The objective of this module is to gain an overview of the ethics surrounding big data and the legislation that governs it. Upon completion of this module you will: - Gain knowledge on how to recognize the necessity of regulating big data - Obtain an understanding of the difference between privacy and data protection - Understand the need to implement data protection actions into your own business

1. This programme has been funded with
support from the European Commission
Module 4:
Legislation

2. DATA SET SKILLS FOR BUSINESS
Module 4:
Legislation
The objective of this module is to gain an overview of the ethics
surrounding big data and the legislation that governs it.
Upon completion of this module you will:
- Gain knowledge on how to recognize the necessity of regulating big
data
- Obtain an understanding of the difference between privacy and data
protection
- Understand the need to implement data protection actions into your
own business
Duration of the module: approximately 1 – 2 hours

3. DATA SET SKILLS FOR BUSINESS
How about Ethics
Legislation
GDPR
Legal Glossary
1
2
3
4
 Ethics of big data
 Aspects of big data ethics
 Privacy vs Data Protection
 Basics of GDPR
 Individual Rights
 GDPR implementation

4. HOW ABOUT ETHICS?
1. Ethics of Big Data
2. Aspects of Big Data Ethics

5. With the increase of computing power,
electronic devices and accessibility to the
Internet, more data than ever is being
produced, collected and transmitted.
Nowadays Big Data is big enough to raise
practical, rather than merely theoretical
concerns about ethics. Big data itself, like
all technology, is ethically neutral.
The use of big data, however, is not.

6. DATA SET SKILLS FOR BUSINESS
ETHICS OF BIG DATA
Collecting and analysing big data has become a powerful way to unlock
actionable insights across any business, but it also brings with it some
concerns about big data ethics that need to be addressed.
Because accessing and storing data is so easy, some organizations
collect everything and keep it forever. It is not just the large
governmental agencies collecting data like this, many major grocery
store chains, investment banks and even the postal services have
a predictive analytics function with the sole purpose of collecting and
analyzing data in order to predict buyer behavior.
QUESTIONS FOR STUDENTS
What if all this data collection takes a negative turn?
“Data can be either
useful or perfectly
anonymous but never
both”
Paul Ohm

7. Aspects Of Big Data Ethics
Big data is already outpacing our ability to understand its
implications. Businesses are innovating every day, and the pace
of big-data growth is practically immeasurable. To provide a
framework for dissecting the often nuanced and interrelated
aspects of big data ethics, the following key components can
help untangle the situation.
Identity Privacy
Ownership Reputation

8. AGE FRIENDLY ECONOMY | FUTURE OPPORTUNITIES FOR SMES
“Is online existence identical to offline existence?”
If our historical understanding of what identity means is being
transformed by big-data technologies, then understanding
our values around the concept itself enhances and expands
our ability to determine appropriate and inappropriate
action.
Big data provides others the ability to quite easily summarize,
aggregate, or correlate various aspects of our identity—
without our participation or agreement.
If big data is evolving the meaning of the concept of identity
itself, then big data is also evolving our ethical relationship to
the concept the word represents.
Identity Privacy
Ownership Reputation

9. AGE FRIENDLY ECONOMY | FUTURE OPPORTUNITIES FOR SMES
“Who should control access to data about you?”
Plenty of people would argue that we have gained a degree of control over how
the world perceives us e.g. Victims of abuse or people who suffer from the same
disease can share their experiences and gain an invaluable sense of connection and
community through the use of anonymous online identities.
But, have we lost or gained control over our ability to manage how the world
perceives us?
There are two issues.
Why do we expect the ability to self-select and control which facts we share with
the world online to be the same as it is offline? The difference between online and
offline expectations regarding the degree of control individuals have over open
access to data about themselves is a deeply ethical inquiry.
The goal is to understand how to balance the benefits of big-data innovations
with the risks inherent in sharing more information more widely.
• Second, should individuals have a
legitimate ability to control data about
themselves, and to what degree?
• First, does privacy mean the same
thing in both online and offline in the
real world?
Identity Privacy
Ownership Reputation

10. AGE FRIENDLY ECONOMY | FUTURE OPPORTUNITIES FOR SMES
Identity Privacy
Ownership Reputation
The degree of ownership we hold over specific information about us
varies as widely as the distinction between privacy rights and privacy
interests.
Does the information about our family history, genetic
makeup, and physical description, preference for Coke or
Pepsi, or ability to shoot free throws on the basketball court
constitute property that we own?
As open data markets grow in size and complexity, open government
data becomes increasingly abundant, and companies generate more
revenue from the use of personal data, the question of who owns
what—and at what point in the data trail—will become a more vocal
debate.
“What does it mean to own data about ourselves?”

11. AGE FRIENDLY ECONOMY | FUTURE OPPORTUNITIES FOR SMES
Identity Privacy
Ownership Reputation
One of the biggest changes born from big data is that now the
number of people who can form an opinion about what kind of
person you are is exponentially larger and farther removed
than it was even a few short years ago. And further, your ability
to manage or maintain your online reputation is growing farther
and farther out of individual control. There are entire companies
now whose entire business model is centered on “reputation
management”. We simply don’t know how our historical
understanding of how to manage our reputation translates to
digital behavior.
At a minimum, this is sufficient reason alone to suggest further
inquiry.
“How can we determine what is trustworthy?”

12. “Privacy on the
internet? That‘s an
oxymoron”
Catherine Butler
LEGISLATION
1. Privacy vs. Data Protection

13. Most users have been unaware of the
volume of personal data retained by
entities for various purposes. This is
beginning to change as awareness of
the data privacy debate is increasing.
The two trends—increasing
popularity of big data and
increasing awareness of data
privacy—are beginning to come to a
head and companies that intend to
capitalize on this era of big data need to
be conscious about and address these
basic ethical concerns.

14. PRIVACY DATA
PROTECTION
vs.
Is there any difference?
YES

15. PRIVACY DATA
PROTECTION
vs.
Is there any difference?
YES
• Privacy relates to the appropriate use
and control of data
• Data privacy protocols around the world
address the control people have over
their personal data and how they can
protect it from unwanted or harmful
uses
• It covers issues such as: what type of
data will be processed, where will it be
held, how long will it be held for
• Privacy applies whenever the data is:
- Collected
- Processed
- StoredWhich relates to a living individual
person who can be identified by that data.
• Data protection relates to the
confidentiality, availability and
integrity of data
• It focuses on two main areas –
the physical security of premises
and the logical security of data
and digitized information
• It covers issues such as: the
confidentiality, integrity and
availability of data, the
protection of networks, the
physical security of sites,
equipment, transport and
people

16. Data privacy, also called
information privacy, is the
aspect of information
technology that deals with
the ability an organization
or individual has to
determine what data in a
computer system can be
shared with third parties.
PRIVACY

17. PRIVACY
EU data protection rules mean that your personal data can only be processed
in certain situations and under certain conditions, such as:
– if you've given your consent (you must be informed that your data is being collected)
– if data processing is needed for a contract, for a job application or a loan request
– if there is a legal obligation for your data to be processed
– if processing is in your 'vital interest’, e.g. doctor needs access to your private medical
data
– if processing is needed to carry out tasks in the public interest or tasks carried out by
government, tax authorities, the police or other public bodies
Personal data about your racial or ethnic origin, sexual orientation, political
opinions, religious or philosophical beliefs, trade-union membership or health may not
be processed except in specific cases (e.g. when you've given explicit consent or when
processing is needed for reasons of substantial public interest, on the basis of EU or
national law). These rules apply to both public and private bodies.
Collection and processing of personal data

18. Data protection is the
process of safeguarding important
information from corruption,
compromise or loss. The
importance of data protection
increases as the amount of data
created and stored continues
to grow at unprecedented
rates.
Data Protection

19. ...is data which relates to a living individual who can be
identified:
from that data, or
from that data and other information which is in the
possession of the data controller,
And includes any expression of opinion about the individual
and any indication of the intentions of the data controller or
any other person in respect of the individual.
•...is PII data, consisting of Information as to:
•the racial or ethnic origin of the data subject,
•his political opinions,
•his religious beliefs or other beliefs of a similar nature,
•whether he is a member of a trade union,
•his physical or mental health or condition,
•his sexual life,
•the commission or alleged commission by him of any
offence.
Sensitive Personal Information
PII
Personally Identifiable Information
SPI
Data protection applies whenever we deal
with 2 types of information:
Data Protection

20. It is no exaggeration to say that we are
nothing more than a collection of data
to most of the institutions—and many
of the people—with whom we deal.
Big data poses enormous challenges
for data protection— both by
processors and regulators. It
simultaneously changes the context
and raises the stakes for Data
protection.

21. Impact: Credit/debit card information and/or contact
information of up to 110 million people compromised.
Details: The breach of Target costumers began before
Thanksgiving, but was not discovered until several weeks later.
The retail giant initially announced that hackers had gained
access through a third-party HVAC vender to its point-of-sale
(POS) payment card readers, and had collected about 40 million
credit and debit card numbers.cc
Impact: 145 million users compromised
Details: The online auction giant eBay reported a cyber
attack in May 2014 that it said exposed names, addresses,
dates of birth and encrypted passwords of all of its 145
million users. The company said hackers got into the
company network using the credentials of three corporate
employees, and had complete inside access for 229 days,
during which time they were able to make their way to the
user database.
Impact: 3 billion user accounts
Details: In September 2013 Yahoo announced it had been
the victim of the biggest data breach in history, likely by “a
state-sponsored actor,” in 2014. The attack compromised
the real names, email addresses, dates of birth and
telephone numbers of 500 million users. The company said
the "vast majority" of the passwords involved had been
hashed using the robust bcrypt algorithm.
With an increasing number of data breaches splashed across front
page news, companies have good reason to take security seriously

22. GDPR
1. The Basics of GDPR
2. Individual rights
3. Implementation of GDPR
As we were approaching this Big Data industrial
revolution, the laws governing its protection had
reached a point where they were a bit like an old
operating system. In need of an update or they
would have become unfit for purpose. Each
country, concerned about citizens’ personal data,
big data analytics and security, was attempting to
come up with its own legislation to control data. In
the European Union companies have to follow the
GDPR legislation.

23. General Data Protection
Regulation (GDPR) is a
single set of legislation
across Europe that gives
individuals get better
control of their personal
data.
GDPR
What is the
GDPR?
Why was
the GDPR
drafted?
When will
the GDPR
apply?
Who does
the GDPR
apply to?
When can I
process data
under the
GDPR?
What are
the
consequenc
es of not
acting by
GDPR?
THE BASICS OF GDPR

24. The EU's General Data Protection Regulation (GDPR) is the
result of four years of work by the EU to bring data protection
legislation into line with new, previously unforeseen ways that
data is now used.
Currently, the UK relies on the Data Protection Act 1998,
which was enacted following the 1995 EU Data Protection
Directive, but this will be superseded by the new legislation. It
introduces tougher fines for non-compliance and breaches,
and gives people more say over what companies can do with
their data. It also makes data protection rules more or less
identical throughout the EU.
GDPR
What is
the
GDPR?
Why was
the GDPR
drafted?
When will
the GDPR
apply?
Who does
the GDPR
apply to?
When can
I process
data under
the GDPR?
What are
the
consequen
ces of not
acting by
GDPR?

25. Firstly, the EU wants to give people
more control over how their personal
data is used
By strengthening data protection
legislation and introducing tougher
enforcement measures, the EU hopes
to improve trust in the emerging
digital economy.
Secondly, the EU wants to give
businesses a simpler, clearer legal
environment in which to operate,
making data protection law identical
throughout the single market.
The GDPR will apply automatically in all EU
member states from 25 May 2018.
While the overwhelming majority of IT
security professionals are aware of GDPR,
just under half of them are preparing for its
arrival, according to a snap survey of 170
cyber security staff by Imperva. Just 43%
are assessing GDPR's impact on their
company and changing their practices to
stay in step with data protection
legislation, Imperva found.
GDPR
What is
the
GDPR? Why was
the GDPR
drafted?
When will the
GDPR apply?
Who does
the GDPR
apply to?
When can
I process
data under
the GDPR?
What are
the
consequen
ces of not
acting by
GDPR?

26. 'Controllers' and 'processors' of data need to abide by the
GDPR.
A data controller states how and why personal data is
processed, e.g. government, while a processor is the party
doing the actual processing of the data, e.g. IT firm.
Even if controllers and processors are based outside the EU,
the GDPR will still apply to them so long as they're dealing
with data belonging to EU residents.
It's the controller's responsibility to ensure their processor
abides by data protection law and processors must
themselves abide by rules to maintain records of their
processing activities. If processors are involved in a data
breach, they are far more liable under GDPR than they were
under the Data Protection Act.
GDPR
What is
the
GDPR? Why was
the GDPR
drafted?
When will
the GDPR
apply?
Who does the
GDPR apply
to?
When can
I process
data under
the GDPR?
What are
the
consequen
ces of not
acting by
GDPR?

27. Once the legislation comes into effect, controllers must
ensure personal data is processed lawfully, transparently, and
for a specific purpose. Once that purpose is fulfilled and the
data is no longer required, it should be deleted.
Penalties for violation of record keeping, security, breach
notifications and privacy impact assessment are greater of
$10 million or 2% of entity‘s global gross revenue.
Penalties for violations olegal justification for processing
(consent), data subject rights and cross-border data transfers
are greater of $20 million or 4% of entity‘s global gross
revenue.
GDPR
What is
the
GDPR? Why was
the GDPR
drafted?
When will
the GDPR
apply?
Who does
the GDPR
apply to?
When can I
process data
under the
GDPR?
What are the
consequences
of not acting
by GDPR?

28. DATA SET SKILLS FOR BUSINESS
Why not take BREAK and READ
Article 2 in the Resource
Section:
Guide to General Data Protection
Regulations (GDPR)

29. AGE FRIENDLY ECONOMY | FUTURE OPPORTUNITIES FOR SMES
INDIVIDUAL RIGHTS
A key part of the regulation requires consent to be given by the
individual whose data is held.
Organisations will need to be able to show how and when
consent was obtained. This consent does not need to be explicitly
given, it can be implied by the person‘s relationship with the
company.
However, the data obtained must be for specific, explicit and
legitimate purposes.
Individuals must be able to withdraw consent at any time and
have a right to be forgotten; if their data is no longer required for
the reasons for which it was collected, it must be erased.

30. The right to be informed
- The right to be informed
encompasses your obligation
to provide ‘fair processing
information’,
typically through a privacy
notice.
- It emphasizes the need for
transparency over how you
use personal data
The right of access
- Individuals have the right
to access their personal
data and supplementary
information.
- The right of access allows
individuals to be aware of
and verify the lawfulness
of the processing.
The right to rectification
- The GDPR gives individuals
the right to have personal data
rectified.
- Personal data can be
rectified if it is inaccurate or
incomplete.
The right to erase
- The right to erasure is also known
as ‘the right to be forgotten’.
- The broad principle underpinning
this right is to enable an individual
to request the deletion or
removal of personal data where
there is no compelling reason for
its continued processing.
The right to restrict
processing
- Individuals have a right to ‘block’ or
suppress processing of personal data.
- When processing is restricted, you are
permitted to store the personal data, but
not further process
it.
- You can retain just enough information
about the individual to ensure that the
restriction is respected
in future.
The right to data
portability
- The right to data portability
allows individuals to obtain and
reuse their personal data for their
own
purposes across different services.
- It allows them to move, copy or
transfer personal data easily from
one IT environment to another in
a safe and secure way, without
hindrance to usability.
The right to object
The right to object
Data Protection gives people the
right to object to the use of their
personal information in certain
circumstances.
You have the right to object to
your data being used for direct
marketing.
Rights in relation to
automated decision
making and profiling
- The GDPR has provisions on:
automated individual decision-making
(making a decision solely by automated
means without any
human involvement);and
profiling (automated processing of
personal data to evaluate certain things
about an individual).
- Profiling can be part of an automated
decision-making process.

31. AWARENESS
INFORMATION
YOU HOLD
COMMUNICATI
NG PRIVACY
INFORMATION
INDIVIDUAL
RIGHTS
SUBJECT ACCESS
REQUESTS
LAWFUL BASIS
FOR
PROCESSING
PERSONAL DATA
CONSENT CHILDREN
DATA BREACHES
DATA
PROTECTION
OFFICERS
INTERNATIONAL
GDPR IMPLEMENTATION
Companies are required to implement appropriate technical and organisational measures in
relation to nature, scope, context and purposes of their handling and rocessing of personal data.
Data protection safeguards must be designed into products and services from the earliest stages
of development.
12 steps you can make in your company to implementate GDPR
1 2 3 4
5 6 7 8
9 11 12

32. DATA SET SKILLS FOR BUSINESS
Why not take a BREAK and READ
Article 2 in the Resource Section:
Big Data: A Survey
-Min Chen

33. AWARENESS1
You should make sure that decision makers
and key people in your organization are
aware of GDPR and they appreciate the.
Implementing the GDPR could have
significant resource implications, especially
for larger and more complex organizations.
You may find compliance difficult if you leave
your preparations until the last minute.

34. INFORMATION YOU HOLD2
You should document what personal data you hold,
where it came from
and who you share it with. GDPR requires you to
maintain records of your processing activities.
You can’t confirm that data is correct or that your
organisation is in compliance unless you know what
personal data you hold, where it came from and who
you share it with. You should document this. Doing
this will also help you to comply with the GDPR’s
accountability principle, which requires organisations
to be able to show how they comply with the data
protection principles, for example by having effective
policies and procedures in place.

35. COMMUNICATING PRIVACY
INFORMATION
3
You should review your current privacy notices
and put a plan in place for making any
necessary changes in time for GDPR
implementation. Currently when collecting
data you must give people certain information,
e.g. identity and intended use.
This is usually done through a privacy notice.
There will now be additional requirements.

36. 4 INDIVIDUAL RIGHTS
Check your procedures to ensure they cover all the
rights individuals have.
The GDPR includes the following rights for individuals:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability;
- the right to object; and
- the right not to be subject to automated decision-
making including
profiling.

37. 5 SUBJECT ACCESS REQUEST
You should update your procedures and plan how you will
handle requests to take account of the new rules:
- In most cases you will not be able to charge for
complying with a request.
- You will have a month to comply, not the current 40
days.
- You can refuse or charge for requests that are manifestly
unfounded or excessive.
- If you refuse a request, you must tell the individual why
and that
they have the right to complain to the supervisory
authority and to
a judicial remedy.
You must do this without undue delay and at the latest,
within one month.

38. LAWFUL BASIS FOR PROCESSING
PERSONAL DATA
6
You should identify the lawful basis for your
processing activity in GDPR and update your
privacy notice to explain it.
Under the GDPR some individuals’ rights will be
modified depending on your lawful basis for
processing their personal data.
The most obvious example is that people will have
a stronger right to have their data deleted where
you use consent as your lawful basis for
processing. You will also have to explain your
lawful basis for processing personal data in your
privacy notice and when you answer a subject
access request.

39. CONSENT7
You should review how you seek, record
and manage consent and whether you
need to make any changes. Refresh existing
consents now if they don’t meet the GDPR
standard.
You should read the guidance the ICO has
published on consent under the GDPR, and
use our consent checklist to review your
practices. Consent must be freely given,
specific, informed and unambiguous.

40. 8 CHILDREN
Do you need to put systems in place to verify
individuals’ ages? Or obtain parental consent.
GDPR will bring in special protection for children’s
personal data, particularly in the context of
commercial internet services such as social
networking.
The GDPR sets the age when a child can give their
own consent to this processing at 16 If a child is
younger then you will need to get consent from a
person holding ‘parental responsibility’. This could
have significant implications if your organisation
offers online services to children and collects their
personal data.

41. 9 DATA BREACHES
You should make sure you have the right procedures in
place to detect, report and investigate a personal data
breach.
GDPR introduces a duty on all organisations to report
certain types of data breach to the ICO, and in some
cases, to individuals
You should put procedures in place to effectively detect,
report and
investigate a personal data breach.
You may wish to assess the types of personal data you
hold and document where you would be required to
notify the ICO or affected individuals if a breach occurred.
Larger organisations will need to develop policies and
procedures for managing data breaches. Failure to report
a breach when required to do so could result in a fine, as
well as a fine for the breach itself.

42. DATA PROTECTION OFFICERS
You should designate someone to take responsibility for
data protection compliance.
You may need to designate a DPO
It is most important that someone in your organisation,
or an external data protection advisor, takes proper
responsibility for your data protection compliance and
has the knowledge, support and authority to carry out
their role effectively.
10

43. DATA PROTECTION OFFICERS
You should consider whether you are required to
formally designate a Data Protection Officer (DPO). You
must designate a DPO if you are:
-a public authority (except for courts acting in their
judicial
capacity);
- an organisation that carries out the regular and
systematic
monitoring of individuals on a large scale; or
- an organisation that carries out the large scale
processing of special categories of data, such as health
records, or information about criminal convictions. The
Article 29 Working Party has produced guidance for
organisations on the designation, position and tasks of
DPOs.
10

44. INTERNATIONAL11
If your organisation operates in more than one EU
member state, you should determine your lead
data protection supervisory authority and
document this.
The lead authority is the supervisory authority in
the state where your main establishment is. Your
main establishment is the location where your
central administration in the EU is or else the
location where decisions about the purposes and
means of processing are taken and implemented.

45. No matter what volumes of data
they’re dealing with, it’s crucial for
businesses to get a good handle on
where their data is, how it’s stored
and who has access to it.
The GDPR comes at a time when
customer expectations have never
been higher over the privacy of
their data. Putting the power back
into the hands of customers can
only serve the businesses who rely
on them, helping to build a far
more positive relationship and
engender consumer trust.

46. LEGAL GLOSSARY
PERSONAL DATA
Any information relating to a person who can be identified,
directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, online
identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social
identity of that person.
CONTROLLERS
Owners of the data, who are responsible for data protection and
make sure processors are compliant.
PROCESSORS
Work with the data and have to take responsible actions with
the data. The relationship between Controllers and Processor
must be documented.
PROFILING
Any automated processing of personal data to determine
certain criteria about a person.
BREACH AND NOTIFICATION
A breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorised disclosure of, or
access to, personal data transmitted, stored or otherwise
processed.
DATA SUBJECT ACCESS REQUESTS
The right of the individual to understand what is stored and
how it is used.
DATA PROTECTION OFFICERS
Public Authorities who have expert knowledge on data
protection laws. They deal with a large scale processing of
special types of personal data.

47. DATA SET SKILLS FOR BUSINESS
FINISH by WATCHING Video 1
in the Resource Section:
Digital ethics and the future of humans in
a connected world
-Gerd Leonhard (Ted X talk)

48. Thank-You
https://www.data-set.eu/
DATA SET SKILLS FOR BUSINESS