Cyberwatching Information Notice Tool

Step1

* Value required to continue the assessment.

- I have read and understood the Privacy Policy *

- I have read and understood the Terms of use *

A - Company Name *

B - Email *

1 - Does the information notice contains who decides how the data subject’s personal data can be used and for which purposes?

2 - Does the information notice contains the identity and the contact details of the controller?

3 - If a DPO has been appointed, are its contact details provided in the information notice?

4 - Does the information notice contains how are the personal data processed, meaning for which purposes?

5 - Does the information notice contains which is the legal basis of the processing?

6 - If any processing is based on the legitimate interest of your organisation, does the information notice contains what does this legitimate interest involve?

7 - Does the information notice contains which personal data are processed? (i.e., name, contact details, official governmental documents, health data, etc.)

8 - Does the information notice contains with whom are the personal data shared, if any?

9 - Does the information notice contains if you intend to transfer the personal data outside the European Union? If yes, does it additionally include the appropriate safeguards on which the is transfer based?

10 - Does the information notice contains for how long are the personal data stored?

11 - Does the information notice contains the existence of automated decision-making used to make decisions based solely on automated processing (including profiling), which produces legal effects concerning the data subject or similarly significantly affects him / her?

Profiling is composed of three elements: 1) it has to be an automated form of processing; 2) it has to be carried out on personal data; 3) the objective of the profiling must be to evaluate personal aspects about a natural person.Art. 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, as last Revised and Adopted on 6 February 2018, p.6-7 An example of profiling may be a data broker collecting data from different public and private sources, on behalf of its clients or for its own purposes, with the purpose of compiling the data to develop profiles on the individuals in order to eventually place them into segments.
Solely automated decision-making has a different scope, in that it is the ability to make decisions by technological means, without human involvement. For example, giving out speeding fines purely on the basis of evidence gathered from speed cameras.
If you employ solely automated decision-making, including profiling, which produces legal effects concerning the data subject, or similarly significantly affecting him / her, then you must ensure to explain clearly and simply to individuals how the profiling or automated decision-making works. Art. 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, as last Revised and Adopted on 6 February 2018, p.16. In short: you must offer meaningful information about the logic involved.
If the processing involves profiling-based decision making, then it must be clarified to the data subject that the processing takes place for both purposes(a) profiling, and (b) making a decision based on the profile generated Art. 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, as last Revised and Adopted on 6 February 2018, p.16. .
Additionally, the data subject should be informed not only about a right to be informed about but also, in certain circumstances, a right to object to profiling, regardless of whether it is solely automated individual decision-making based on profiling takes place. Art. 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, as last Revised and Adopted on 6 February 2018, p.17.

12 - Are the user data further processed for a purpose other than that for which they were obtained?

13 - Where the personal data is collected from third-parties, or in another way other than directly from the data subject - is the source of collection of the personal data specified?

14 - Does the information notice contains the existence of the right to request from the controller access to and rectification, or erasure of personal data, or restriction of processing concerning the data subject, or to object to processing, as well as the right to data portability and the right to withdraw consent, where applicable?

15 - Is the information notice concise, transparent, intelligible and easily accessible?

16 - Is the information notice written in clear and plain language?

17 - Is the information notice provided free of charge?

Cancel