• Nederlands
    • English

The GDPR – How Do You Handle Personal Data?

20220513_0128

What does GDPR stand for?

General Data Protection Regulation, a law that came into effect throughout Europe in May 2018. The European designation of this regulation is General Data Protection Regulation (GDPR). All organizations and companies active in Europe must comply with this regulation.

What is the GDPR about?

The GDPR ensures compliance with five privacy rights of citizens. These rights relate to the protection of citizens’ personal data and the ability of citizens to determine what happens with their data.

These rights are:

  1. Right to information – what does an organization do with your data?
  2. Right of access – which personal data has an organization stored?
  3. Right to rectification – changing personal data
  4. Right to be forgotten – having personal data deleted
  5. Right to data portability – transferring information to another organization
  6. Right to object – objecting to the processing of personal data

OK, but what exactly are PERSONAL DATA?

Personal data

This concerns data that can be directly or indirectly traced back to a person. This includes, for example:

  • Name and address details – name, address and city. Nowadays, the address is often an email address. These data may generally be stored, as they are not very high-risk. Sharing this data with other organizations is not permitted. Note: work phone numbers and work emails are easy to use and share, as they are often available online. However, in the volunteer sector, private phone numbers and private email addresses are often used, which is much more personal.
  • Additionally, there are special categories of data, such as country of origin, language proficiency, health, physical/psychological/social conditions, religion/philosophy of life, political preference, sexual orientation, criminal records. You cannot simply store, process or share this data; you need legal consent for that. Note: a photo of someone wearing glasses is already an example of medical data!
  • BSN number (citizen service number) – a number used in contact with the government. It is not a special category of data, but… you are not allowed to store or use it!
  • What about the VOG (Certificate of Good Conduct)? A VOG is a personal document and may not be copied and stored by third parties. The only thing you can register is the number on the top of the document. This is also the reference number if you want to verify information. The same applies to a passport or driver’s license.

When are you allowed to store and process personal data?

Legal bases:

  • Consent
  • Contract
  • Legal obligation
  • Public interest
  • Vital interests
  • Legitimate interest

Legitimate interest can, for example, be used for taking photos at an activity. Taking photos of people that reveal which country they come from or what physical disability they have constitutes special category data and cannot simply be stored and processed. In such cases, you must be able to explain why you want to take the photos and what interest you have in doing so. For example, to promote your organization. In this video on YouTube, it is clearly explained.

For a detailed explanation of the legal bases on which you may store personal data, visit the website of the Dutch Data Protection Authority.

By anonymizing personal data, you can store and process more information; because if the data cannot be traced back to individuals, the risk in case of a data breach is minimal.

Is the personal data stored securely?

  • Pay attention to what personal data your organization stores on the computer, on your organization’s network or on paper!
  • It is then important to ensure that this data is also secure. Who has access? Is there proper security with a password? Are folders with personnel files stored in a locked cabinet?

What is a privacy statement?

A privacy statement is a document that describes how personal data is handled within the organization. What data do you store, how do you store it and for how long? This document is public and must be accessible for people to view. The privacy statement is a document that must be tailored to your organization. In this document you will find 14 questions that can help you get started.

What is a data breach and where should you report it?

A data breach involves unauthorized or unintended access to personal data. But also the unwanted destruction, loss, alteration and disclosure of personal data. This can also cause harm to the individuals involved.

A data breach must be reported to the Dutch Data Protection Authority, which has established a reporting protocol that guides you clearly and straightforwardly.

Also read the 5 tips: how to prevent a data breach.

GDPR Step-by-Step Plan

In our toolkit for organizations, you will find a GDPR step-by-step plan, GDPR in 7 Steps.

Other useful links and websites

 

 




Newsletter

Subscribe

Sign up for the VCA newsletter to stay informed about new volunteer opportunities and program updates.