Chapter 9 — Law and data

Chapter 9 — Law and data

Lesson map

Lesson 09 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Data protection basics"]
  N2["9.2 Lawful bases"]
  N3["9.3 Rights"]
  N4["9.4 Other duties"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Data protection basics"]
  N2["9.2 Lawful bases"]
  N3["9.3 Rights"]
  N4["9.4 Other duties"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX025"]

[Learning outcomes]
    |
    v
[9.1 Data protection basics]
    |
    v
[9.2 Lawful bases]
    |
    v
[9.3 Rights]
    |
    v
[9.4 Other duties]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) outline data protection law relevant to Harbourline; (2) identify lawful bases and rights; (3) recognise other legal duties for data.

9.1 Data protection basics

Amara studies the GDPR as an example of data protection law. It applies to personal data, meaning information about identifiable people, such as loyalty members and staff. Organisations must process personal data lawfully, fairly and transparently, for specified purposes, using only what is needed, keeping it accurate, storing it no longer than necessary and keeping it secure. She notes that several of these principles, such as accuracy and storage limitation, are also data governance concerns. Amara lists each principle with a Harbourline example.

9.2 Lawful bases

Each use of personal data needs a lawful basis. Harbourline processes purchases to run the loyalty scheme under its contract with members, while marketing emails need consent. Amara finds that the old sign-up form bundled marketing consent with joining the scheme, which the GDPR treats as not freely given. She recommends a separate consent box. She explains that governance must record the basis for each use so that teams know what is permitted. The new form is introduced at the next scheme relaunch.

9.3 Rights

Members have rights, including to access their data, correct errors, object to marketing and in some cases have data erased. Amara reviews how Harbourline handles requests and finds that requests arrive at stores, head office and by email, with no central log. Some went unanswered. She recommends a single intake and log with deadlines. She notes that fulfilling rights depends on knowing where personal data are stored, which needs good metadata and inventories. The data protection officer agrees and sets up the log that month.

9.4 Other duties

Beyond data protection, Harbourline must keep financial records for set periods for tax purposes, respond to food safety recalls using supplier and batch data and follow employment law for staff records. Amara lists these duties with the data each requires. She sees that some duties require keeping data while others require deleting it, so governance must reconcile them in a retention schedule rather than leaving each team to decide alone. Amara's list becomes the starting point for the retention schedule studied in later chapters.

Worked example

Amara outlines GDPR principles, finds bundled marketing consent and recommends a separate box, centralises rights requests and lists tax, recall and employment duties affecting data.

Synthetic case. Harbourline is synthetic; the GDPR is real. This is not legal advice.

Errors and limits

Bundled consent is not freely given; separate it.

Exercises

• EX025 — Marketing basis. What lawful basis do marketing emails need here? Rubric: 3 = consent;; 2 = partly correct;; 1 = other;; 0 = none.
• EX026 — Rights problem. What problem did Amara find with rights requests? Rubric: 3 = no central log, some unanswered;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX027 — Recall data. Which data support food safety recalls? Rubric: 3 = supplier and batch data;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 09 (chapter 09 of 40)

← Chapter 08 · Course chapter index · Chapter 10 →

Continue to the next authored lesson.