3. Data Protection Principles and Safeguards

When we speak of data protection, we should not speak in terms of absolute rights. Instead we should speak in terms of rights and obligations that are acknowledged to and imposed on several parties. There is no data ownership and it is not only about informed consent. It is about rights and obligations for both data subjects and data controllers. That idea is also reflected in the structure of the GDPR.

GDPR outlines seven principles. Instead of outlining them all individually, we'll provide a concise summary focusing on five key principles in our video. These principles should be applied in order to collect and process data with respect for the data subjects and their rights.

In the video and below we explain 5 Principles of Data Protection. The principles for data protection are to be found in chapter 2 of the GDPR. The GDPR is structured as following:

• Data should be collected for specific, well-defined purposes, clearly communicated to the data subjects.
• Collecting data without a defined purpose is not permitted under the GDPR.
• Legal bases, outlined in Article 6 of the GDPR, must justify data processing activities.
• Legal bases must be chosen based on the situation and may include options beyond informed consent.

Article 6 of the GDPR:

• Only necessary data should be collected for the defined purpose.
• Data should be retained only for as long as necessary to achieve the defined purpose.
• Anonymisation or pseudonymisation should be applied when identifiers are no longer needed.

• Data controllers should communicate transparently about data processing activities to data subjects and relevant authorities.
• Communication should be personalized, understandable, and not limited to publishing project lists on websites.

• A maximum storage duration should be specified for personal data.
• Storage duration may be determined through periodic reviews rather than fixed timeframes.
• Compliance with sector-specific laws regarding storage duration should be considered.

• Data controllers are responsible for implementing and maintaining technical and organizational security measures.
• Technical measures include encryption, authentication, and automatic screen locking.
• Organizational measures encompass policies, contracts, confidentiality requirements, and awareness campaigns.
• Collaboration among various departments within an organization is crucial for effective security measures.