Bid exclusion risks in Public Procurement

Transcript:Bid exclusion risks in Public Procurement:
Bid exclusion risks in Public Procurement Procedures With focus on Competition and new Data Protection rules related breaches 11 APRIL 2017 Public Procurement & the New Data Protection Regime: Roger Bickerstaff April 2017 page 3 Agenda What's new in the GDPR? Managing personal data submitted by bidders in tender processes How should data breaches by bidders be taken into account in procurement processes? Privacy as a Selection Criteria "Privacy by Design" as an award criteria? Rules on the Export of Data Concluding thoughts What is New in the General Data Protection Regulation? page 5 What's new in the GDPR? Expansion of definition of "personal data" GDPR: an identifiable natural person is one who can be identified, directly or indirectly through "all the means reasonably likely to be used" (Recital 26), in particular by reference to: an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; NB. Case c-582/14 0 CJEU ruled that dynamic IP addresses may constitute ‘personal data’ page 6 What's new in the GDPR(2)? Privacy by Design and Privacy by Default Data controllers must implement appropriate technical and organisational measures both when the means is decided upon and at the time of the processing itself in order to ensure data protection principles such as data minimisation are met. This may include, for example, pseudonymisation or other privacy-enhancing technologies. Pseudonymous data New concept of 'pseudonymisation' - privacy enhancing technique: information allowing data to be attributed to a particular individual is held separately and subject to technical and organisational measures to ensure non-attribution. Pseudonymous data is still a form of personal data - its use is encouraged by the GDP. page 7 What's new in the GDPR(3)? Explicit or unambiguous consent? All consents given by a data subject must be unambiguous All consents to process sensitive personal data must be explicit All consents must be specific, informed and active Silence or inactivity is not sufficient Consent must be freely given and individuals must be able to withdraw consent page 8 What's new in the GDPR(4)? Accountability, Impact Assessment and DPOs Accountability: Organisations must be able to demonstrate compliance with data protection principles, including, where proportionate, through adoption of policies and codes of conduct Privacy Impact Assessments: Needed where new technologies involve a high privacy