Frequently Asked Questions concerning GDPR

First of all, you should clarify whether GDPR is generally applicable to your company’s activities (see question 1). Then, you should identify if your company processes personal data.

According to GDPR, “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

According to GDPR, “Processing” means any operation or set of operations that are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

According to GDPR, “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

According to GDPR, “Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

Example 1. GDPR is applicable if you are an employer and monitor the location of the cars that belong to or are assigned to your particular employees. The data can include not just the vehicle’s location but the employee’s location as well. In this case, the data derived from the vehicle can help to identify the individual and their location.

Example 2. GDPR is inapplicable if you monitor the location of the cars that are linked to the company’s IP address and cannot be attributed to a particular person.

In order to decide whether there is a sufficient probability that the collected data will be used to identify an individual, all objective factors should be taken into account, such as the cost and amount of time required for identification, taking into account available technologies at the time of processing and technological developments.

This question is important because your company may be required to perform certain actions in accordance with the GDPR (see question 5). We recommend that you contact your local legal adviser or supervisory authority to determine whether the GDPR applies to your company’s activities.