the new gdpr rules came into effect on december 22.
the new gdpr rules came into effect on december 22.
when do the new gdpr rules come into effect?
december 22
bullet::::- soc 2 – trust services principles









































bullet::::- soc 3 – service organization controls









































bullet::::- eu/us privacy shield data privacy practices









































section::::workplace and gdpr.









































the general data protection regulation (gdpr) standardizes data protection rules across the european union (eu). it came into effect on 25 may 2018. gdpr builds on existing data protection law, while also adding new requirements. most of the gdpr's requirements fall on data controllers. workplace premium customers act as data controllers and appoint facebook as a data processor under the workplace agreement. facebook and workplace comply with all applicable data protection laws.









































section::::workplace and facebook.
workplace by facebook
third, it has been recognised that the 'right to keep oneself to oneself, to tell other people that certain things are none of their business, is under technological threat' also from private corporations, as well as the state. through standard form [[english contract law|contracts]], tech corporations routinely appropriate users' private data for targeted advertising, particularly [[google]] (e.g. search and browsing history, email, locations), [[facebook]] (e.g. personal interactions, hobbies, messages), microsoft (e.g. emails, or cloud documents) and others. because people have no choice but to agree to the terms and conditions, consent is defective and contract terms are often unfair, legislation has been increasing in strength to reflect the fundamental 'right to the protection of personal data' in the [[european union]]. the [[general data protection regulation 2016]] requires that all data is processed lawfully, fairly and transparently, and on the basis of 'consent' or a contract. the meaning of 'consent' requires more than the basic rules for commercial contracts, and must be clearly and distinctly identifiable, and revocable at any time. contract terms may be subject to more protective rights contained in uk law. whenever a 'data subject' has personal data processed or stored, they have basic rights to be provided with transparent information about the data stored including when they have not given that information themselves, to access the data and rectify any inaccuracies, and to demand that the data is erased when it is no longer necessary for the purpose for which it was originally given. there is a further right that data must be portable 'to another controller without hindrance', for instance in switching phone contacts. data may be disclosed for legitimate reasons, so in "[[rugby football union v consolidated information services ltd]]" the supreme court held that a ticketing agency had no data protection defence against disclosing information to the rugby football union about people who touted tickets against its rules, because the legitimate interest in stopping theft was stronger. article 32 states a data controller must ensure the security of people's data, and notify supervisory authorities of any breach, including transfers to 'third countries' where the [[rule of law]] is defective. however, during the [[2016 brexit referendum]] the house of commons fake news committee found that facebook enabled massive breaches of users' data, being sold onto third parties including [[cambridge analytica]], which psychologically targeted voters with political adverts, and this data spread into [[russian interference in brexit|russia]]. the penalties for breach of gdpr rules, since it came into force in may 2018, can be up to 4% of a company's worldwide turnover, or €20m, whichever is higher. there are also databases kept by uk state bodies, including the [[national domestic extremism and disorder intelligence unit|national domestic extremism database]], a [[united kingdom national dna database|dna database]], and a [[police national computer]], related to this, the supreme court held in "[[r(l) v metropolitan police commissioner]]" that there was no breach of privacy when a primary school's enhanced criminal record check on an applicant for a teaching assistant job showed the applicant's son was put on a child protection register because of neglect, and she was refused a job. a planned nhs patients' database, [[care.data]], was abandoned because of protests about confidentiality and security of data. finally, claimants may sue any private party on the grounds of [[breach of confidence]], an old [[equity (law)|equitable action]], although one that may be giving way to a tort of misuse of private information. for instance, it was held that it was an unlawful breach of privacy for the [[daily mail]] to publish private journals of the [[prince of wales]] about the handover of [[hong kong]] to [[china]] stolen and leaked by a former employee. it was also held to be unlawful for a newspaper to publish details of an applicant's private sexual life, even though in other countries the story had spread around the internet, because there was no 'public interest... in the disclosure or publication of purely private sexual encounters, even though they involve adultery or more than one person at the same time'. in this way the common law has developed to uphold human rights.
united kingdom constitutional law