On 4 May 2016 the European Parliament and the European Council published the new General Data Protection Regulation (GDPR) in the Official Journal of the European Union. This is the final step of a legislative process spanning over five years. According to Art. 99 Sec. 2 GDPR it will enter into force on 25 May 2018.
For further details, please see our comprehensive summary, dated 7 November 2013 (here), as well as our alerts on 24 April 2014 (here) and on 14 January 2016 (here).
Key elements of the GDPR include:
- Right to be forgotten
- Right to data portability
- A decision cannot solely be taken based on automated data processing
- Implementing data protection by design and by default
- Enhanced obligations to notify the relevant Data Protection Authority within 72 hours of a data breach
- The need to carry out privacy impact assessments before high risk processing
- “Lead authority” approach to cross-border processing
- Increased penalties - up to 4 % of group annual worldwide turnover in the preceding financial year
The GDPR will be directly applicable throughout the European Union – and even beyond if a company processes personal data of European citizens regarding offering them goods or services or monitoring their behavior within the European Union.
Over the next two years, the impact of the GDPR will be discussed. Some practical questions are:
- How to draft data protection clauses in contracts which (potentially) run until after 25 May 2018. Parties need to take the GDPR into account.
- How to implement and execute the right to data portability. A company needs to be prepared to provide personal data in a way that another company can easily import it.
- How to carry out a privacy impact assessment. A white paper has already been published to characterize a tool to prepare such assessment.
- The remaining scope of national data protection law, in other words the data protection regime under, for example, the German Teleservices Act and employment data protection.
We will provide you with updates on these discussions on a regular basis.