Data Processing Management

00:00

Welcome To. Less than four point to control data processing management.

00:07

In this video we will look at the control function category number two. Data processing management.

00:15

So in this category of the control function we're looking at data processing management and where this differs from the previous um

00:24

category Where we were looking at the data processing policies, processes and procedures um for how you're handling things internally. Uh This category to me really focuses on have the processes procedures for how an individual can request information from your company.

00:44

So you're looking at basically how you're managing data processing from the way you're protecting the individual's privacy.

00:53

So this is where you get into a lot of the data subject. Access requests that you could receive um from data elements can be access for review um their access for transmission or disclosure to others

01:07

as well as being access for alteration or deletion. Um Under the G. D. P. R. A data subject has the right to um basically view the data that you have on them and if they feel something's wrong have it altered or they can basically ask for you to delete their information.

01:25

So that's what you're looking at when you're looking at the subcategories of p. three and p. four.

01:30

And then as well as in the previous category we talked about the data lifecycle and part of that life cycle was data destruction. So here it's this is really your

01:42

making sure um in this one that you're following those policies, processes and procedures that you put into place and that's really what data processing management about that you've had. You have the written part in that first category. And now this is about managing and making sure that you're complying with the

02:00

policies, processes and procedures that you're putting in place

02:02

And that's where P5 comes in and that data lifecycle management that you're actually destroying according to your own policy

02:09

and that you're able to transmit that data and standardized formats. Um as well as that you have mechanisms for transmitting processing permissions and related that data values with data elements that that's established and in place and having audit log records um uh that they're documented implemented

02:29

um and that that is done in accordance with policy

02:31

and that you're actually incorporating data minimization. Uh The principle of data minimization because you want to make sure that you're only asking for data that you need before, you know, we really got into this realm of privacy. You know, the thought was collect all the information that you can. But now with a lot of the laws and regulations, it's really about data minimization and really only asking for personal data that's necessary for the purpose that you're trying to carry out.

03:00

You want to make sure also that technical measures are implemented to manage data process,

03:05

data processing and that you're basically testing those uh those technical measures and assessing them to make sure that they are working properly. Um because the last thing you want is for there to be a data breach or um an issue with the confidentiality

03:23

um or availability of data because there's an issue with the technical measures. So you want to make sure that you are continuously monitoring those technical measures that you have in place and then really ensuring that stakeholder privacy preferences are included in your algorithmic design objectives and outputs are evaluated against these preferences. Um Sometimes those stakeholders can be internal

03:44

um teams and sometimes they are external. Um you know, if you're

03:50

uh an app developer, your stakeholder, maybe the company that you're developing the app for, so if they have certain privacy preferences that they want set and whatever you're developing, you want to make sure that you are encompassing that in the design, because the last thing you want is to not have basically thought of that.

04:09

Um and then it becomes an issue basically, after you've completed the uh you know, the concept of the application at that point, um and you're showing it, it's

04:21

fine to have to go back at that point, but when you're ready to go into production, it's definitely going to be a different thought process to have to go back and look at. Um you know, did we incorporate that? So that is kind of where you get into privacy by design at a certain point, to make sure that you're having those discussions

04:39

if you're looking at something either from a manufacturing standpoint,

04:43

um you know, I worked for a medical device at one point and some of those devices were ingesting personal health information. So that was a thought of how are we making these devices so that that information is protected when it is basically ingested into the machine.

05:00

And it's the same thing with an app if you're a developer and you're working with your external customers, if they have other requirements, either from a legal or contractual standpoint that they have to be in compliance with, you want to make sure that you're including that.

05:15

So that's where data processing management is really looking sure that you're protecting the individual's privacy, um and basically managing those policies, processes and procedures that you've implemented around data processing from that first category.