Chapter 10 — Privacy and data protection: orientation
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Principles"]
N2["10.2 Lawful bases"]
N3["10.3 Special categories"]
N4["10.4 Rights"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Principles"]
N2["10.2 Lawful bases"]
N3["10.3 Special categories"]
N4["10.4 Rights"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 Principles]
|
v
[10.2 Lawful bases]
|
v
[10.3 Special categories]
|
v
[10.4 Rights]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) explain core data protection principles; (2) identify lawful bases in a fitness business; (3) recognise special category data.
10.1 Principles
Aisha studies GDPR Article 5 principles and LGPD Article 6 principles and applies each to Quayside. Purpose limitation means CCTV footage for security is not used to monitor staff productivity. Minimisation means the app asks only for data needed for workouts. Accuracy means members can correct their details in the app. Storage limitation means footage and inactive accounts are deleted on schedule. Integrity and confidentiality mean member data are protected against loss and misuse. Accountability under Article 5(2) means Quayside must be able to show compliance, not just claim it, which is why Aisha keeps evidence of every check she performs.
10.2 Lawful bases
Membership processing relies on contract; payment records on legal obligation; marketing emails on consent; CCTV on legitimate interests. Aisha learns that each purpose needs its own basis. She notes that consent is not appropriate for membership processing, because members cannot refuse the processing and still have a membership; contract fits better. For CCTV, legitimate interests require a balancing test showing that security needs outweigh the intrusion on members and staff. She drafts the balancing test with the data protection officer and records the reasoning.
10.3 Special categories
Heart-rate data used to assess health may be health data, needing an Article 9 condition such as explicit consent. Aisha notes that Quayside must decide and document this carefully. She discusses the difference between heart-rate readings shown during a class and a long history used to suggest rest days or detect irregular rhythms. The second clearly reveals information about health. Quayside decides to treat all stored heart-rate data as health data, which is the more protective choice and simplifies explanations to members and staff alike.
10.4 Rights
Members have rights to access, rectify, erase, restrict, port and object. Aisha lists how each would be handled in Quayside's systems. Mr. Reilly notes that rights must be practical, not only stated. For access, a checklist covers every system. For rectification, members edit details in the app. For erasure, an account deletion process reaches all systems with documented exceptions such as debt. For objection, members can stop marketing in one tap. She notes that LGPD Article 18 gives similar rights to members in Brazil if Quayside ever operates there.
Worked example
Aisha maps principles to Quayside, assigns lawful bases by purpose, flags heart-rate data as possible health data and lists rights handling.
Synthetic case. Quayside's choices are synthetic; GDPR Articles 5 and 9 and LGPD Article 6 are real.
Errors and limits
Lawful basis choices depend on facts; review with counsel.
Exercises
- EX028 — CCTV purpose. Why can CCTV footage not be used for staff productivity? Rubric: 3 = purpose limitation;; 2 = mentions purpose;; 1 = allowed;; 0 = none.
- EX029 — Marketing basis. What lawful basis does marketing email use? Rubric: 3 = consent;; 2 = partly correct;; 1 = contract;; 0 = none.
- EX030 — Heart-rate condition. What condition may heart-rate health data need? Rubric: 3 = explicit consent under Article 9;; 2 = mentions consent;; 1 = vague;; 0 = none.
Continue studying — lesson 10 (chapter 10 of 30)
← Chapter 09 · Course chapter index · Chapter 11 →
Continue to the next authored lesson.