What is GDPR
The General Data Protection Regulation (GDPR) is a new set of EU regulations over personal data protection and privacy. It is composed of two parts, GDPR and the Data Protection Directive.
GDPR Summary
The GPDR replaces the 1995 Data Protection Directive 95/46/EC and addresses the treatment of EU consumers’ personally identifiable information (PII). Since the creation of the Data Protection Directive, the complexity of our technological environment has evolved. Data used by modern smart phones and social media are not covered in the 1995 Data Protection Directive.
GDPR Requirements
GDPR sets responsibility and accountability with corporations, defining what companies can and can not do with personal data, requiring data breaches be reported in 72 hours, setting encryption standards, requiring clear consent for consumers, stipulating how long data may be held, and requiring data protection by design and by default. Under GDPR, certain organizations are required to elect a Data Protection Officer. This figure is held accountable for data management at a given organization and serves as a primary point of contact with the regulatory authority. The new requirements have a major impact on how companies communicate with consumers and also how they manage the data they hold.
For EU consumers, GDPR provides control over your personal data. The data considered under the new set of rules include: names, IP addresses (location), pictures, email addresses, home addresses, social media activity, banking information, and medical details. The regulation grants consumers the right to request a copy of their data, the right to opt-out at any time, and the right to request that their personal data be deleted, although the latter is not a universal right.
Compliance with GDPR
Compliance with GDPR is enforced by the European Union with the Data Protection Directive. The directive provides the legal infrastructure to support the reform, ensuring consumers’ rights to their data and that infractions are punished.
Regulation
The regulation is applicable for any organization managing the personal data of EU residents. This includes companies in the United States, and other countires outside of the European Economic Area, with access to European consumers’ data.
The 2018 GDPR is a more encompassing regulation that harmonizes rules across the European Union and the European Economic Area. This simplifies the regulatory landscape for companies, decreasing the total costs of compliance, and makes the EU a more competitive market.
GDPR Official Text
The official text can be found here.
Deadline to Implement
The deadline for the regulation to go into effect was May 25, 2018, however many companies will fail to meet this deadline due to the scope of changes required. The impact of the new regulation has been substantial on some companies’ operating models. Tech giants such as Google, Facebook, and Amazon will face considerable challenges around the new reforms.
Data Protection in the U.K.
Although the UK has decided to leave the European Union during the Brexit referendum, Parliament has enacted an equivalent legislation called the Data Protection Act 2018.
Data Protection in the United States
The recent Cambridge Analytica scandal was also a major influencer. The now bankrupt UK-based political consulting firm, Cambridge Analytica, was hired by the 2017 Trump Campaign and is alleged to have gained access to 87 million Facebook users’ personal data via a third party. This breach is currently being examined for its potential impact on the 2016 US Presidential Election.
Penalties for Non-Compliance
The new regulation imposes fines for non-compliance, after a warning has been issued for a first offense. Depending on the nature of the offense, the imposable penalty is up to $10 million USD or 4% of global revenue, whichever is higher.
Facebook GDPR
Facebook is the first company under review against its compliance with GDPR and could face a substantial fine. Facebook and other social media platforms, such as Instagram, use pre-selected consent. GDPR requires that the consumer have a clear action to opt-in before sharing personal data.
Google GDPR
Google has a substantial footprint in the European Union and is being investigated for infractions against GDPR. Similar to Facebook, Google uses a pres-selected consent checkbox. If found guilty, the potential fine could reach €4 billion ($5.2 billion USD).
