The EU GDPR and Its Impact

Introduction

The EU General Data Protection Regulation has applied since 25 May 2018. Its purpose is to harmonize privacy law across Europe. It covers organizations and establishments in the European Union that process personal data.

Under certain conditions, it also applies to organizations outside the EU when processing relates to offering goods or services to people in the Union or monitoring their behavior.

Organizations therefore need to understand the requirements for lawful processing, the obligations the regulation creates, and the potential consequences of non-compliance.

Supervisory Authorities

Supervisory authorities monitor and enforce application of the regulation. They handle questions and complaints from data subjects, raise awareness of controllers' obligations, and investigate whether requirements are being observed.

Their powers range from warnings to instructions intended to protect data-subject rights. Depending on the infringement, penalties can reach EUR 20 million or four percent of worldwide annual turnover in the preceding financial year.

Data Protection Principles

The regulation is built around central principles for processing personal data. Data must be:

• processed lawfully, fairly, and transparently for the data subject,
• collected for specified, explicit, and legitimate purposes,
• limited to what is necessary for those purposes,
• accurate and kept up to date,
• and stored only for as long as the processing purpose requires.

Security and protection against unauthorized or unlawful processing, accidental loss, destruction, or damage are equally important. Appropriate technical and organizational measures should safeguard these objectives. Controllers must be able to demonstrate compliance with the principles.

Lawfulness

Processing may be based on the data subject's consent. Other possible legal bases include performance of a contract, compliance with a legal obligation, a task carried out in the public interest, and legitimate interests pursued by a controller or third party. The appropriate basis depends on the specific processing activity.

Data-Subject Rights

Data subjects have rights concerning their personal data, including:

• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• the right not to be subject solely to an automated individual decision
• the right to withdraw consent

Security of Processing

Controllers must implement appropriate technical and organizational measures after considering the nature, scope, circumstances, and purpose of the processing. The measures should be proportionate to the activities and risks, while accounting for implementation costs and the state of the art.

The measures described include:

• pseudonymization and encryption of personal data,
• the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services,
• the ability to restore availability and access following a physical or technical incident,
• and a process for regularly testing, assessing, and evaluating the effectiveness of the measures.

This article reflects the information available at the time of publication and does not constitute legal advice.