The rules of data protection provide prominent and significant restrictions on the collection, storage and use of certain special categories of personal data, over and above the protections for ordinary personal data.
The failure by organisations to correctly use such “special category personal data” – which include information about people’s health, sexual orientation, sex life, race, religion, ethnic origin, trade union membership and biometrics (including face recognition and fingerprints) – is the reason behind over 70% of the ICO’s annual fines.
Compliance with the law on special category personal data requires data protection professions to thoroughly understand certain key factors. Attend this one-day training course to gain a practical and detailed knowledge of:
- the exact definition of special category personal data, including what types of information about people clearly fall within the definition, what types of information are never within the definition, and what types of information and processing are in the grey areas of the definition (and what to do about it)
- the precise ambit of the main conditions – including explicit consent, vital interests and employment – that justify and permit organisations to collect and use special category personal data
- an overview of the ambit of the remaining conditions, known as the ‘substantial public interest conditions’, including the additional protections that must be put in place as regards those conditions
- how data collection notices and privacy policies should be amended where an organisation processes special category personal data
- how to word explicit consent provisions for opt-in devices
- when a data protection impact assessment must be carried out prior to the processing of special category personal data
- how to implement a system to ensure compliance
This session includes real-world exercises and case studies that enable delegates to understand the practical application of data protection law to this complex area of compliance.
It is recommended that delegates attending this session have a basic knowledge of current data protection legal requirements. Delegates with no existing knowledge may find it helpful to attend Data Protection Essential Knowledge Level 1 before attending this training course.