The final draft of the new European General Data Protection
Regulation (GDPR) was agreed on 15 December 2015 and, once it has
been approved by the European Parliament in early 2016, is expected
to take effect by early 2018. This reform aims to update data
protection law to address the challenges of the digital age while
simultaneously protecting the rights of individuals and enabling
businesses to utilise personal data in a more consistent manner
across the European Union. The GDPR will be directly applicable in
the same form in all EU Member States with the intention of
reducing the burden on international organisations that, up until
now, have had to vary their compliance to satisfy the particular
data protection requirements of each Member State.
The key points to take away from the GDPR are as follows:
- International application of
the GDPR
European data protection law will now apply depending on the type of data processing being undertaken and not necessarily depending on where that processing is being carried out. In addition to data controllers (persons that determine the purposes for which personal data is processed) that are established in the European Union, data controllers located outside the EU that process personal data in relation to offering goods or services to individuals within the EU, or as a result of monitoring individuals within the EU, will be subject to the GDPR. Non-EU organisations will need to consider whether their activities are caught by the GDPR and whether they must appoint a European representative to take responsibility for their actions. - Tougher
sanctions
The GDPR has substantially increased the maximum fine that may be imposed on organisations that breach EU data protection law. The maximum fines for a breach of the GDPR will be 4% of an enterprise's worldwide turnover or €20 million, whichever is higher. - Data breach notification
obligations
GDPR introduces an express obligation for controllers to notify breaches of security relating to personal data to the relevant data protection authority where the breach is likely to cause a degree of risk to the data subject. Data controllers must notify the authority without undue delay and where feasible within 72 hours of the breach. Where an authority has not been notified within 72 hours, a reasoned justification for the delay must also be given. Controllers must also communicate the fact that there has been a personal data breach to the data subject without undue delay where there is a high risk to the individual's rights and freedoms. Data processors (persons that process personal data on a data controller's behalf) must notify the relevant data controller of a security breach without undue delay. Policies of controllers and processors that relate to responding to security breaches will need to be amended and tested ahead of the implementation of the GDPR. - Liability for data
processors
Data processors will have direct obligations to comply with the GDPR under certain circumstances and data protection authorities may take action against them for breaching the GDPR. Processors will be held accountable for their own level of appropriate security and must document their processing to the same extent required by controllers under the GDPR. Processors must obtain the prior consent of the controller to employ sub-processors, while controllers must only use processors that provide sufficient guarantees to implement appropriate technical and organisational measures to meet the requirements of the GDPR. Data controllers will need to amend their contracts with processors (typically service providers) to address the shift in the processors' responsibilities. - Privacy by
design
GDPR introduces the concept of 'privacy by design', whereby appropriate levels of security are built-in to an organisation's data processing procedure. Data controllers are required to take a proactive approach to ensure that an appropriate standard of data protection is the default position taken when personal data is being processed. The controller must take into account the cost of implementing the required technical and organisational measures. Controllers need to consider the risks posed to individuals by the processing instead of setting precise benchmarks for compliance, and make suggestions about how to minimise risk, for example using anonymisation or pseudonymisation. - Stricter
governance
Data controllers will be required to undertake impact assessments for higher risk processing. These assessments would generally include an evaluation of the risk posed to the data subject as well as the measures envisaged to address the risk. The data controllers and data processors will need to appoint a data protection officer to carry out relevant assessments of an organisation's data processing in certain circumstances. - Strengthening of data
subjects' rights
An individual will have the right to have their personal data removed from a controller or processor's system or online content (the 'right to be forgotten'). Controllers will need to judge whether freedom of expression and information prevails over the protection of personal data. Individuals will also have the right not to be subject to automated data profiling (where this would produce a 'legal effect'). An individual will also have the right to be given a copy of the personal data relating to them by a data controller in a commonly used format and to have that information transmitted to another data controller without hindrance (the 'right to data portability').
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2015. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
