This new regulation is very focused on risk management. It raises two levels of security: the risk analysis and the impact evaluation. The type of analysis that each company must carry out will depend on the risks that may be involved in handling the information handled.
RISK ANALYSIS AND IMPACT EVALUATION
The new regulation requires that all companies, regardless of their size, focus on compliance with privacy from a risk perspective; To do this they must do a risk analysis and an impact evaluation.
According to the new regulations, risk analysis will be mandatory in all cases. However, the impact evaluation will only be necessary on certain occasions.
These differentiations can generate some confusion.
- The first phase: risk analysis
Risk analysis is the most used practice. This study starts from the description of all the treatment activities and the subsequent analysis of the whole process. With the data obtained, you will have the necessary information to establish, where appropriate, the appropriate security measures.
- Risks evaluation
The RGPD states in its article 35 in which cases a data protection impact assessment must be carried out, before starting the treatment.
This in-depth analysis should be done when there is a probability that a treatment of the information implies "a high risk for the rights and freedoms of natural persons". Normally, it will be special categories of data that include political, religious opinions, health-related data, etc.
TYPE OF RISKS
The main risks can be divided into two types:
- Risks associated with the protection of information.
- Risks related to compliance with the requirements that regulate the rights of the interested parties.
Regarding the protection of information, three levels of threats are usually identified: those that affect confidentiality, integrity and availability. The main problems are those that potentially affect the integrity of personal data, that is, its modification or alteration.
Situations related to confidentiality may also occur, generally with the unauthorized use of personal information. And finally there are the risks associated with availability, such as the loss or deletion of data.
Regarding the risks related to compliance with regulatory requirements, the most common problem that a company may have to face is that of not having the appropriate procedures to satisfy the rights of users.
Another risk of this type is the one that has to do with the absence of legitimacy for the treatment of the data, or that an illicit treatment of these is carried out.
Now you know better the modifications and the new demands that the New European Regulation of Protection of Data brings. There is no great reform, but the novelties have a great importance in practice.
Writings SF Lawyers
