gdpr affects your data protection in may 2018

ive been watching gdpr for a while now

https://www.theregister.co.uk/2017/04/07/gdpr_people_not_process_your_worst_nightmare/

Let's start with customer consent to data processing. The GDPR goes some way beyond current legal requirements by abolishing "implicit" and opt-out consent.

In future, data subjects will be able to withdraw consent at any time: and it should be as easy to withdraw consent as to grant it. No more will companies be able to recruit online, then rebuff objectors, by demanding they write in via snail mail.

Consent must be freely given, which will not be the case where there is imbalance of power between data controller and subject. This could be bad news for public authorities who presently process much data on the basis that if it is done for the public good, then that is good enough.

An upgrading of biometric data to "sensitive" status means explicit consent for processing may now be required before processing a customer's image or voice data. Most significant of all, profiling of customers – the automated processing of personal data to evaluate certain personal aspects relating to a natural person – cannot take place without some human input.


https://www.theregister.co.uk/2017/04/07/gdpr_people_not_process_your_worst_nightmare/

We may be leaving the EU, but some EU law – with significant consequences for the IT community – will carry on. One such is the General Data Protection Regulation (GDPR).

We signed up to it before the referendum, agreed to persist with it after and, if businesses wish to continue to process data belonging to EU firms, as well as avoid some potentially eye-watering fines, they need to be compliant with the GDPR no later than May 2018.

gdpr even effects the nhs as well

https://www.theregister.co.uk/2017/05/23/commvault_nhs_gdpr_opportunity/

http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN

1.  Personal data shall be: accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)

And that includes inaccurate reports sent to the DWP by Maximus or Atos HCPs