(5% - .05 hours of coursework)

The candidate will be expected to define the wider scope and jurisdiction of the GDPR, its relationship to the UK Data Protection Bill 2017 (DPB) and other overlapping new or emerging legislation including the following:

1. 1.1 Wider scope of the GDPR – EU Directive 2016/679

2. 1.2 Main establishment and when EU representation is needed

3. 1.3 Cooperation between supervisory authorities (concept of the one-stop shop)

4. 1.4 UK Data Protection Bill 2017 (implementing the GDPR in the UK) structure and status

5. 1.5 EU Directive 2016/680 The Law Enforcement Directive (LED)

6. 1.6 The Digital Economy Act 2017

7. 1.7 The Directive on Security of Network and Information Systems (NIS Directive) ((EU) 2016/1148)

8. 1.8 Telecommunications Directive 97/66/EC, Privacy and Electronic Communications Directive 20002/58/EC, and anticipated revisions (ePrivacy Regulation 2017/0003 (COD)

9. NB The candidate will be expected to summarise the above legal instruments and how they relate to or influence the requirements of the GDPR. Candidates are not expected to have a detailed knowledge of their provisions.

(5% - 0.5 hours of coursework)

The objective is to ensure that the candidate is able to distinguish the important definitions in the GDPR where the terminology is new or differs from previous data protection legislation, including:

1. 2.1 Special category personal data

2. 2.2 Main establishment

3. 2.3 Data minimisation

4. 2.4 Data Protection Officer

5. 2.5 Data Protection Impact Assessment

6. 2.6 Codes of Conduct (Codes of Practice in DPB)

7. 2.7 Transparency

8. 2.8 Profiling

9. 2.9 Consent

10. 2.10 Child’s consent in relation to information society services

11. 2.11 Competent authority in relation to the LED

(5% - .05 hours of coursework)

The objective is to ensure that the candidate can identify how the enhancements to the data protection principles established in the GDPR (Article 5) differ from the UK Data Protection Act 1998 principles, i.e. the 6 principles detailed within Article 5(1) and the accountability requirement from Article 5(2). The candidate will be expected to explain the importance of data processing, specifically:

1. 3.1 Transparency requirements in relation to being ‘fair and lawful’

2. 3.2 Explicit and compatible in relation to ‘specified purposes’

3. 3.3 Limited to what is ‘accurate and relevant’

4. 3.4 Pseudonymisation in relation to ‘retention’

5. NB The candidate will also be expected to also explain the importance of data controllers and processors being accountable for compliance with data processing principles.

(5% - .05 hours of coursework)

The objective is to ensure that the candidate recognises that the GDPR introduces new special categories of personal data and separates the processing of personal data relating to criminal convictions and alleged criminal offences, specifically:

1. 4.1 Genetic and biometric data

2. 4.2 Processing personal information relating to crime as a ‘competent authority’

3. 4.3 Processing criminal records and alleged offences information in the employment context

(14% - 1.5 hours of coursework)

The objective is to ensure that the candidate can identify the lawful conditions (grounds) that must be satisfied in order to legitimise the processing of personal data including:

1. 5.1 Conditions for consent (Article 7, Recitals 32, 42, 43)

2. 5.2 Consent of a child in relation to information society services (Article 8)

3. 5.3 Special categories of personal data (Article 9 and 10)

4. 5.4 Obligations of professional secrecy

5. 5.5 Processing that does not require identification (Article 11)

(14% - 1.5 hours of coursework)

The objective is to ensure the candidate is able to identify data subject rights granted under the GDPR, how they relate to the fundamental data processing principles and how they are applied in practice:

1. 6.1 Confirmation of processing (Article 12)

2. 6.2 Right to be informed (transparency), including of further processing (Article 12, 13 and 14)

3. 6.3 Right of access to personal data (Article 15), including timescales

4. 6.4 Right to rectification (Article 16)

5. 6.5 Right to erasure (to be forgotten) (Article 17)

6. 6.6 Right to restriction of processing (Article 18)

7. 6.7 Obligation to notify the rectification, erasure or restriction to recipients and the data subject (Article 19)

8. 6.8 Right to portability (Article 20)

9. 6.9 Right to object and rights in relation to direct marketing (Article 21)

10. - Consent rules and the proposed alignment of Privacy In Electronic Communications Regulations (PECR)

11. 6.10 Rights in relation to automated decision making and profiling (Article 22)

12. 6.11 Right to lodge a complaint (Article 77)

13. 6.12 Right to effective judicial remedy (Article 78 and 79)

14. 6.13 Right to compensation including non-material damage (Article 82)

(9% - 1 hour of coursework)

The candidate will be required to identify the obligations that are placed upon data controllers and processors under the GDPR, including:

1. 7.1 General obligations of a controller and processor (Article 5(2))

2. 7.2 Data controller/data processor and joint controller relationships (Article 5(2))

3. 7.3 Accountability and governance (Article 5(2))

4. 7.4 Controller specific obligations (Article 24)

5. - Joint controller obligations (Article 26)

6. - Data protection by design and by default (Article 25)

7. 7.5 Processor specific obligations (Article 28)

8. - Records of processing activities (Article 30)

9. 7.6 Information security (Article 32)

10. 7.7 Data breach notification (Articles 33 and 34)

11. - To the Supervisory Authority including when to notify to the data subject

12. - Overlap with the NIS Directive in relation to breach reporting

13. 7.8 Data protection impact assessment (Article 35)

14. 7.9 Co-operation with the Supervisory Authority (Article 31) and consultation on high-risk processing (Article 36)

15. 7.10 Data Protection Officer appointment (Article 37 to 39)

16. 7.11 Status and use of Codes of Conduct (Article 40)

(5% - 0.5 hours of coursework)

The candidate will be required to identify the:

1. 8.1 General principles for transfers

2. 8.2 Transfers on the basis of an adequacy decision by the EU, including Privacy Shield

3. 8.3 Transfers subject to appropriate safeguards

4. - Contract clauses

5. - Binding Corporate Rules

6. 8.4 Exemptions for specific situations

(5% - 0.5 hours of coursework)

The objective is to ensure the candidate can define the Supervisory Authority’s powers to:

1. 9.1 Impose monetary penalties

2. 9.2 Issue enforcement notices

3. 9.3 Require controllers or processors to provide information

(33% - 4 hours of coursework)

The objective is to ensure that the Practitioner level candidates understand the practical application of the new requirements of the GDPR and the Data Protection Bill where it varies from the GDPR. Specifically, the candidate will be expected to be able to apply the following requirements to a range of scenarios:

1. 10.1 The role of the Data Protection Officer (DPO)

2. 10.2 Restrictions of data subject rights

3. 10.3 Data protection by design and by default

   1. - How to perform a data protection impact assessment (DPIA)

4. - Implications for information technology teams

5. - Evaluation and management of third party contracts (Article 29)

6. 10.4 Personal data breach notifications

7. NB To assist the candidate, the workshop will include a range of practical exercises with classroom feedback.