Spreadsheets

[vetran]

Using Excel is not in itself a GDPR breach. It should however be subject to a DPIA and the risks managed (and they should have moved away from this over the summer when they had breathing space).

Sharing data without any limitation, security or logging is though. How can you do that with a spreadsheet ? This isn't market research about chocolate bars!

Tips to keep your company GDPR compliant while working from home

Recital 83 essentially stipulates that personal data must be protected both in transit and at rest. Data is in transit pretty much any time someone accesses it. The data passing from this website’s servers to your device is one example of data in transit. On the other hand, data a rest refers to data in storage, like on your device’s hard drive or a USB flash drive.
The two keys to maintaining data protection when your teams are all working remotely are encryption and controlling access.

You should revisit who in your company has access to sensitive data. Employees should only have regular access to the data they need to complete their daily tasks. Limiting the amount of data each individual can access mitigates the damage one employee’s security lapse can cause.

This should have been a web tool properly secured with 2fa and logging. You should see you next 3 contacts and a button to press to make a call no access to any information they don't need.

Wait for the first celeb's number to be released after a test.

[Old Greg]

I don't remember giving consent for my data to be shared, when I did a covid test back in July, so I think they are actually breaching GDPR guidelines (which will cease after Dec 31st anyway)

Consent is not necessary.

[Old Greg]

Sharing data without any limitation, security or logging is though. How can you do that with a spreadsheet ? This isn't market research about chocolate bars!

Tips to keep your company GDPR compliant while working from home





This should have been a web tool properly secured with 2fa and logging. You should see you next 3 contacts and a button to press to make a call no access to any information they don't need.

Wait for the first celeb's number to be released after a test.

Absolutely there are risks, but these risks can be managed (password protection etc.) The risks were probably acceptable in the early stages, but as I said, this should have been sorted out over the summer.

Also, I expect that Excel was used for Export from lab systems and import into Public Health systems, with limited access to the Excel files.

[vetran]

Consent is not necessary.

Because?

[vetran]

Absolutely there are risks, but these risks can be managed (password protection etc.) The risks were probably acceptable in the early stages, but as I said, this should have been sorted out over the summer.

Also, I expect that Excel was used for Export from lab systems and import into Public Health systems, with limited access to the Excel files.

hmm

How to Remove, Crack, or Break a Forgotten Excel XLS Password

I agree its probably part of the transfer process as well so whichever idiot designed that needs a P45. CSV/XML is the best for such things.

[Old Greg]

Because?

It is not a prerequisite data processing under GDPR. Article 9 gives numerous circumstances where consent is not needed.



1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.






2. Paragraph 1 shall not apply if one of the following applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
=> Article: 22
=> Dossier: Consent, Opening Clause, Permission, Purpose (Binding)
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
=> Dossier: Data Protection Guarantee, Opening Clause
(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
=> Dossier: Consent, Permission
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
=> Dossier: Permission, Data Protection Guarantee, Consent, Disclosure
(e) processing relates to personal data which are manifestly made public by the data subject;
=> Dossier: Permission, Publication Of Personal Data
(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
=> Dossier: Permission
(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
=> Article: 22
=> Dossier: Opening Clause
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
=> Dossier: Opening Clause
(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
=> Dossier: Professional secrecy, Opening Clause
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

[SueEllen]

Because?

Data protection, GDPR and screening - PHE Screening

Have a good read...

[Old Greg]

hmm

How to Remove, Crack, or Break a Forgotten Excel XLS Password

I agree its probably part of the transfer process as well so whichever idiot designed that needs a P45. CSV/XML is the best for such things.

Having worked around this in the early stages of Covid in a different jurisdiction, I have a great deal of sympathy for anyone who decided on Excel with a password on a secure server to get off the ground. This was at the point when parts of Spain and Italy appeared to be on the point of meltdown.

It is the failure to migrate which should see P45s issued.

[vetran]

It is not a prerequisite data processing under GDPR. Article 9 gives numerous circumstances where consent is not needed.



1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.






2. Paragraph 1 shall not apply if one of the following applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
=> Article: 22
=> Dossier: Consent, Opening Clause, Permission, Purpose (Binding)
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
=> Dossier: Data Protection Guarantee, Opening Clause
(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
=> Dossier: Consent, Permission
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
=> Dossier: Permission, Data Protection Guarantee, Consent, Disclosure
(e) processing relates to personal data which are manifestly made public by the data subject;
=> Dossier: Permission, Publication Of Personal Data
(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
=> Dossier: Permission
(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
=> Article: 22
=> Dossier: Opening Clause
(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
=> Dossier: Opening Clause
(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
=> Dossier: Professional secrecy, Opening Clause
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

I know why they have an exemption as above, now how long will that be acceptable if they spaff all the information to the publc?

[vetran]

Data protection, GDPR and screening - PHE Screening

Have a good read...

yep, I already know just wanted it from the experts.