������

Understanding the legal implications

IT law and data governance researcher, Professor Dr Sophie Stalla-Bourdillon at Southampton, examines what this means for businesses and individuals. 

Personal data must be processed for a specific reason, lawfully and transparently. It must be used with consent of the data subject and must not be held for longer than needed.

This change is better for individuals because we now have:

• the choice to ‘opt in’, rather than ‘opt out’ of company privacy policies
• the right to have our information removed from company records

The implications for organisations is that they need to make sure governance structures are in place to comply with the legislation.

Creating opportunities with anonymisation

Working with data using techniques like anonymisation or pseudonymisation can also present valuable opportunities. Anonymisation removes information that can identify an individual person in a data set and pseudonymisation replaces it. 

Sophie is studying how these approaches can be used:

Sophie’s work will help companies understand when they are dealing with personal data, and when they are outside of the scope of the GDPR.

Sophie again:

Connecting organisations working with data

Southampton is also leading – an international innovation programme working to connect organisations with subject matter experts and start-ups working with data.

The Data Pitch team are investigating how data can be used to solve problems across different industries including:

• sport and recreation
• retail supply chains
• tourism
• lifelong learning
• transport

Sophie says: