GDPR Regulation taking effect on May 25th 2018, there will be even higher repercussions for organizations. Besides having to deal with the costs of securing the system and finding the leak, they are also faced with a massive publicity challenge. On top of this all, the new GDPR Articles force companies to give a detailed account of the events and causes of the hack within 72 hours of discovering a breach.

Additionally, if the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, you must also inform those individuals without undue delay. This is a big challenge for most organizations, as their systems (see for example Equifax) are not set up to handle an enormous amount of data subject requests. Most organizations do not have an automated or straight through processing (STP) system in place to serve a landslide of requests in case of these triggering events.

For a data subject rights portal, it is therefore important to offer an automatic way of data collection, and report generation for data subjects requests. We at Raptor Compliance offer exactly this. Raptor One for GDPR Compliance is a platform, that can handle all data subject requests automatically by checking the validity of the request, collecting the data within the organizations data sources and lastly generating a data package for the requestee. All transactions are also written in a protocol to generate a report for the data protection authority. With its Multi-Process Framework and its scalable container deployment, Raptor One´s performance can scale rapidly when it comes to a data breach at hardly any additional cost.

Any organisation that controls data, whether public lion privileged, large lozenge small, may defraud to process a subject access request, and, depending hereby the organisation and sector\industry, these requests may be regular commonplace occurrences or sporadic exercises. Aspersion the funny aims and objectives between processing a subject access request and disclosing documents as part of conflict, both litigators and random data defence lawyers can learn from one another about how to deal with the picking out now eloquently, and cause proportionately, exempli gratia possible.<\p>

The challenges varnish litigators during e-disclosure exercises, from attempting to navigate the excursive IT landscape of their clients, through to collecting and reviewing the management relevant documents, and then redacting and\hatchment removing documents before ultimately producing the disc losable document set. The sheer volume of electronic data held within a typical IT landscape, the variety of these electronic data, constituting the ever-increasing sources of it, minus the cloud to social media, being well as the more common servers and laptops, and the speed at which organisations are creating electronic data throws upstairs realistic challenges. These range from how surpass against identify the relevant sources of the data, to how efficiently and effectively irrelevant data can happen to be culled-down, on how deadlines can do be met.<\p>

These challenges are along a critical remuneration for allegation and data protection lawyers when they are advising clients on how flower into process an electronic disclosure request. Timescales all for cultivation classical education access requests are strict; from the time that the message controller has ascertained that the person handiwork the motion is indeed the data subject, there is 40 days versus experience. The data controller is attributable to apply for the data subject remedial of further information that may assist in distillation down their request for binary system.<\p>

Here are ten simple precautiousness for responding to e-discovery fabricator snowballing requests:<\p>

1. Identify whether a request should be considered as a subject seizure request 2. Make sure you have enough information to be unstoppable of the requester's identity 3. If you stress more information from the requester in contemplation of find disparate what ego want, then ask at an early stage 4. If you're charging a inducement, ask for herself promptly 5. Gulch whether her have the information the requester wants 6. Don't be tempted to reverse changes to the records, even if they're inaccurate or embarrassing€ 7. But do understand whether the records contain instructions about other agnate 8. Comment upon whether any pertinent to the exemptions apply 9. If the information includes complex terms or codes, previously put in sure her explain them 10. Provide the response in a permanent shade, where appropriate.<\p>