SCOPE
The regulation applies if the
- data controller (organization that collects data from EU residents)
- or processor (organization that processes data on behalf of data controller e.g. cloud service providers)
- or the data subject (person)
is based in the EU. Furthermore, the Regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents. Per the European Commission, “personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from
- a name,
- a home address,
- a photo,
- an email address,
- bank details,
- posts on social networking websites,
- medical information,
- or a computer’s IP address.”
The regulation does not apply to the processing of personal data for national security activities or law enforcement; however, the data protection reform package includes a separate Data Protection Directive for the police and criminal justice sector that provides robust rules on personal data exchanges at national, European and international level.
SINGLE SET OF RULES AND ONE-STOP SHOP
A single set of rules will apply to all EU member states. Each member state will establish an independent Supervisory Authority (SA) to hear and investigate complaints, sanction administrative breaches, etc. SA’s in each member state will cooperate with other SA’s, providing mutual assistance and organizing joint operations. Where a business has multiple establishments in the EU, it will have a single SA as its “lead authority”, based on the location of its “main establishment” (i.e., the place where the main processing activities take place). The lead authority will act as a “one-stop shop” to supervise all the processing activities of that business throughout the EU. A European Data Protection Board (EDPB) will coordinate the SAs.
There are exceptions for data processed in an employment context and data processed security, that still might be subject to individual country regulations.
RESPONSIBILITY AND ACCOUNTABILITY
The notice requirements remain and are expanded. They must include the retention time for personal data and contact information for data controller and data protection officer must be provided.
Automated individual decision-making, including profiling (Article 22) is made disputable. Citizens now have the right to question and fight decisions that affect them that have been made on a purely computer generated basis.
To be able to demonstrate compliance with the GDPR, the data controller should implement measures which meet the principles of data protection by design and data protection by default. Privacy by Design and by Default require that data protection measures are designed into the development of business processes for products and services. Such measures include pseudonymizing personal data, by the controller, as soon as possible.
It is the responsibility and liability of the data controller to implement effective measures and can demonstrate the compliance of processing activities even if the processing is carried out by a data processor on behalf of the controller.
Data Protection Impact Assessments must be conducted when specific risks occur to the rights and freedoms of data subjects. Risk assessment and mitigation is required and prior approval of the Data Protection Authorities (DPA) is required for high risks. Data Protection Officers (DPO) are to ensure compliance within organizations.
DPO must be appointed:
- for all public authorities, except for courts acting in their judicial capacity
- if the core activities of the controller or the processor consist of
- by their nature, their scope and/or their purposes, require regular and systematic
monitoring of data subjects on a large scale - processing on a large scale of special categories of data pursuant to Article 9 and
personal data relating to criminal convictions and offences referred to in Article 10
processing operations which, for the purposes of national
bleu-azur-consulting.eu 