circl / compliance Goto Github PK

https://github.com/CIRCL/compliance/blob/master/gdpr/workshop-materials/02-DS_CIRCL_2016-LU-IA-0098_slide_workshop_data_science_2018.05_v1.3.pdf

on page 4 lists "Not legal person" as a requirement to be a data subject. This should obviously be "Legal person"

Good stuff, thanks.

A couple of things that strengthen your argument. First, the Legitimate Interests basis allows you to include the Interests of third parties, too, so if you plan to notify organisations or individuals about leaks of their information then that strengthens the argument for processing the personal data in the first place. See, for example, p.28 of Article 29 Opinion 06/2014 on Legitimate Interests and section 4.1.1 of my paper on Incident Response and the GDPR

There's also an argument, I think, that planning to notify individuals (either directly or via relevant third parties) of leaks supports the Article 14 (qualified) requirement to notify. Again that should make the argument in favour of processing stronger.

Andrew