EU GENERAL DATA PROTECTION REGULATION (GDPR)
This regulation will replace all data protection legislation in EU member states. Companies need to be preparing for this now, and SMP Risk Managed can help you with Data Privacy Policies.
The GDPR, or General Data Protection Regulations, are new EU regulations which will make the current Data Protection regulations much stronger. The GDPR comes into force in May 2018 and, if breached, could result in a ﬁne of up to 4% of global turnover.
The data protection principles, as set out in the Data Protection Act 1998 (DPA) remain, but they have been condensed into six, as opposed to eight principles. Article 5 of the GDPR states that personal data must be:
Like the DPA, the GDPR will require data controllers to have a legitimate reason for processing personal data. If they rely on the consent of the data subject, they must be able to demonstrate that it was freely given, speciﬁc, informed and unambiguous for each purpose for which the data is being processed.
The preamble to the GDPR states: ‘Children deserve speciﬁc protection of their personal data, as they may be less aware of risks, consequences, safeguards and their rights in relation to the processing of personal data. This concerns especially the use of personal data of children for the purposes of marketing or creating personality or user proﬁles and the collection of child data when using services offered directly to a child.’
Data Subjects’ Rights
The list of rights that a data subject can exercise has been widened by section 2 of the GDPR. In addition, article 17 introduces a ‘right to be forgotten’, which means data subjects will be able to request that their personal data is erased by the data controller and no longer processed.
Data Protection by Design
Data controllers will be expected to include data protection controls at the design stage of new projects involving the processing of personal data.
The GDPR stipulates a requirement for data controllers to keep an internal record in relation to all personal data they process (Article 28).
Article 31 of the GDPR requires that, as soon as the data controller becomes aware a personal data breach has occurred, it should, without undue delay and, where feasible, not later than 72 hours after becoming aware of it, notify the personal data breach to the Information Commissioners Office (ICO).
The GDPR introduces much higher ﬁnes.
Data Protection Officer
Section 4 of the regulation introduces a statutory role of Data Protection Officer (DPO). Most organisations handling personal data, both data controllers and data processors, will require a DPO who will have a key role in ensuring compliance with the GDPR.
There are a lot of things that need to be taken into consideration and sorted well in advance of the go-live date of 25th May 2018. If you need speciﬁc help or need someone to discuss your requirements with, please contact SMP Risk Managed, by using our contact form, and we will call you right back.