Article 5 of the GDPR contains the basic rules that all other rules build on. If you know them, you can often judge for yourself whether something is reasonable.
The six principles
- Lawfulness, fairness and transparency. There must be a lawful basis (lesson 3). The data must be processed fairly, and people must be told what is happening.
- Purpose limitation. The data must be collected for specified, explicit and legitimate purposes. It must not then be used in a way that is incompatible with the original purpose.
- Data minimisation. Collect only what is adequate, relevant and necessary. Ask yourself: do I really need this information?
- Accuracy. The data must be correct and up to date. Inaccurate data must be corrected or deleted without delay.
- Storage limitation. Do not keep data longer than needed. When the purpose has been fulfilled, the data must be deleted, anonymised or, if the law requires it, kept according to the law's rules.
- Integrity and confidentiality. The data must be protected against unauthorised access, loss and destruction. This requires technical and organisational measures.
Accountability
Under Article 5(2), the controller must be able to demonstrate that the principles are followed. So it is not enough to do the right thing. The organisation must also be able to document that it does, for example through procedures, records and training.
Examples from everyday work
- Purpose. A shop collects telephone numbers so that it can tell customers when an order is ready. The number may not simply be used for advertising.
- Minimisation. A web form for a newsletter subscription needs an e-mail address. It does not need a date of birth or a home address.
- Accuracy. A customer has moved and has said so. The address must then be changed everywhere it is used.
- Storage. Application documents from a recruitment that is finished should not stay around forever. The employer sets the retention periods, and you follow them.
- Security. A list of customer details should not be left open on a shared desktop or sent to the wrong recipient.
Data protection by design
Article 25 requires data protection by design and by default. This means that systems and procedures must be designed so that the principles are followed from the start. By default, only the data needed for each purpose is processed, and only the people who need it have access.
Your role
- Use data only for what the work requires.
- Do not take more with you than you need, and do not keep your own copies in private files.
- Correct errors you find, or tell the person responsible for the data.
- Follow retention rules and procedures. Ask if something is unclear.
- Keep the principles in mind even when something feels convenient: what is easy is not always lawful.
An example that shows all the principles
A colleague in the HR department receives a list of all employees' sick leave to plan staffing. The purpose is staffing, so the list must not be used to judge who is "ill too often" in a pay matter. She needs only the dates and the number of days, not diagnoses. The list must be accurate, protected by access rights and deleted when it is no longer needed. This is how the principles work together.