Cyberwatching Information Notice Tool

Step1

* Value required to continue the assessment.

- I have read and understood the Privacy Policy *

- I have read and understood the Terms of use *

A - Company Name *

B - Email *

1 - Does the information notice specify who decides how the data subject’s personal data can be used and for which purposes?

2 - Does the information notice indicate the identity and the contact details of the controller?

3 - Does the information notice provide the contact details of the DPO, if one has been appointed,?

4 - Does the information notice explain how the personal data are processed, meaning for which purposes?

5 - Does the information notice include the legal basis of the processing?

6 - If any processing is based on the legitimate interest of your organisation, does the information notice explain what this legitimate interest involve?

It is recommended to integrate the information notice with this information, essential according to Article 13 (1) (d) and Article 14 (2) (b) GDPR. It is important to note that where you choose to utilise the legal basis of legitimate interest, then the specific legitimate interest pursued must be explained to the data subject – this includes a description of the reason for this legitimate interest.Art. 13 (1) (d) and Art. 14 (2) (b) General Data Protection Regulation.
According to the Article 29 Working Party an interest is the interest or benefit that the controller gets (or the society too) as a result of the processing. The decision to rely on legitimate interest as a legal basis must be the result of a proper evaluation of a) whether the company has a legitimate interest, b) whether the processing is necessary for that specific legitimate interest and c) whether the legitimate interest overrides the interests and rights of the data subject. As you may have noticed, you need to carry out a balancing test between the legitimate interest of your organization and the interests and fundamental righst of the data subjects involved. In addition, the interest must be “real” and “present”, meaning that it must correspond with the current activities of your organization, or, at least, the expected benefits should be realized in the very near future. Therefore, the interest must be specific and should not be assumed. It is important to explain the legitimate interest to the data subject because the nature of a company’s interest can vary (for example, the legitimate interest to carry out scientific research is completely different from the economic interest of an organization to learn as much as possible about its potential customers so that it can create more successful targeted advertisement about its products and or services [Article 29 Data Protection Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, p.23, available here.].
After having carried out the necessary assessments which resulted to the use of legitimate interest as a legal basis for the processing it is crucial to inform your data subjects about it in a clear and user-friendly manner. This way the data subjects will be enabled to exercise their rights.
You can also use the lawful basis interactive tool produced by the Information Commissioner’s Office (ICO). It is a useful interactive tool to receive tailored guidance on which lawful basis is likely to be the most appropriate for your processing activities. This tool will result to a rating for each lawful basis based on the answers to key questions, accompanied by suggestions on the actions you should take.

7 - Does the information notice indicate which personal data are processed? (i.e., name, contact details, official governmental documents, health data, etc.)

8 - Does the information notice indicate with whom are the personal data are shared, if any?

9 - Does the information indicate if your organisation intends to transfer the personal data outside the European Economic Area? If you do transfer personal data, does it additionally include the appropriate transfer tools and safeguards on which the is transfer based?

Please keep in mind that it is necessary to specify the safeguard the transfer is based on, for example, whether you rely on an adequacy decision, Standard Contractual Clauses, Codes of Conduct, etc.
Furthermore, please consider that due to Brexit if your organisation is based in the UK and offers goods or services to EU citizens, then your organisation would be considered as a company that transfers personal data in the EU. On June 28th 2021 the United Kingdom received an adequacy decision from the European Commission which means that if your organisation transfers personal data outside the European Economic Area (EEA) to the United Kingdom you must specify that the transfer tool you rely on is the adequacy decision [Commission Implementing Decision of 28.6.2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom, available here]. Also, keep in mind that remote access from a third country or cloud storage in a cloud situated outside the EEA is also considered a transfer [European Data Protection Board Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 – Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, 23 July 2020, FAQ nr. 11.]. Lastly, also note that due to the Schrems II ruling issued on July 2020 there are additional steps that must be taken when transfers take place.

Identify your transfers;
Identify the transfer tool you rely on;
Is the tool effective in the place of destination;
If the tool is not effective, supplementary safeguards must identified;
The above safeguards must be put in place (organisational, contractual, technical measures);
A regular re-evaluation of the level of protection should be carried out.

If you would like to check your compliance with the GDPR or receive more detailed recommendations on the topic of transfers, you can take the assessment of the GDPR Temperature Tool and specifically Question 9.

It is recommended to integrate the information notice with this information, essential according to Article 13 (1) (f) and Article 14 (1) (f) GDPR. If you intend to transfer personal data outside the European Union, this needs to be clearly disclosed to the data subject. It is especially important to further explain the existence of the safeguards implemented in order for the transfers to legally take place – safeguards may include: an adequacy decision by the Commission, or binding corporate rules, standard contractual data protection clauses adopted by the Commission, an approved code of conduct, or an approved certification mechanism [Article 13 (1) (f), Art. 14 (1) (f) and Art. 46 (2) (b), (c), (d), (e), (f) General Data Protection Regulation.].
Please keep in mind that it is necessary to specify the safeguard the transfer is based on, for example, whether you rely on an adequacy decision, Standard Contractual Clauses, Codes of Conduct, etc.
Furthermore, please consider that due to Brexit if your organisation is based in the UK and offers goods or services to EU citizens, then your organisation would be considered as a company that transfers personal data in the EU. On June 28th 2021 the United Kingdom received an adequacy decision from the European Commission which means that if your organisation transfers personal data outside the European Economic Area (EEA) to the United Kingdom you must specify that the transfer tool you rely on is the adequacy decision [Commission Implementing Decision of 28.6.2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom, available here]. Also, keep in mind that remote access from a third country or cloud storage in a cloud situated outside the EEA is also considered a transfer [European Data Protection Board Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 – Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, 23 July 2020, FAQ nr. 11.]. Lastly, also note that due to the Schrems II ruling issued on July 2020 there are additional steps that must be taken when transfers take place.

Identify your transfers;
Identify the transfer tool you rely on;
Is the tool effective in the place of destination;
If the tool is not effective, supplementary safeguards must identified;
The above safeguards must be put in place (organisational, contractual, technical measures);
A regular re-evaluation of the level of protection should be carried out.

10 - Does the information notice indicate for how long the personal data are stored?

11 - Does the information notice explain the existence of automated decision-making used to make decisions based solely on automated processing (including profiling), which produces legal effects concerning the data subject or similarly significantly affects him / her?

Good job! Remember to explain clearly and simply to individuals how the profiling or automated decision-making works. In short: you must check whether your explanation offers meaningful information about the logic involved. If your processing involves profiling-based decision making, then it must be clarified to the data subject that the processing takes place for both purposes (a) profiling, and (b) making a decision based on the profile generated.
Additionally, the data subject should be informed not only about a right to be informed about but also, in certain circumstances, a right to object to profiling, regardless of whether it is solely automated individual decision-making based on profiling takes place.
You must provide information about intended or future processing, and how the automated decision-making might affect the data subject – the significant and the envisaged data protection consequences [Art. 13 (2) (f), Art. 14 (2) (g) General Data Protection Regulation.]. In order for this information to be understandable by any data subject, it must be accompanied with examples of the type of possible effects. Taking the example given by the Working Party 29 in the Guidelines on Automated individual decision-making and Profiling: an insurance company uses an automated decision-making process to set motor insurance premiums based on monitoring customers’ driving behaviour. It provides an app comparing fictional drivers (including ones with dangerous habits) in order to illustrate the significant and envisaged consequences of the automated-decision processing they would like to use. The Guidelines on Automated individual decision-making and Profiling further advice that other visual techniques may be used to explain how a paste decision has been made, that way the data subject can clearly conceive the consequences.

As a controller, you may carry out profiling and automated decision-making so long as you respect all the principles and have a proper legal basis for the processing. Please make sure that you have also carried out a Data Protection Impact Assessment, since automated decision-making activities may often lead to high risks for the data subjects. Carrying out a DPIA will both enable you to assess the risks of the processing activity, as well as demonstrate that you have put in place appropriate measures to address those risks.
If you would like to check your compliance with the GDPR or receive more detailed recommendations on the topic of transfers, you can take the assessment of the GDPR Temperature Tool and specifically Question 8.

It is recommended to integrate the information notice with this information, essential according to Article 13 (2) (f) and Article 14 (2) (g) GDPR.
The GDPR stipulates that the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her[Art. 22 (1) GDPR.]. Therefore, if you plan to conduct any automated individual decision-making (that produces legal effects to the data subject), the only way to do so is if the decision:

is necessary for entering into, or performance of, a contract between the data subject and a data controller; or
is authorised by European or Member State law to which the controller is subject to and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
• is based on the data subject's explicit consent[Art. 22 (2) GDPR.]

Profiling is composed of three elements: 1) it has to be an automated form of processing; 2) it has to be carried out on personal data; 3) the objective of the profiling must be to evaluate personal aspects about a natural person. An example of profiling may be a data broker collecting data from different public and private sources, on behalf of its clients or for its own purposes, with the purpose of compiling the data to develop profiles on the individuals in order to eventually place them into segments.
Solely automated decision-making has a different scope, in that it is the ability to make decisions by technological means, without human involvement. For example, giving out speeding fines purely on the basis of evidence gathered from speed cameras.
If you employ solely automated decision-making, including profiling, which produces legal effects concerning the data subject, or similarly significantly affecting him / her, then you must ensure to explain clearly and simply to individuals how the profiling or automated decision-making works. In short: you must offer meaningful information about the logic involved.
If the processing involves profiling-based decision making, then it must be clarified to the data subject that the processing takes place for both purposes (a) profiling, and (b) making a decision based on the profile generated.
Additionally, the data subject should be informed not only about a right to be informed about but also, in certain circumstances, a right to object to profiling, regardless of whether it is solely automated individual decision-making based on profiling takes place. As a controller, you may carry out profiling and automated decision-making so long as you respect all the principles and have a proper legal basis for the processing. Please make sure that you have also carried out a Data Protection Impact Assessment, since automated decision-making activities may often lead to high risks for the data subjects. Carrying out a DPIA will both enable you to assess the risks of the processing activity, as well as demonstrate that you have put in place appropriate measures to address those risks.
If you would like to check your compliance with the GDPR or receive more detailed recommendations on the topic of transfers, you can take the assessment of the GDPR Temperature Tool and specifically Question 8.

12 - Does the information notice explain whether the data are further processed for a purpose other than that for which they were obtained?

13 - If the personal data is collected from third-parties, or in another way other than directly from the data subject - is the source of collection of the personal data specified in the information notice?

14 - Does the information notice mention the existence of the right to request from the controller access to and rectification, or erasure of personal data, or restriction of processing concerning the data subject, or to object to processing, as well as the right to data portability and the right to withdraw consent, where applicable?

15 - Is the information notice concise, transparent, intelligible and easily accessible?

16 - Is the information notice written in clear and plain language?

17 - Is the information notice provided free of charge?

Cancel