 |
If you are trying to better understand all aspects of the GDPR (General Data Protection Regulation), you have probably realized that reading it from Article 1 to 99 is the fastest way to get a headache. The secret to making it simpler is understanding its structure. The GDPR is not a random list of rules, but a logical path divided into 11 Chapters.
📋 Guide Index
🔗 Do you like Techelopment? Check out the website for all the details!
📌 Chapter I: General Provisions (Arts. 1 - 4)
The "why" and "for whom" of the regulation.
- Art. 1 (Subject-matter and objectives): Protecting the personal data of natural persons and ensuring the free movement of this data within the EU.
- 💡 Example: Allowing a French hospital to access your medical records if you feel unwell while on vacation in Paris, while preventing a private company from buying that same data without your knowledge.
- Art. 2 & 3 (Scope of application): Applies to any automated processing (or structured paper records). It applies to EU companies, but also to non-EU companies that offer services or monitor the behavior of individuals in the EU (extraterritoriality principle).
- 💡 Example: Meta or TikTok (US/Chinese companies) must strictly comply with the GDPR when an Italian citizen signs up for their platforms from Europe.
- Art. 4 (Core definitions): The key terms to know by heart:
- Personal data: Any info that identifies a person (name, IP address, geolocation).
- 💡 Example: Even your car's license plate or your computer's IP address are personal data, because they allow someone to trace back to you.
- Processing: Any operation performed on data (collection, storage, deletion).
- 💡 Example: Even the simple action of a company entering your phone number into an Excel database is considered "processing".
- Controller (Data Controller): The one who decides why and how to process the data (the company).
- 💡 Example: Your bank. It is the entity that determines which data you must mandatory provide to open a checking account.
- Processor (Data Processor): The one who processes data on behalf of the controller (e.g., the cloud hosting service).
- 💡 Example: The external company that owns the physical servers used by the bank to store customer files.
📌 Chapter II: Principles (Arts. 5 - 11)
The commandments that anyone processing data must respect.
- Art. 5 (The 6 Principles of processing):
- Lawfulness, fairness, and transparency. (💡 Example: Do not hide how you will use the data inside small-print clauses).
- Purpose limitation (collect data only for a specific purpose). (💡 Example: If a photo editing app asks for access to your contact list, it is violating this principle).
- Data minimization (collect only what is strictly necessary). (💡 Example: An e-commerce website does not need to know your religious beliefs to ship you a pair of shoes).
- Accuracy (data must be kept up to date). (💡 Example: If a customer moves, the company must correct the address to avoid sending confidential invoices to the old tenant).
- Storage limitation (delete data when it is no longer needed). (💡 Example: A university cannot keep your bank account details for 30 years after you graduate).
- Integrity and confidentiality (cybersecurity). (💡 Example: Protecting company computers with strong passwords and encryption to prevent data theft).
Note: The article also introduces the principle of Accountability: the controller must be able to demonstrate compliance with these points.
- Art. 6 (Lawfulness of processing): You cannot process data "just because". One of these 6 conditions is required: Consent, Contract, Legal obligation, Vital interests, Public interest, Legitimate interest.
- 💡 Example: Shipping a package to your home is based on a Contract; issuing an invoice is based on a Legal obligation; sending promotional discounts to your phone requires your Consent.
- Arts. 7 - 10 (Consent and Special Categories of Data): Rules for children's consent (Art. 8) and a general prohibition (with exceptions) on processing sensitive data (Art. 9 - political orientation, religion, health data, biometrics) and judicial data (Art. 10).
- 💡 Example: An employer cannot ask which political party you vote for or if you suffer from a specific pathology, unless it is strictly necessary for mandatory company medical checkups.
📌 Chapter III: Rights of the Data Subject (Arts. 12 - 23)
The core of the GDPR: what can I, as a citizen, demand from companies?
- Arts. 13 & 14 (Information to be provided): The right to know who has my data and what they do with it (the privacy policy).
- 💡 Example: That clear and transparent document you read and sign when you join a gym or visit a new doctor.
- Art. 15 (Right of access): I can ask a company: "What data do you have on me? Spill the beans".
- 💡 Example: Sending an email to a social network asking to receive a file containing all the messages, Likes, and searches you have made since you opened the profile.
- Arts. 16 & 17 (Rectification and Erasure): I can correct wrong data or ask for its permanent deletion (Right to be Forgotten).
- 💡 Example: Asking Google to de-index (remove from search results) an old news article talking about a crime of which you were completely cleared ten years ago.
- Art. 18 & 21 (Restriction and Objection): I can ask to "freeze" my data while verifications are carried out or object at any time to the use of my data (such as direct marketing, for which the company must immediately cease processing for these purposes).
- 💡 Example: Clicking on the “Unsubscribe” link at the bottom of a commercial newsletter. The company must immediately stop writing to you for advertising purposes.
- Art. 20 (Data portability): I can request my data in a readable format (e.g., a .CSV file) to transfer it to a competitor (e.g., from one phone operator to another).
- 💡 Example: Asking your electricity supplier to give you your consumption history in a digital format to upload it to another supplier's website and compare rates.
- Art. 22 (Automated individual decision-making): I have the right not to be judged exclusively by an algorithm or an AI (automated profiling) without human intervention.
- 💡 Example: If you apply for a loan online and a software automatically rejects your application based on your profile, you can demand that the decision be reviewed by a real person.
📌 Chapter IV: Controller and Processor (Arts. 24 - 43)
Technical and practical obligations for businesses.
- Art. 25 (Privacy by Design & by Default): Data protection must be engineered before creating a software or service (Design), and the base settings must always be the most restrictive possible (Default).
- 💡 Example: When you download a new app, sharing your GPS location and the public visibility of your profile must be deactivated "by default". You will be the one to activate them if you want to.
- Art. 30 (Records of processing activities): The "logbook" where the company writes down what data it has, why, and where it stores it. Mandatory for over 250 employees (or under, if the processing is risky).
- 💡 Example: An internal company document where everything is mapped out: "We process employee data (names, IBANs) to pay salaries, we store them on server X, and only the Human Resources office can access them".
- Arts. 32, 33 & 34 (Security and Data Breach): Appropriate security measures (Art. 32): Pseudonymisation and Encryption, Confidentiality, Integrity, Availability and Resilience, Disaster Recovery (timely restoration), Regular testing and evaluation. In case of a hacker attack or data loss (Data Breach), the controller must notify the Supervisory Authority within 72 hours (Art. 33) and, if the risk is high, also the users (Art. 34).
- 💡 Example: If an hotel's servers are breached and customers' credit cards are stolen, the hotel has 3 days to report it to the authority and must notify the affected customers via email so they can block their cards.
- Art. 35 (DPIA - Data Protection Impact Assessment): A mandatory risk analysis before launching highly invasive processing operations (e.g., mass video surveillance).
- 💡 Example: A Municipality wants to install cameras equipped with facial recognition across the city. Before doing so, it must draft a DPIA to understand the impact on the freedom of passersby.
- Arts. 37 - 39 (The DPO - Data Protection Officer): An independent figure, mandatory in Public Authorities and in companies that monitor data on a large scale, who acts as a consultant and a bridge with the Supervisory Authority.
- 💡 Example: In a large hospital, the DPO is the expert doctors turn to if they have a doubt (e.g., "Can we send this medical report to the patient via WhatsApp?") and is the one who monitors compliance with the rules.
📌 Chapter V: Transfers of Personal Data to Third Countries (Arts. 44 - 50)
What happens if data leaves Europe?
Data of EU citizens can be transferred abroad only if the third country guarantees adequate protections. The main tools are:
- Adequacy decisions (Art. 45): The EU Commission declares that a country (e.g., Canada) is safe.
- 💡 Example: The EU establishes that Switzerland has privacy laws just as strong as ours. An Italian company can therefore send data to Switzerland without having to request special permissions.
- Appropriate safeguards (Art. 46): Standard Contractual Clauses (SCC) signed between companies.
- 💡 Example: If an Italian company uses marketing software with servers in the US, it must sign a contract containing these special clauses to oblige the American company to process the data according to European standards.
📌 The "Institutional" Chapters (Chapters VI - XI)
This is the administrative and bureaucratic part. Less focused on data and more on how the authorities operate.
- Chapter VI (Arts. 51 - 59) - Independent supervisory authorities: Establishes national Privacy Authorities (in Italy, the Garante per la protezione dei dati personali).
- 💡 Example: The Privacy Guarantor's office in Rome, which receives reports from citizens, carries out inspections in companies, and decides on sanctions.
- Chapter VII (Arts. 60 - 76) - Cooperation and consistency: Regulates the "One-Stop-Shop" mechanism and creates the EDPB (European Data Protection Board), the committee that brings together all EU Guarantors to ensure the law is applied the same way everywhere.
- 💡 Example: If a social network with legal headquarters in Ireland commits a violation that affects Italian users, the Italian and Irish Guarantors collaborate to issue a single sanction valid for the entire Union.
- Chapter VIII (Arts. 77 - 84) - Remedies, liability and penalties: The right to lodge a complaint with a supervisory authority (Art. 77) and the famous administrative fines (Art. 83), which can reach up to 20 million euros or 4% of the company's total worldwide annual turnover.
- 💡 Example: The massive fines of hundreds of millions of euros inflicted over the years on web giants for tracking users' advertising cookies without valid consent.
- Chapters IX, X, XI (Arts. 85 - 99) - Provisions relating to specific processing situations and final provisions: Regulate the relationship between privacy and freedom of expression (journalism), access to public documents, and implementation rules.
💡 Pro Tip
Do not try to remember the numbers of all 99 articles. Focus on the "Big Ones": Art. 5 (Principles), Art. 6 (Lawfulness), Art. 9 (Special categories of data), Art. 17 (Right to be forgotten), Art. 25 (Design/Default), Art. 32/33 (Security and Data Breach), and Art. 37 (DPO). If you have these clear, you hold 80% of the GDPR in your hands!
Follow me #techelopment
Official site: www.techelopment.it
facebook: Techelopment
instagram: @techelopment
X: techelopment
Bluesky: @techelopment
telegram: @techelopment_channel
whatsapp: Techelopment
youtube: @techelopment
