Section 8: General obligations of Data Fiduciary

Section 8 sets out the main rules for a Data Fiduciary, which is the person or entity deciding how and why personal data is processed. The Data Fiduciary is always responsible for following the law, even if they use a Data Processor (someone who processes data on their behalf) or if the Data Principal (the individual the data is about) fails to do their duties. If a Data Fiduciary uses a Data Processor to offer goods or services, they must have a valid contract in place. The Data Fiduciary must keep personal data complete, accurate, and consistent if it will be used to make a decision about the Data Principal or shared with another Data Fiduciary. They must also set up technical and organizational measures to follow the law and use reasonable security safeguards to prevent a personal data breach. If a breach happens, the Data Fiduciary must notify both the Board and every affected Data Principal in a manner that will be prescribed by rules. Data must be erased when the Data Principal withdraws their consent or when the original purpose for collecting it is no longer being served, whichever happens first. The Data Fiduciary must also ensure their Data Processors erase this data. However, data can be kept if another law requires it. The law considers a purpose no longer served if the Data Principal does not contact the Data Fiduciary or exercise their rights for a specific time period, which will be prescribed by rules. Finally, the Data Fiduciary must publish contact information for someone who can answer questions and set up a mechanism to handle grievances.

Key points

• The Data Fiduciary is responsible for compliance for all processing done by it or its Data Processors. (1)
• A valid contract is required to use a Data Processor for activities related to offering goods or services. (2)
• The Data Fiduciary must ensure data is complete, accurate, and consistent if used for decisions or shared with another Data Fiduciary. (3)
• In the event of a personal data breach, the Data Fiduciary must notify the Board and each affected Data Principal. (6)
• Personal data must be erased when consent is withdrawn or the purpose is no longer served, unless another law requires retention. (7)
• The Data Fiduciary must publish contact information for a person to answer questions and establish a grievance redressal mechanism. (9, 10)

Common misreadings

• A Data Fiduciary cannot avoid responsibility by blaming a Data Processor or by signing an agreement that shifts the blame.
• A Data Fiduciary does not have to erase data if another active law requires them to keep it, even if the Data Principal withdraws consent.