Understanding General Data Protection Regulation and Data Privacy

This document provides an overview of the General Data Protection Regulation (GDPR) and its impact on data privacy. It discusses the importance of data protection, the consequences of data breaches, and the rights of individuals to access their personal data. The document also addresses the issues related to contract terms and provides guidance on resolving conflicts. Overall, it aims to provide a comprehensive understanding of GDPR and data privacy.

1
Civil Law

2
Table of Contents
Section 1.....................................................................................................................................3
Section 2.....................................................................................................................................4
Section 3.....................................................................................................................................6
Section 4.....................................................................................................................................6
Reference List............................................................................................................................8

3
Section 1
The issues in the Concerns Section primarily involve the aspects related to the gaps identified
by the client which are to be addressed at the earliest in order to make sure that the outcomes
of the project are met in an effective and efficient manner as far as the comprehensive
solutions are concerned. The management of databases is also to be taken into consideration
since the client would be having the responsibility pertaining to the strategic aspect of data
clearing in terms of Human Resource, sales, procurement and finance (Martin, Borah and
Palmatier, 2017). It is imperative that the issues between the client and Clearing Skies UK
need to be resolved at the earliest in order to avoid and prevent the occurring of further
problems in the long runas far as the contract is concerned. There are also some emails
received by the team members of Clearing Skies UK which seem to be of such nature that
investigation in a detailed manner is needed for them. The General Data Protection
Regulation of the European Union is also to be understood in a proper and appropriate
manner as far as the concept of data privacy is concerned in order to undertake the necessary
steps for the ensuring of the confidentiality of data.
The risk register implies the aspect of the risks that would possibly occur in terms of the facts
of the case along with the steps and measures which would be undertaken in order to resolve
the risks and issues in an effective and efficient manner so that the project is completed in a
timely manner thereby implying the desired outcomes. The Red, Amber and Green (RAG)
status has been provided in the risk register taking account of the gravity of the risks and their
probability of taking place along with the extent of the effect the risks can have accordingly.
Additionally, mitigation plans have also been discussed and demonstrated in order to reduce
and prevent the risks to a significant extent as far as the appropriate steps and measures to be
undertaken are concerned (O'Har, Senesi and Molenaar, 2017). The action needs to be taken
for the prevention of risks in a proper manner by following the required steps thereby
resulting in an amicable solution in a timely manner as far as the facilitation of the ease of the
completion of the project is concerned. It is also imperative form of a risk register that the
almost all kinds of risks would cause various kinds of hindrances and impediments towards
the undertaking and finishing of the project in the manner as decided by the client of Clearing
Skies UK. The percentage relating to priority in terms of the addressing of the different kinds
of issues and risks have also been taken into consideration as implied by the risks and issues
register as observed and inferred from the facts of the case. Such kind of risks and issues

4
register plays an important role in the assessment and evaluation of risks in an incredible
manner thereby enabling the deduction of the solutions in the desired manner.
As implied by the entries of the risks in the register, it is observed that the resolution of the
issues should be done as early as possible so that there are no major hurdles and obstacles in
the course of the completion of the project at the client site. It is further implied form the
facts of the case that the relationships amongst the members of the team have been negative
in nature thereby leading to potential conflicts. As a result, measures are to be applied and
implemented in order to ensure that there is cohesion amongst the team members as far as the
amicable relationships are concerned which would help in the smooth completion of the
project thereby leading to the favourable outcomes (Hiscock and Jones, 2017). The policy
relating to the confidentiality data as per the register is to be analysed and implemented in a
proper and appropriate manner. It would help in the protection of data of the customers in an
effective manner thereby leading to the prevention of the breach of data. In this regard, the
laws and regulations related to data privacy would play an essential role as far as the
protection of data is concerned. Additionally, the mitigation of the risks would help in the
overcoming of the challenges to a considerable extent thereby leading to the closure of the
risks and issues register at the earliest as far as the undertaking of the necessary actions are
concerned.
Section 2
The regulation which has been implemented with regard to the ensuring of the privacy of data
is the General Data Protection Regulation. It was implemented on 25th May 2018. It is
applicable to the region of European Union and the European Economic Area. It plays in
important role in the protection of personal data.
Data privacy
The regulation is purported to protect the data of the citizens under the jurisdiction of the
European Union and the European Economic Area. In this regard, the management of data
would be facilitated by the application of this legislation in the desired manner as far as the
personal data of the customer concerned. The regulation is also aimed at the ensuring of the
right to privacy for all citizens belonging to the region of European Union and the European
Economic Area. Such right to privacy is implied by Article 8 of the European Convention on
Human Rights. As a result, the monitoring of the flow of personal data beyond the region of

5
the European Union and the European Economic Area is also governed by the General Data
Protection Regulation. The provisions related to the control of personal data by the respective
individual are also envisaged and enshrined in the General Data Protection Regulation.It is
imperative that the client has to ensure to the flow of information relating to the datasets in a
proper and appropriate manner so as to ensure the privacy of data as far as the cleansing of
data is concerned.
Data breaches and consequences
The regulation has hitherto played a vital role in the guaranteeing of data protection at the
personal level to a significant extent since its implementation. It further implies that the
technical measures are to be taken into consideration for the management and controlling of
personal data in a significant manner (Carey, 2018). It would help in the application of
principles related to the protection of data in an incredible manner. As far as the aspect of
data management is concerned in terms of the facts of the case, the General Data Protection
Regulation would facilitate the ease of the control of personal data of the individual in
question. It is imperative that sensitive data of people are to be handled with utmost care and
not to be disclosed unless it seems to be extremely necessary. The data breaches are to be
reported within seventy two hours of its occurrence as implied by the facts and circumstances
of the case with regard to the project of Clearing Skies UK. Such kinds of breaches would
lead to stringent action to be undertaken as implied by the General Data Protection
Regulation. The disclosure of information with regard to sales, Human Resource,
procurement and finance is to be made in compliance with the General Data Protection
Regulation.As a result, in terms of the maintenance and storage of the datasets, the guidelines
inferred by the General Data Protection Regulation are to be taken into consideration by the
client as far as the undertaking of responsibilities in the prescribed manner is concerned
thereby delving into the content of the data in question.
Accessing of personal data
As far as the accessing of the personal data by a former customer is concerned, Article 15 of
the General Data Protection Regulationprovides for the right to access of personal data by the
individual concerned. It further implies the person entrusted with the management and
control of data must not only provide the data under process upon request under Article 15
(1) (b) but also the data which is in actual form under Article 15 (3).As a result, such
provisions are to be taken into consideration in terms of the accessing of the personal data of

6
the customers with regard to the concerns raised by the client as far as disclosure of
information is concerned.
Personal data Non personal data
Name of a person Registration number of a company
Address of a person Email id of a company
Subject Access Request
The aspect of Subject Access Request with regard to the handling and management of data
implies the disclosure of information to people about their personal data accordingly. It
further implies that an employee must be informed about its personal data as far as its
processing in the database of the organization is concerned. In addition to the extent, the
purpose of the use of the personal data should also be disclosed to the employee (Boniface et
al., 2019). It would help the employee to know about the objectives of the utilization of their
personal data.
Key elements of Subject Access Request
The key elements of Subject Access Request are as follows:
1. The Subject Access Request implies that the employees have the right to know to
whom their personal data is being furnished or disclosed. The reason with regard to
the details of disclosure of the personal data must also be furnished to the employee in
the desired manner so that it would be feasible for the employees to undertake the
necessary steps. It would lead to the protection and security of data of the employees
in a proper and appropriate manner. As a result, it is imperative that a Subject Access
Request plays an important role in the disclosure of information to the employees
with reference to the extent of the usage of their personal data by the respective
organization as far as the details of the processing of the data is concerned.
2. The decisions made by the organization in terms of the use the personal data must
also be furnished to the employee thereby disclosing the beneficial purposes and
objectives of the personal data as far as the progress of the organization to higher
levels is concerned. In this regard, the aspect of the purpose of verification to should
be taken into consideration as far as the disclosure of information is concerned. It is
implied that the aspect of Subject Access Request would help the employee to know

7
about the instances where breach of data has been occurred on part of the organization
(Ouaddah et al., 2017).
It is thereby implied that the details regarding the usage of personal data set by the
organization in the form of name and address of the employee are to be disclosed as a result
of the Subject Access Request made by the employee concerned with reference to Article 15
of the General Data Protection Regulation. It further implies that the purpose of the name and
address of the employee to be used by that are to be disclosed as per the Subject Access
Request accordingly. The key thing in this regard is the code of practice issued by the
Information Commissioner’s Office thereby following the appropriate protocol in terms of
Subject Access Request.
Section 3
The guidance would be provided to the client by briefing about the steps and procedures that
are to be followed accordingly. With regard to the email concerning invoice where the dates
appear to be inconsistent with the work being undertaken, the verification is to be conducted
in a proper and appropriate manner as far as the analysis of the details of all official email
accounts of Clearing Skies UK are concerned. The logo in the invoice is also to be examined
in order to determine the authenticity of the invoice whether it is actually from Clearing Skies
UK or not. If it is found out that the email is actually from an account of Clearing Skies UK,
the person who sent the email is to be investigated thoroughly and further steps are to be
taken as required in order to establish a reasonable conclusion behind the sending of such
invoice through email. The cyber authorities would have to play an important role in this
regard as far as the providing of a comprehensive solution to the client. If it is concluded that
the email is not form an account Clearing Skies UK, then a thorough investigation is to be
conducted at the internal level of Clearing Skies UK since it may lead to the disclosure of
confidential information thereby leading to breach of data privacy (Wheatley, Maillart and
Sornette, 2016). As a result, stringent action is to be undertaken against the person or entity
acting in such kinds of breaches. The aspect of hacking must also be taken into consideration
during the course of investigation as far as the busting of cyber crime is concerned. The
contact details in the invoice along with the bank details must be examined in a proper and
appropriate manner. It would help in the identification of the sender in an incredible manner
as a result of verification in the desired manner. The Computer Misuse Act of 1990 and the

8
Data Protection Act of 2002 would play an important role in the conducting of investigation
and undertaking the necessary action.
The link needs to be examined and analysed in order to reach to a conclusion as a result of
the investigation by following the necessary procedure (Abomhara, 2015). The client has to
assess the link in a detailed manner by undertaking the necessary steps in compliance with
the ethical guidelines so as to mitigate the risks and issues in the desired manner. The
concerned authority must be intimated by the client if there is any suspicious content found in
the link. In this regard, the key legislation would be the General Data Protection Regulation.
The junk folder of the email account is to be analysed in a proper manner as far as the
carrying out of checks are concerned with regard to tracking of emails by the appropriate
cyber authority. The bank statement regarding the suspicions purchase is also to be taken into
consideration in order to infer the details of the transaction connected with the purchase. It
would help to track the person behind the suspicious purchase as far as fraud is concerned
(Bossler, 2019). In this matter, the client has to report and inform the concerned cyber
authority with regard to the detailed evaluation of the mails in the junk folder. The bank
account through which such kind of suspicious purchase has been made is also to be verified.
As a result, the Data Protection Act of 2002 would not be violated in this regard since the
disclosure of information would be for a beneficial cause as far as addressing of issues related
to possible fraudulent activities are concerned. In addition to the Data Protection Act of 2002,
the key legislation would also be the General Data Protection Regulation as far as far as the
monitoring of the flow of information is concerned.
Section 4
The aspect of unfair contract terms might lead to legal recourse if not resolved mutually
between the client and Clearing Skies UK as far as the common law related to contracts is
concerned. As a result, it is observed amendments in the contract are to be made prior to its
executionso that the issues raised by the client are resolved at the earliest with regard to the
project (Loos, 2015). It is imperative that in order to ensure smooth function with regard to
the desired outcome of the project, the contract is to be drafted taking into consideration the
demands and expectations of the client. It is implied that the disagreements are to be resolved
and addressed at the earliest in order to prevent the aspect of legal recourse thereby implying
an amicable relationship between Clearing Skies UK and the client. With regard to the legal

9
proceedings in terms of unfair terms in a contract, the Unfair Contract Terms Act of 1977
would be the key legislation. The client in this regard would be treated as a consumer as far
as the interpretation of Section 12 of the Unfair Contract Terms Act of 1977 is concerned.
Additionally, the interpretation of the term business as per Sub-section 3 of Section 1 of the
Unfair Contract Terms Act of 1977 would mean Clearing Skies UK as far as the facts and
circumstances of the case are concerned. As a result, it is imperative that the Unfair Contract
Terms Act of 1977 is the key legislation in this regard since it would enable the application of
the restrictions of certain terms of the contract as far as their operations are concerned. It is
also implied that the rules of interpretation are to be followed as far as the importance of
interpretation is concerned. Therefore, interpretation is of extreme importance in the interest
of fairness as far as the aspect of natural justice is concerned. In this regard, the principles of
statutory interpretation would be the key thing.
Additionally, the aspect with regard to the lack of cohesion may also lead to legal recourse as
far as the aspect related to resolution of conflicts is concerned. It is also inferred from the
facts of the case that some members of the team have used language which is not acceptable
on an average basis. The aspect of professional misconduct is to be taken into consideration
with regard to such usage of unprofessional language (Tricco et al., 2018). If the language is
abusive or vulgar, the aspect of obscenity would play a vital role in the initiation of criminal
proceeding s accordingly. As far as the legal proceedings are concerned, they can be initiated
when it is observed that there cannot be any mutual understanding amongst the team
members as far as being on the same page is concerned and the issues are escalating instead
of resolving. The Employment Rights Act of 2004 would be the key legislation with regard to
the addressing of the lack of cohesion amongst the team members thereby implying that the
team members are treated in a fair manner as far as legal proceedings are concerned. The
procedural law with regard to arbitration would be the Arbitration Act of 1996 as far as the
resolution of disputes through arbitration is concerned in order to avoid the complexities
involved in litigation.

10
Reference List
Abomhara, M., 2015. Cyber security and the internet of things: vulnerabilities, threats,
intruders and attacks. Journal of Cyber Security and Mobility, 4(1), pp.65-88.
Boniface, C., Fouad, I., Bielova, N., Lauradoux, C. and Santos, C., 2019, June. Security
Analysis of Subject Access Request Procedures. In Annual Privacy Forum (pp. 182-209).
Cham: Springer,.
Bossler, A.M., Holt, T.J., Cross, C. and Burruss, G.W., 2019. Policing fraud in England and
Wales: examining constables’ and sergeants’ online fraud preparedness. Security Journal,
pp.1-18.
Carey, P., 2018. Data protection: a practical guide to UK and EU law.Oxford: Oxford
University Press, Inc..
Hiscock, K. and Jones, A., 2017. Assessing the extent to which the UK’s National Risk
Register supports local risk management. Sustainability, 9(11), p.1991.
Loos, M., 2015. Transparency of standard terms under the Unfair Contract Terms Directive
and the proposal for a common European sales law. European Review of Private Law, 23(2),
pp.179-193.
Martin, K.D., Borah, A. and Palmatier, R.W., 2017. Data privacy: Effects on customer and
firm performance. Journal of Marketing, 81(1), pp.36-58.
O'Har, J.P., Senesi, C.W. and Molenaar, K.R., 2017. Development of a risk register
spreadsheet tool for enterprise-and program-level risk management. Transportation research
record, 2604(1), pp.19-27.
Ouaddah, A., Elkalam, A.A. and Ouahman, A.A., 2017. Towards a novel privacy-preserving
access control model based on blockchain technology in IoT. In Europe and MENA
Cooperation Advances in Information and Communication Technologies (pp. 523-533).
Cham: Springer,.
Tricco, A.C., Rios, P., Zarin, W., Cardoso, R., Diaz, S., Nincic, V., Mascarenhas, A.,
Jassemi, S. and Straus, S.E., 2018. Prevention and management of unprofessional behaviour
among adults in the workplace: A scoping review. PloS one, 13(7), p.e0201187.

11
Wheatley, S., Maillart, T. and Sornette, D., 2016. The extreme risk of personal data breaches
and the erosion of privacy. The European Physical Journal B, 89(1), p.7.