Data Protection

Obligations
1
Learning Outcomes

• List the different data protection obligations

• Explain the different data protection obligations
• Explain the need for accountability
• List the different data protection principles

2
 Introduction

With the increase in cybercrimes, it has becomes evident that there

is a need to protect personal data, which is a powerful source of
information.
Thus, a set of obligations were created for the organisations to
implement in order to maintain a standard amongst organisations
that collect, use or disclose personal data of individuals.

3
 Individual’s Autonomy over
Collection of Personal Data Care of Personal Data
Personal Data

4
 Individual’s Autonomy over
Collection of Personal Data Care of Personal Data
Personal Data

7
NOTIFICATION OBLIGATION

Notify individuals of the purposes for collecting, using and disclosing

their personal data.

Individuals are aware of what personal data they are providing and
how their personal data will be used.

9
 NOTIFICATION OBLIGATION

When should
How to notify? What to take note of?
organisation notify?

On or before • No specific manner The notification

collecting, use or or form should be:
disclosure • Can be via Data • Easy to understand
Protection Policy
• Highlight purpose
• Can be physical
of special concern
document or any
or unexpected
other manner
10
 Individual’s Autonomy over
Collection of Personal Data Care of Personal Data
Personal Data

11
CONSENT OBLIGATION

Collect, use or disclose personal data for purposes which individuals

have given consent to.
Also allow them to withdraw their consent with reasonable notice.

Gives individual more control over the personal data they are
providing, and allows them to withdraw consent should they wish to.

13
 CONSENT OBLIGATION
To get consent…
Individual has to be notified
of the purpose
Consent becomes invalid if…
Consent was gather via
unethical method
Is deemed to have When withdrawing… 14
consented via…
• Organisation must not
• By conduct prohibit individual from
withdrawing
• By contractual necessity
• Organisation must inform
• By notification individual of consequences
Possible without consent if…
• Emergency
• Legitimate interest
• Business improvement
• Research
• Publicly available
 Individual’s Autonomy over
Collection of Personal Data Care of Personal Data
Personal Data

15
PURPOSE LIMITATION OBLIGATION

Collect, use or disclose personal data for purposes that a reasonable

person would consider appropriate under given circumstances, and
for which the individual has given consent to.

Ensures that the personal data are not misuse for unreasonable
purpose without individual’s knowledge.

17
PURPOSE LIMITATION OBLIGATION

Organisation may collect, use, or

disclose personal data…
• Only for purposes that a reasonable person would
consider appropriate in the circumstances
AND
• For purposes that the individual has been
informed of by the organisation (in accordance
with Notification Obligation)

18
 Individual’s Autonomy over
Collection of Personal Data Care of Personal Data
Personal Data

19