Privacy Law, Principles, and Data Subject Rights

Introduction

Privacy law governs how organisations collect, use, disclose, retain, secure, and delete information relating to identifiable people. For business analysts, privacy is not merely a legal constraint. It is a design requirement affecting data architecture, analytical methods, vendor selection, risk management, customer trust, and organisational reputation.

Modern organisations often operate across several legal regimes. A customer may live in one country, use a service hosted in another, and have information analysed by a supplier located in a third. Consequently, privacy compliance requires more than reading one statute. It requires an understanding of common principles, legal roles, operational controls, and the interaction between local law and cross-border data flows.

This chapter uses the European Union General Data Protection Regulation (GDPR) as a major reference framework because its concepts have influenced privacy regulation globally. It also identifies where requirements differ across jurisdictions. The GDPR should not be treated as universally applicable: its application depends on factors such as organisational establishment, targeting of individuals, processing activities, and applicable exemptions.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the meaning and importance of privacy and personal data.
2. Interpret the principal privacy principles, including lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.
3. Distinguish lawful bases for processing and assess when consent is appropriate.
4. Explain data subject rights and the organisational processes needed to support them.
5. Analyse cross-border data transfers and the responsibilities of controllers, processors, and other parties.
6. Apply privacy principles to analytics, artificial intelligence, marketing, and business operations.
7. Identify limitations, conflicts, and ethical issues that remain even when processing is legally permissible.

1. Privacy, Personal Data, and Processing

Privacy is the ability of individuals to control information about themselves and to live without unjustified intrusion. It includes informational privacy—the appropriate collection and use of personal information—but also relates to autonomy, dignity, confidentiality, freedom of association, and freedom from discrimination.

Under the GDPR, personal data means information relating to an identified or identifiable natural person. Names and identification numbers are obvious examples, but personal data may also include email addresses, device identifiers, location data, online identifiers, photographs, employment records, and inferred profiles. A dataset does not become anonymous merely because names have been removed. If a person can reasonably be re-identified by combining the dataset with other information, the data may remain personal data.

Pseudonymisation replaces direct identifiers with a code, while keeping additional information separately. It reduces risk but does not generally remove the data from privacy law. Proper anonymisation, by contrast, aims to make identification no longer reasonably possible, taking account of available means, cost, time, and technology.

“Processing” is a broad concept. It includes collecting, recording, organising, storing, adapting, retrieving, consulting, using, disclosing, combining, restricting, erasing, and destroying data. A business analytics team is therefore processing personal data when it prepares a customer dataset, trains a model, creates a dashboard, or exports records to a cloud provider.

Important roles

The same organisation may be a controller for employee administration and a processor when hosting another organisation’s customer platform. Role analysis must be based on actual decision-making rather than labels in a contract.

2. The Core Privacy Principles

Privacy principles convert broad legal values into operational expectations. The GDPR’s principles are particularly influential, although wording and details differ among legal systems.

2.1 Lawfulness, fairness, and transparency

Processing must have a lawful basis, must not be unfair, and must be explained in an accessible way. Lawfulness concerns the legal permission to process. Fairness concerns whether the processing produces unjustified, unexpected, deceptive, or harmful effects. Transparency concerns whether people receive meaningful information about what happens to their data.

A long privacy notice that technically contains all required information may still fail the fairness and transparency objectives if it is unreadable, hidden, or presented only after a decision has been made. Effective transparency uses layered notices, plain language, clear timing, and explanations relevant to the particular service.

2.2 Purpose limitation

Data should be collected for specified, explicit, and legitimate purposes and not later used in ways incompatible with those purposes. Purpose limitation does not prohibit all secondary use. Compatibility depends on factors such as the relationship with the individual, the nature and sensitivity of the data, the consequences of the new use, and the safeguards applied.

For example, collecting a delivery address to fulfil an order does not automatically authorise selling the address to unrelated advertisers. A later analytical use may sometimes be possible, but the organisation must assess legal basis, compatibility, transparency, minimisation, and safeguards.

2.3 Data minimisation

Only data that is adequate, relevant, and limited to what is necessary should be collected and used. Minimisation is not simply deleting data at the end of a project. It should influence requirements, interface design, data models, access permissions, feature engineering, and reporting.

A model predicting product demand may need product, date, region, and sales volume. It may not need customer names, full addresses, or precise birth dates. Removing unnecessary variables can reduce privacy risk, security impact, storage expense, and the possibility of discriminatory use.

2.4 Accuracy

Personal data should be accurate and, where necessary, kept up to date. Inaccurate data can cause incorrect credit decisions, failed deliveries, inappropriate marketing, or unjustified fraud alerts. Organisations should provide correction mechanisms, identify authoritative sources, record update dates, and propagate corrections to recipients where required.

Accuracy also has an analytical dimension. A prediction may be statistically well calibrated yet still be inappropriate if the underlying personal data are outdated, incomplete, or systematically biased.

2.5 Storage limitation

Personal data should not be retained longer than necessary for the purposes for which it is processed. Retention decisions should consider legal obligations, contractual needs, operational value, security risk, and the likelihood that the data will be required for a legitimate purpose.

A defensible retention schedule identifies data categories, purposes, retention periods, legal holds, archival rules, deletion methods, and responsible owners. “Keep everything just in case” is generally inconsistent with minimisation and storage limitation.

2.6 Integrity and confidentiality

Organisations must protect data against unauthorised or unlawful processing and against accidental loss, destruction, damage, or disclosure. Controls may include least-privilege access, authentication, encryption, secure development, logging, segregation, backups, vulnerability management, staff training, and incident response.

Security is necessary but not sufficient for privacy. A perfectly encrypted system can still be unlawful if it collects excessive data or uses it for an undisclosed purpose.

2.7 Accountability

Accountability requires an organisation not only to comply but to demonstrate compliance. Evidence may include records of processing, data protection impact assessments, contracts, training records, access reviews, retention schedules, consent logs, incident records, and documented decisions.

Accountability changes privacy from a one-time legal review into a management system. Senior leaders must assign responsibility, fund controls, monitor performance, and ensure that analytics projects pass privacy review before deployment.

3. Lawful Bases for Processing

A lawful basis is the legal justification for processing personal data. Under the GDPR, common bases are:

The organisation should choose the basis before processing begins, document it, and communicate it consistently. A lawful basis is not interchangeable with a general statement that processing is useful or commercially beneficial.

Consent and legitimate interests

Consent is appropriate where the individual has a real choice. It is weak where the service is conditional on unrelated consent, where there is a power imbalance, or where the organisation cannot support withdrawal. Consent records should identify who consented, when, what they were told, what they agreed to, and how withdrawal is handled.

Legitimate interests generally involves three questions: Is there a legitimate interest? Is the processing necessary for that interest? Do the individual’s interests, rights, or freedoms override it? Sensitive data, unexpected monitoring, vulnerable individuals, and intrusive profiling require particular caution. Some jurisdictions impose additional or different requirements, so a local legal assessment remains necessary.

Special-category data

Some data receive enhanced protection because misuse could create serious harm. Under the GDPR, examples include health data, biometric data used for identification, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and information about sex life or sexual orientation. Processing normally requires both an ordinary lawful basis and an additional condition. Organisations must never assume that a person’s public disclosure removes all obligations.

4. Transparency and Privacy by Design

A privacy notice should normally explain the organisation’s identity, purposes, categories of data, lawful bases, recipients, international transfers, retention periods, rights, complaint routes, and significant automated decision-making. Information should be supplied at an appropriate time—for example, when data are collected or, where obtained indirectly, within the legally specified period unless an exception applies.

Privacy by design and by default means incorporating privacy into the architecture and default settings of systems. Practical techniques include:

• collecting optional data separately from essential data;
• making privacy-protective settings the default;
• separating identifiers from analytical attributes;
• using aggregation, masking, pseudonymisation, or anonymisation where suitable;
• restricting access by role and purpose;
• testing re-identification risk;
• recording data lineage and provenance;
• building deletion, correction, and export functions into the system;
• testing models for disparate impact and proxy discrimination.

A data protection impact assessment (DPIA) is appropriate where processing is likely to create a high risk to individuals, such as large-scale sensitive-data processing, systematic monitoring, or extensive profiling. A DPIA should describe the processing, assess necessity and proportionality, identify risks, specify mitigations, and record residual risk and approval.

5. Data Subject Rights

Rights provide individuals with practical control and a means of challenging organisational decisions. The precise rights and time limits vary by law, but the GDPR includes the following principal rights.

Right to be informed

Individuals have a right to understandable information about processing. This is normally fulfilled through privacy notices and contextual explanations.

Right of access

An individual may request confirmation that their data are being processed and obtain a copy, together with prescribed information about purposes, categories, recipients, retention, and rights. Access requests can affect databases, email archives, call recordings, analytics platforms, and supplier systems.

Right to rectification

Individuals may require inaccurate personal data to be corrected and incomplete data to be completed, subject to applicable conditions.

Right to erasure

Often called the right to be forgotten, this permits deletion in specified circumstances, such as when data are no longer necessary or consent has been withdrawn and no alternative basis applies. It is not absolute; legal obligations, freedom of expression, public interest, or litigation needs may justify retention.

Right to restriction

Processing may need to be suspended while accuracy, lawfulness, or an objection is assessed. Restricted data may generally be stored but not otherwise used, except under permitted conditions.

Right to data portability

Where applicable, individuals may receive certain data in a structured, commonly used, machine-readable format and transmit it to another controller. Portability generally concerns data provided by the individual or generated by their activity, processed by automated means on the basis of consent or contract. It does not require disclosure of another person’s data or every derived business insight.

Right to object

Individuals may object to processing based on legitimate interests or public task in relevant circumstances. They have a particularly strong right to object to direct marketing, including related profiling.

Rights concerning automated decision-making

Where a decision is solely automated and has legal or similarly significant effects, legal safeguards may apply. These can include information about the logic involved, human intervention, an opportunity to express a view, and the ability to challenge the decision. Human involvement must be meaningful rather than a nominal approval of an unchanged machine output.

Handling requests professionally

An effective rights process should verify identity proportionately, log the request, locate relevant systems, apply exemptions, consult suppliers, protect third-party information, meet deadlines, and communicate the result clearly. A central request register and searchable data inventory greatly improve performance. Organisations should not make access impossible merely because data are distributed across incompatible systems.

6. Cross-Border Transfers

A transfer may occur when personal data are sent to a foreign supplier, accessed remotely from another country, placed in an overseas cloud region, or made available to a group company abroad. The legal analysis normally asks:

1. Is personal data involved?
2. Is there a transfer to, or remote access from, another jurisdiction?
3. Is the destination covered by an adequacy decision or equivalent recognised mechanism?
4. If not, are appropriate safeguards such as standard contractual clauses available?
5. Are supplementary technical, contractual, and organisational measures needed?
6. Are onward transfers, government-access risks, and supplier practices understood?

Contractual safeguards alone may not be enough if the destination’s legal environment undermines effective protection. Encryption with keys controlled by the exporting organisation, strong access restrictions, data localisation, minimised datasets, and pseudonymisation may reduce risk, but controls must be evaluated against the actual threat model.

Multinational businesses should maintain a transfer map identifying data flows, countries, recipients, purposes, safeguards, and responsible owners. They must also monitor changes in court decisions, adequacy arrangements, contractual mechanisms, and local surveillance law.

7. Privacy in Business Analytics and Artificial Intelligence

Analytics can create new information rather than merely organise existing facts. A model may infer health status, financial vulnerability, likely pregnancy, political preference, or propensity to churn. These inferences can be personal data even when they were not directly supplied by the individual.

Several risks are especially important:

• Function creep: data collected for service delivery are reused for unrelated profiling.
• Re-identification: supposedly anonymous records are linked with external datasets.
• Proxy discrimination: variables such as postcode or purchasing behaviour indirectly encode protected characteristics.
• Opacity: individuals cannot understand or challenge a consequential score.
• Data drift: old training data produce inaccurate decisions as circumstances change.
• Excessive retention: raw data and model artefacts persist without a continuing purpose.

A sound analytics workflow defines the purpose, selects the minimum necessary variables, documents the lawful basis, tests data quality and bias, restricts access, evaluates model performance across relevant groups, establishes human review, and monitors outcomes after deployment. Technical accuracy does not establish legal fairness. A model can be accurate on average while imposing unacceptable error rates on a minority group.

8. Illustrative Case: The Retail Loyalty Platform

Background

A fictional national retailer, Northstar Retail, operates a loyalty programme. It collects purchase history, email address, store location, and app interaction data. The marketing team proposes a model that predicts which customers are likely to buy premium products and automatically sends targeted offers.

Problem

The proposed design would combine loyalty data with precise location histories purchased from a third party. The team assumes that acceptance of loyalty-programme terms is consent for all future analytics and plans to retain every event indefinitely.

Analysis

The project raises several issues. The original purpose of administering the loyalty account may not be compatible with extensive location-based profiling. The third-party data require provenance and lawful-basis analysis. Precise location may be unnecessary for premium-product prediction. The notice does not clearly explain profiling, retention, recipients, or the right to object. Long-term retention conflicts with storage limitation, and the model may use postcode as a proxy for socioeconomic characteristics.

Approach and solution

Northstar redesigns the project as follows:

1. It defines a specific marketing and customer-insight purpose.
2. It conducts a DPIA and legitimate-interests assessment, while offering a separate consent choice where consent is the appropriate basis.
3. It rejects precise location unless a documented business need is demonstrated.
4. It uses coarse geographic categories and removes direct identifiers from the modelling environment.
5. It publishes a layered notice describing profiling, data sources, retention, and objection rights.
6. It creates a retention schedule and deletes event-level data after the approved period.
7. It tests model performance and offer allocation across demographic and geographic groups.
8. It provides an accessible opt-out and ensures that marketing suppression is respected across channels.
9. It contracts with suppliers as processors where appropriate and assesses any international access.
10. It requires human review before using predictions for materially significant decisions.

Outcome

The revised system produces a less intrusive model with slightly lower predictive performance but materially lower legal, ethical, and reputational risk. Customers receive clearer choices, data access requests can be fulfilled more efficiently, and the analytics team documents why each variable is necessary.

Learning points

Legality is not equivalent to technical feasibility. Minimisation can improve governance without eliminating business value. Transparency must describe meaningful uses rather than merely reproduce legal vocabulary. Finally, privacy decisions should be made during project design, not after deployment.

9. Challenges and Limitations

Privacy law contains unavoidable judgement. Purpose compatibility, necessity, legitimate interests, anonymisation, and significant effects are context-dependent. Different jurisdictions define personal data, consent, employee monitoring, children’s data, cookies, biometrics, and government access differently.

There are also practical tensions. Minimisation may reduce analytical detail; deletion may conflict with fraud investigation or legal preservation; transparency may be difficult when models are complex; portability may be technically costly; and strict access controls can reduce operational efficiency. These tensions do not justify ignoring privacy. They require documented trade-offs, proportionality, technical safeguards, and governance escalation.

Organisations should also distinguish compliance from ethics. A use may be technically lawful but manipulative, discriminatory, or socially harmful. Ethical review should ask whether the processing respects human dignity, whether people would reasonably expect it, who benefits, who bears the risk, and whether a less intrusive alternative exists.

10. Best-Practice Governance Framework

A practical privacy governance programme should include:

1. Inventory: maintain records of systems, data categories, purposes, owners, recipients, and locations.
2. Classification: identify ordinary, confidential, sensitive, pseudonymised, and anonymised data appropriately.
3. Legal assessment: document purpose, lawful basis, special-category conditions, and jurisdictional requirements.
4. Design review: apply minimisation, privacy by default, security, retention, and rights functionality.
5. Supplier governance: conduct due diligence, define instructions, audit rights, breach duties, deletion, and transfer safeguards.
6. Operational controls: restrict access, monitor use, manage changes, respond to incidents, and maintain data quality.
7. Rights management: provide channels, workflows, identity checks, deadlines, exemptions, and audit trails.
8. Training and culture: teach employees that privacy is part of professional conduct and analytical quality.
9. Assurance: perform DPIAs, audits, testing, reviews, and corrective action.
10. Continuous improvement: update controls as technology, business purposes, risks, and laws change.

Chapter Summary

Privacy law regulates the lifecycle of personal data, from collection and analysis to disclosure, retention, and deletion. The central principles are lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. Organisations must select and document an appropriate lawful basis; consent is only valid where it is informed, specific, freely given, and withdrawable. Special-category data require additional protection.

Data subject rights—including access, rectification, erasure, restriction, portability, objection, and safeguards concerning automated decisions—must be supported by discoverable data and operational workflows. Cross-border processing requires analysis of destination countries, transfer mechanisms, contractual safeguards, and technical measures. In analytics and AI, inferred information, re-identification, proxy discrimination, opacity, and data drift create significant risks. Privacy by design, DPIAs, minimisation, retention controls, supplier governance, and accountability provide a practical foundation for responsible data use.

Key Terms

Personal data: Information relating to an identified or identifiable natural person.

Processing: Any operation performed on personal data, including collection, use, disclosure, storage, or deletion.

Data subject: The individual to whom personal data relate.

Controller: Organisation that determines the purposes and means of processing.

Processor: Organisation that processes data on behalf of a controller.

Lawful basis: Legal justification for processing personal data.

Consent: Freely given, specific, informed, and unambiguous agreement to processing.

Legitimate interests: A lawful basis requiring necessity and balancing against individual rights.

Purpose limitation: Using data only for specified, explicit, and legitimate purposes.

Data minimisation: Limiting data to what is adequate, relevant, and necessary.

Pseudonymisation: Replacing identifiers with codes while retaining the possibility of re-linking.

Anonymisation: Processing intended to make identification no longer reasonably possible.

Special-category data: Sensitive data receiving enhanced legal protection.

Accountability: The duty to comply and demonstrate compliance.

Data protection impact assessment: Structured assessment of high-risk processing and mitigations.

Data portability: Right to receive certain data in a structured, machine-readable format.

Profiling: Automated processing used to evaluate or predict personal aspects.

Cross-border transfer: Sending or making personal data accessible across jurisdictions.

Privacy by design: Integrating privacy safeguards into system and process design.

Review Questions

Short Answer Questions

1. What is the difference between a controller and a processor?
2. Why does pseudonymisation not usually remove data from privacy law?
3. State the main requirements for valid consent.
4. What is the purpose of a retention schedule?
5. Name four data subject rights.

Long Answer Questions

1. Explain the relationship between lawfulness, fairness, and transparency, using a business analytics example.
2. Discuss the seven principal lawful bases for processing under the GDPR and the limitations of at least three.
3. Explain how purpose limitation and data minimisation should influence the design of an analytics project.
4. Describe the organisational and technical requirements for responding to a data subject access request.
5. Analyse the main legal and operational issues in cross-border personal-data transfers.

Analytical / Application Questions

1. A retailer wants to use customer purchase history, mobile location, and inferred income to determine credit offers. Assess the project using purpose limitation, minimisation, transparency, lawful basis, fairness, and automated-decision principles.
2. A university discovers that an old student database is being used to train a recruitment model. Identify the governance questions that must be answered before the model is deployed.
3. An organisation receives an erasure request from a customer whose data are also needed for an unresolved fraud investigation. Explain how the organisation should analyse and document the competing requirements.

Multiple Choice Questions with Answers

Question 1

Which principle requires personal data to be limited to what is adequate, relevant, and necessary?

A. Accuracy

B. Data minimisation

C. Storage limitation

D. Portability

Correct Answer: B. Data minimisation

Question 2

Which lawful basis is most directly associated with processing an address to deliver a product that a customer has purchased?

A. Contract

B. Vital interests

C. Public task

D. Consent only

Correct Answer: A. Contract

Question 3

Why is pseudonymised data generally still subject to privacy law?

A. It cannot be encrypted

B. It always contains a person’s name

C. Re-identification may remain reasonably possible

D. It is automatically classified as special-category data

Correct Answer: C. Re-identification may remain reasonably possible

Question 4

Which right allows an individual to request correction of inaccurate personal data?

A. Right to rectification

B. Right to restriction

C. Right to portability

D. Right to object

Correct Answer: A. Right to rectification

Question 5

Which statement about consent is correct?

A. It may normally be obtained through silence

B. It must be freely given, specific, informed, and unambiguous

C. It cannot be withdrawn after processing begins

D. It is always required for every processing activity

Correct Answer: B. It must be freely given, specific, informed, and unambiguous

Question 6

What is the primary purpose of a data protection impact assessment?

A. To calculate storage costs

B. To identify and mitigate risks from high-risk processing

C. To replace all security testing

D. To guarantee that processing is anonymous

Correct Answer: B. To identify and mitigate risks from high-risk processing

Question 7

Which activity is an example of processing personal data?

A. Deleting a dataset

B. Only collecting a person’s signature

C. Retrieving and analysing customer records

D. Publishing a law unrelated to data

Correct Answer: C. Retrieving and analysing customer records

Question 8

Which control most directly supports storage limitation?

A. A retention schedule with deletion rules

B. A larger database

C. A public marketing campaign

D. A model with more variables

Correct Answer: A. A retention schedule with deletion rules

Question 9

What should an organisation examine when assessing a cross-border transfer?

A. Only the colour scheme of the application

B. The destination, transfer mechanism, and supplementary safeguards

C. Only whether the data are stored in a spreadsheet

D. Whether the recipient has a marketing department

Correct Answer: B. The destination, transfer mechanism, and supplementary safeguards

Question 10

Why can a technically accurate analytics model still create a privacy or ethical problem?

A. Accuracy makes all processing unlawful

B. It may use excessive data, be opaque, or produce unfair effects

C. Models cannot process personal data

D. Privacy law prohibits all statistical prediction

Correct Answer: B. It may use excessive data, be opaque, or produce unfair effects