14-Aug-2018
How to Prepare your Company for the GDPR
Written by Nasser Messaik
GDPR came into force on May 25, 2018
The
General Data Protection Regulation (“GDPR”) (EU Regulation 2016/679) is
a regulation setting out the rules and protection framework for
collecting and processing personal data within the European Union
territory and which applies, to a broader extent, to all
non-EU-companies controlling or processing personal data within or
coming from EU data subjects.
The principles of the personal data
management, the protection of the human rights namely the right to
privacy, and possible penalties in case of non-compliance are all set
out in the GDPR. As highlighted, all companies that deal with EU’s
citizens are subjected to the GDPR which came into force across the
European Union since May 25, 2018. The European Union Commission along
with all the national data protection authorities worked on the GDPR and
had intensive discussion for about four years to bring the GDPR into
legislation.
The GDPR was implemented directly in all EU Member
states and does not require national governments to pass any enabling
legislation. It has entirely replaced the current data protection laws
based on the former EU Privacy Directive (Directive 95/46/EC).
Nevertheless, the EU members will be able, at their own discretion, to
provide specific rules in light of the GDPR that will be enforced by the
national EU data protection authorities of each member state. In case
of cross border or multinational processing one of the EU data
protection authority will be assigned as the supervisory data protection
authority for leading such matters.
European Union law and in
particular the former Directive, have safeguarded the idea and
conception that everyone has the sacred right to privacy and to guard
their personal information safe. Personal data can only be gathered
lawfully under severe conditions. Moreover, individuals or organizations
which gather and manage personal data must guard it from
misappropriation and respect the rights of the data owners which are
protected by European Union law.
Businesses, public authorities
and people transfer a massive amount of personal information across
borders within the European Union. Contradicting data protection
legislation in different countries would disturb global exchange which
may lead individuals unwillingly to transfer personal information abroad
if they are unsure of the level of safety of other countries. With that
in mind, the European Union’s goal was to establish a set of rules in
order to certify that personal information would be on a high level of
safeguarding everywhere in the EU.
The GDPR’s aim is
principally to give control back to individuals over their personal data
and to abridge the regulatory environment for international business by
uniting the regulation within the EU.
GDPR principles:
- Scope
of application: the regulation applies if the data controller
(organization that collects data from EU residents) or processor
(organization that processes data on behalf of data controller) or the
data subject is based in the EU (presence of an establishment with a
single imperative should be sufficient). Moreover, the regulation also
applies to organizations based outside the European Union if they
collect or process personal data of EU residents.
- “Personal
Data” under GDPR: any information relating to an individual or
identifiable natural person. Examples of personal data are among others
name, address, photo, email address, bank details, posts on social
networking websites, medical information, or a computer’s IP address, in
addition to biometric data, health and genetic data, racial or ethnic
data, political opinions, and sexual orientation.
- GDPR increases
the protection of individuals and their personal data: the processing
of personal data should be lawful and fair. The storage of personal data
should be accurate, adequate, relevant and limited to the minimum
amount of data necessary for a given situation. The processing of
personal data should refer to one of the legal ground listed in the GDPR
including the following:
the data subject has given consent to the processing of the individual’s private data for one or more precise purposes;
- processing
is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data
subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary to protect the vital interests of the data subject or of another natural person;
- processing
is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the
controller; and,
- processing is necessary for the purposes of the
legitimate interests pursued by the controller or by a third party,
except where such interests are dominated by the interests or
fundamental rights and freedoms of the data subject which involve
protection of personal information, where the data subject is a child.
- Principle
of transparency: any information or reason associated to the processing
of personal data should be clear and easily accessible.
- New
obligations implemented by the GDPR: in particular the obligation to
appoint a Data Protection Officer (“DPO”) in larger companies, to
perform a Privacy Impact Assessment (“PIA”) and to notify data leaks to
the relevant data protection authorities.
In case of
non-compliance, administrative fines can be imposed by the data
protection authorities up to EUR 20,000,000 or 4% of the global
turnover, whichever is higher.
The GDPR has led in the
recent years to substantial changes in the legislation in several
jurisdictions where if the new legislations would not be as strict and
complete as the GDPR, they will nevertheless open a better protection
path to personal data such as the Qatari law no. 13 of 2016.
These
recent legislative developments have real impact on the day-to-day
operations of your business and our primary advice for your company to
prepare for the GDPR would be:
- to set sense of urgency that comes from top management
- to create a data protection mapping and planning;
- to involve all the stakeholders;
- to hire or appoint a DPO (Data Protection Officer) in the case of larger companies;
- to
review and amend your contractual documentation involving processing of
personal data with your suppliers in light of the GDPR or any evolving
data protection applicable laws.