GDPR Explained 2017-08-09T09:03:15+00:00

GDPR Explained

This is one of the biggest ever changes to your obligation on managing your customers data. It’s only right that we work together to get on top of this issue. Here is a helpful starting point.

Did you know?

Potential fines of up to £17million or 4% of annual turnover

Comes into force 25/05/18

All businesses will be affected

The EU data protection reforms promise to be the biggest shake up for consumers’ data protection rights for three decades. Organisations simply cannot afford to fall behind.
– Information Commissioner’s office

What is the GDPR?

After four years of preparation and debate, the new General Data Protection Regulation (GDPR), was finally approved by the EU Parliament on the 14th of April 2016. The GDPR replaces the Data Protection Directive 94/46/EC and has been designed to harmonise data privacy laws across Europe, to protect and empower all EU citizen’s data privacy and to reshape the way organisations across the region approach data privacy.

The GDPR threatens significant fines and penalties for non-compliant data controllers and processors. It will mean an increase in the maximum fine the Information Commissioner’s Office (ICO) can impose upon companies who have not adequately protected themselves against data theft from £500,000 to £17 million (or four percent of turnover). Needless to say changes to the governance of data will have far-reaching consequences for your business.

The drivers behind the GDPR are twofold. Firstly, the EU wants to give people more control over how their personal data is used. Secondly, the EU wants to give businesses a simpler, clearer legal environment in which to operate, making data protection law identical throughout the single market.

So who does the GDPR apply to?

The answer; ‘Controllers’ and ‘processors’ of data. A data controller states how and why personal data is processed, while a processor is the party doing the actual processing of the data. So the controller could be any organisation, from a profit-seeking company to a charity or government. A processor could be an IT firm doing the actual data processing. Even if controllers and processors are based outside the EU, the GDPR will still apply to them so long as they’re dealing with data belonging to EU citizens. It’s the controller’s responsibility to ensure their processor abides by data protection law and processors must themselves abide by rules to maintain records of their processing activities. If processors are involved in a data breach, they are far more liable under GDPR than they were under the Data Protection Act.

Why is the GDPR needed?

The European Union’s General Data Protection Regulation (GDPR) represents the biggest change to global privacy laws for over 20 years. The GDPR represents the culmination of over five years of effort to modernise data protection. The EU Directive on Data Protection (95/46/EC), adopted back in 1995, could not have anticipated the increasing importance and reach of the Internet, or the exponential growth in methods for the mass-processing of data. In response to these needs, the GDPR has superseded the previous EU Directive to create a unifying data protection law for all EU Member States.

The GDPR applies to personal data relating to EU residents regardless of where it is processed. It redefines the scope of EU data protection legislation, forcing organisations worldwide to comply with its requirements. While the GDPR is based on the same data protection principles as its predecessor, it introduces new rights for data subjects. Robust data protection is not simply a burden on an organisation; good data protection practices should protect both brand and reputation, and improve data quality.

Will the GDPR set up a one-stop-shop for data privacy regulation? 2017-08-08T12:08:02+00:00

The discussions surrounding the one-stop-shop principle are among the most highly debated and are still unclear as the standing positions are highly varied. The Commission text has a fairly simple and concise ruling in favour of the principle, the Parliament also promotes a lead DPA and adds more involvement from other concerned DPAs, the Council’s view waters down the ability of the lead DPA even further.

How does the GDPR affect policy surrounding data breaches? 2017-08-08T12:07:06+00:00

Proposed regulations surrounding data breaches primarily relate to the notification policies of companies that have been breached. Data breaches which may pose a risk to individuals must be notified to the DPA within 72 hours and to affected individuals without undue delay.

Does my business need to appoint a Data Protection Officer (DPO)? 2017-08-08T12:06:31+00:00

DPOs must be appointed in the case of: (a) public authorities, (b) organizations that engage in large scale systematic monitoring, or (c) organizations that engage in large scale processing of sensitive personal data. If your organization doesn’t fall into one of these categories, then you do not need to appoint a DPO.

What is the difference between a regulation and a directive? 2017-08-08T12:05:51+00:00

A regulation is a binding legislative act. It must be applied in its entirety across the EU, while a directive is a legislative act that sets out a goal that all EU countries must achieve. However, it is up to the individual countries to decide how. It is important to note that the GDPR is a regulation, in contrast the previous legislation, which is a directive.

What about Data Subjects under the age of 16? 2017-08-08T12:05:02+00:00

Parental consent will be required to process the personal data of children under the age of 16 for online services; member states may legislate for a lower age of consent but this will not be below the age of 13.

Do data processors need ‘explicit’ or ‘unambiguous’ data subject consent – and what is the difference? 2017-08-08T12:04:20+00:00

The conditions for consent have been strengthened, as companies will no longer be able to utilise long illegible terms and conditions full of legalese, as the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent – meaning it must be unambiguous. Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it. Explicit consent is required only for processing sensitive personal data – in this context, nothing short of “opt in” will suffice. However, for non-sensitive data, “unambiguous” consent will suffice.

What is the difference between a data processor and a data controller? 2017-08-08T12:03:32+00:00

A controller is the entity that determines the purposes, conditions and means of the processing of personal data, while the processor is an entity which processes personal data on behalf of the controller.

What constitutes personal data? 2017-08-08T12:02:51+00:00

Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address

What are the penalties for non-compliance? 2017-08-08T12:02:08+00:00

Organizations can be fined up to 4% of annual global turnover for breaching GDPR or €20 Million. This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors — meaning ‘clouds’ will not be exempt from GDPR enforcement.

Who does the GDPR affect? 2017-08-08T12:01:28+00:00

The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.

In light of an uncertain ‘Brexit’ – I represent a data controller in the UK and want to know if I should still continue with GDPR planning and preparation? 2017-08-08T11:59:45+00:00

If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR, irrespective as to whether or not you the UK retains the GDPR post-Brexit. If your activities are limited to the UK, then the position (after the initial exit period) is much less clear. The UK Government has indicated it will implement an equivalent or alternative legal mechanisms. Our expectation is that any such legislation will largely follow the GDPR, given the support previously provided to the GDPR by the ICO and UK Government as an effective privacy standard, together with the fact that the GDPR provides a clear baseline against which UK business can seek continued access to the EU digital market.

When is the GDPR coming into effect? 2017-08-08T11:58:51+00:00

The GDPR was approved and adopted by the EU Parliament in April 2016. The regulation will take effect after a two-year transition period and, unlike a Directive it does not require any enabling legislation to be passed by government; meaning it will be in force May 2018.

Fill out the form to arrange a no obligation call about how we can help you prepare for the GDPR.

Confused by all the new terms? Need to cure your insomnia? Have a look at this Glossary of Terms and Definitions used in relation to GDPR.

Glossary