Chapter 3 — Privacy and data protection: systems, data and dependencies

Chapter 3 — Privacy and data protection: systems, data and dependencies

Lesson map

Lesson 03 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Mapping the systems"]
  N2["3.2 Following the flows"]
  N3["3.3 Vendors and dependencies"]
  N4["3.4 Lawful bases"]
  N5["3.5 Retention"]
  N6["Concepts — the basis does not travel to the next pur"]
  N7["Data — four flows that leave the shop"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Mapping the systems"]
  N2["3.2 Following the flows"]
  N3["3.3 Vendors and dependencies"]
  N4["3.4 Lawful bases"]
  N5["3.5 Retention"]
  N6["Concepts — the basis does not travel to the next pur"]
  N7["Data — four flows that leave the shop"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX055"]

[Learning outcomes]
    |
    v
[3.1 Mapping the systems]
    |
    v
[3.2 Following the flows]
    |
    v
[3.3 Vendors and dependencies]
    |
    v
[3.4 Lawful bases]
    |
    v
[3.5 Retention]
    |
    v
[Concepts — the basis does not travel to the next pur]
    |
    v
[Data — four flows that leave the shop]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) map Juniper's systems and data flows; (2) identify vendors and dependencies; (3) note lawful bases and retention.

3.1 Mapping the systems

Sofia draws Juniper's systems on one page: the dispensing system that holds prescriptions and medication histories, the till that records sales, the loyalty app run by a vendor, the email newsletter tool, the CCTV recorder, the delivery service and paper prescription files. For each box she writes the main data it holds. The drawing shows that the loyalty app receives purchase data from the till each night, a flow the owner had not realised included medicine purchases. The drawing takes one afternoon to complete.

3.2 Following the flows

Sofia traces where data go next. Prescriptions arrive electronically from doctors' surgeries and on paper. The dispensing system sends claims to the health service for payment. The delivery service receives names, addresses and a sealed bag description. The newsletter tool receives emails of customers who joined the mailing list. The loyalty vendor receives every till item, including pain relief and pregnancy tests. She marks each flow with an arrow, its contents and whether customers would expect it. Two flows surprise the owner.

3.3 Vendors and dependencies

Juniper relies on four vendors: the dispensing system supplier, the loyalty app company, the newsletter tool and the delivery firm. Each processes customer data for Juniper and needs a contract that meets Article 28 of the GDPR, setting out instructions, confidentiality, security and deletion. Sofia finds contracts for the dispensing supplier and newsletter tool, but the loyalty and delivery contracts are standard terms that do not mention data protection. She flags both as gaps for the owner and Mr. Patel. Mr. Patel drafts the missing clauses.

3.4 Lawful bases

With Mr. Patel, Sofia notes the lawful basis for each purpose. Dispensing relies on providing health care, with Article 9(2)(h) as the condition for health data. Keeping prescription records relies on legal obligations for pharmacies. The newsletter relies on consent. The loyalty scheme relies on contract with members, but using medicine purchases for personalised offers would need explicit consent because it uses health data. Mr. Patel explains that each purpose needs its own basis, chosen before processing starts. Sofia records each basis in a table.

3.5 Retention

Sofia asks how long each type of data is kept. Prescription records follow professional rules set for pharmacies. CCTV is overwritten after thirty days. Loyalty data have no limit, and delivery records are kept in the driver's phone indefinitely. She recommends that the owner set retention periods for loyalty data, delivery records and newsletter subscribers who never open emails, and record them in a simple schedule. Storage limitation, she notes, reduces both legal risk and the damage any breach could cause. The owner approves.

Worked example

Sofia maps seven systems, traces flows including medicine purchases to the loyalty vendor, finds two vendor contracts without data protection terms, notes lawful bases and recommends retention periods.

Synthetic case. Systems are synthetic; GDPR Articles 9(2)(h) and 28 are real.

Errors and limits

A map drawn once becomes outdated; update it when systems change.

Concepts — the basis does not travel to the next purpose

Sofia already records one basis for each purpose, before processing starts. A basis chosen for points does not cover a new purpose. Health data keeps that rule and adds an Article 9 condition for the purpose that actually uses the health data.

Data — four flows that leave the shop

Decision flow — the owner proposes one new use

flowchart TD
  A["A new use of data Juniper already holds"] --> B{"Is this purpose already in Sofia's basis table?"}
  B -->|No| C["Do not start. Record a basis for this purpose first"]
  B -->|Yes| D{"Does this use contain a medicine name or other health data?"}
  D -->|Yes| E{"Is an Article 9 condition already recorded for this same purpose?"}
  E -->|No| F["Stop. The loyalty contract is not that condition"]
  E -->|Yes| G["Go on to the receiver"]
  D -->|No| G
  G --> H{"Would a vendor receive it under a contract with no Article 28 terms?"}
  H -->|Yes| I["Flag the contract. Do not add a new flow on those terms"]
  H -->|No| J{"Is there a written retention period for this data?"}
  J -->|No| K["Set a period before keeping more. Do not invent the pharmacy rule"]
  J -->|Yes| L["Write the use into the table"]

Worked example — a text when insulin is sold

The owner wants the loyalty app to text a voucher whenever a member buys insulin. Sofia will not switch it on. The members' contract covers points. It does not cover a message triggered by a named medicine, and that message is a new purpose which uses health data. The shop has not collected the explicit consent that purpose needs. The loyalty contract also still lacks Article 28 terms. A voucher based only on total points, with no medicine named, would be a different proposal and would go through this flow from the start. This proposal names insulin, so it stays off.

Synthetic case. The insulin voucher text is invented. Articles 9 and 28 are real. This is not legal advice.

Apply

• EX055 — Insulin text. Which recorded basis fails, and what must exist before any such text is sent? Rubric: 3 = the loyalty contract does not cover a medicine-named offer; the shop needs explicit consent for that purpose, and the loyalty contract still lacks Article 28 terms;; 2 = explicit consent;; 1 = vague;; 0 = none.
• EX056 — No end date. Which principle fails for the delivery records on the driver's phone, and what does Sofia not invent? Rubric: 3 = storage limitation, because there is no end date; the owner sets a delivery period; she does not invent the professional period for prescriptions;; 2 = set a delivery period;; 1 = vague;; 0 = none.

Exercises

• EX027 — Hidden flow. Which flow had the owner not realised? Rubric: 3 = till sends medicine purchases to the loyalty app;; 2 = mentions loyalty;; 1 = vague;; 0 = none.
• EX028 — Delivery data. What does the delivery service receive? Rubric: 3 = names, addresses and bag description;; 2 = most;; 1 = one;; 0 = none.
• EX029 — Vendor count. How many vendors does Juniper rely on? Rubric: 3 = four;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX030 — Contract gaps. Which contracts lacked data protection terms? Rubric: 3 = loyalty and delivery;; 2 = both;; 1 = one;; 0 = none.
• EX031 — Article 28. What must processor contracts cover? Rubric: 3 = instructions, confidentiality, security, deletion;; 2 = most;; 1 = one;; 0 = none.
• EX032 — Dispensing condition. Which condition covers dispensing health data? Rubric: 3 = Article 9(2)(h);; 2 = partly correct;; 1 = consent;; 0 = none.
• EX033 — Personalised offers. What would personalised offers from medicine purchases need? Rubric: 3 = explicit consent;; 2 = partly correct;; 1 = contract;; 0 = none.
• EX034 — CCTV retention. How long is CCTV kept? Rubric: 3 = thirty days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX035 — Unlimited data. Which data had no retention limit? Rubric: 3 = loyalty data and delivery records;; 2 = both;; 1 = one;; 0 = none.
• EX036 — Retention benefit. Why does storage limitation reduce breach damage? Rubric: 3 = less data held means less exposed;; 2 = mentions less data;; 1 = vague;; 0 = none.
• EX037 — Basis timing. When should a lawful basis be chosen? Rubric: 3 = before processing starts;; 2 = partly correct;; 1 = after;; 0 = none.
• EX038 — Expectation marks. What did Sofia mark on each flow besides contents? Rubric: 3 = whether customers would expect it;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 03 (chapter 03 of 04)

← Chapter 02 · Course chapter index · Chapter 04 →

Continue to the next authored lesson.