Data Privacy and Information Law
Roles, Bases and Transfers
Privacy analysis starts with role. A controller determines purposes and means; a processor acts only on documented instructions. A processor that starts deciding purposes becomes a controller and inherits full accountability. Joint controllers share responsibility. Personal data is broad - names, IDs, IP addresses, location, HR records and pseudonymised data all qualify; only truly anonymous data falls outside scope.
Under GDPR-style regimes, processing needs a lawful basis: consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent is one basis, never mandatory - and public authorities cannot rely on legitimate interests for their public tasks. Layer on principles: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and accountability.
Accountability is documentary: records of processing, data protection impact assessments for high-risk processing, processor contracts with mandatory clauses, breach notification (typically 72 hours to the regulator where risk exists), and privacy by design.
International transfers need a mechanism - adequacy decision, standard contractual clauses, or binding corporate rules - plus a transfer risk assessment. US state laws add sale/share opt-outs and access rights; sectoral rules (health, financial) sit alongside.
Traps: assuming consent is always required; treating pseudonymised data as anonymous; forgetting employee and applicant data; and letting a vendor set retention or subcontracting terms without approval.
Rule of thumb: for each data flow, record role, basis, retention, recipients, transfer mechanism and the right that could be exercised over it.