The European Union’s General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in over two decades, are you prepared for it? If the answer is no & you handle other people’s personal data, then you better get a move on – educate yourself & take necessary steps to avoid being hit with hefty fines, before GDPR comes into force across all EU member states on 25 May 2018. Well done for discovering my article, read on to gather ideas, tactics & strategies on how to tackle this going forward & be GDPR-ready.
The EU Parliament spent over 4 years discussing and negotiating the GDPR and finally approved it on 14 April 2016 and set the enforcement date for 25 May 2018 – from that date any organisation that operates within the European Union (EU) or handles personal data belonging to EU citizens and fails to comply with the new regulation could face heavy fines and/or be suspended from carrying out business activities within the EU.
The GDPR is a new set of rules governing the privacy and security of personal data with the aim to harmonise data privacy laws across Europe, to protect and empower all EU citizens’ data privacy and to reshape the way organisations approach data privacy. The GDPR replaces the previous 1995 Data Protection Directive law which current UK law is based upon.
The introduction of this new set of rules has been designed to give control back to EU citizens over how their data is processed and used, as well as to simplify the regulatory environment. In Europe the privacy is a fundamental right of every citizen, it is about ensuring the rights and freedom of all EU citizens and ensuring that data is not put at higher risk or violated, it’s about protecting that data so the concept of privacy and security is what the GDPR has been formed around.
‘Brexit’ is happening, should you still prepare?
You will need to comply with the GDPR if you process data about individuals in other EU member states through activities such as selling goods or services to EU citizens. If you only deal within the UK, then the position after UK’s exit from EU is unclear, but the British government has indicated it will implement an equivalent legislation, the Data Protection Bill, which is expected to largely mirror the EU’s GDPR.
Are small/micro companies going to be impacted?
Yes, individuals, organisations & companies that handle any personal data such as name, address, IP address which can be used to identify a person or personal sensitive data such as religion, political views, sexual orientation, biometric data etc. will need to comply with the GDPR.
In the event of a data breach, you must notify your countries data protection agency, which in the UK is the Information Commissioner’s Office (ICO) of any risk within 72 hours and you must also notify affected individuals in certain circumstances.
Object to automated decision-making processes – Where decisions are solely made by automated means without any human involvement, and profiling where automated processing of personal data is used to evaluate certain things about an individual which can be part of an automated decision-making process.
Enforce penalties of up to €20 million or 4% of annual global turnover (whichever is greater) for non-compliance.
Commercial data use restriction – GDPR poses restriction on businesses on what they can do with data to extract commercial benefits.
Compliance spending – operational processes and data structural changes can cost a huge sum of money on compliance spending.
May lead to loosing customers and trust if found to be non-compliant with GDPR as risk around data security may exist.
A recent research carried out by VPN Mentor (the web privacy experts) found approximately 66% of websites in the EU are not GDPR compliant. Unsurprising Germany has the most websites (67%) that do meet the GDPR standards and worrying the U.K pales in comparison with only 31%. You can read the full report by clicking here.
Review the data breach plan, you need to be able to report breaches within 72 hours – If your a data controller or data processor, It’s critical to know what your responsibilities are to your partner controller or processor.
I hope you found my article interesting, informative and useful and hopefully it has helped you better understand and prepare for the incoming GDPR. You can watch my presentation video by clicking here or why not expand you knowledge further on GDPR by clicking here.