General Data Protection Regulation (GDPR)

Introduction

The General Data Protection Regulation (“GDPR” or “Regulation”) is the privacy and security law of the European Union (“EU”). Passed by the European Parliament and coming into force in 2016, GDPR requires all organizations that target or collect data related to people in the EU to be compliant as of May 25, 2018. The primary objective of the Regulation is to protect the fundamental rights and freedoms of natural persons, particularly their right to the protection of personal data.

The Regulation outlines rules concerning the processing of personal data and the free movement of such data within the EU.

Scope

According to Article 2 of GDPR, the Regulation applies to the processing of personal data by automated means as well as processing by other means of personal data that forms part of, or is intended to form part of, a filing system.

The GDPR applies if the data controller (an organization that collects data from EU residents), or the data processor (an organization that processes data on behalf of a data controller), or the data subject (person) is based in the EU. It also applies to organizations outside the EU if they collect or process personal data of individuals located inside the EU. However, it does not apply to data processing by a person for purely personal or household activities.

Key Terms and Definitions

Data Subject:

The person whose data is processed.

Data Controller:

The person who decides why and how personal data will be processed.

Data Processor:

A third party that processes personal data on behalf of a data controller.

Personal Data:

Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processing:

Any operation or set of operations performed on personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

Key Principles of GDPR

Article 5 of the Regulation outlines key principles regarding personal data:

• Lawfulness, Fairness, and Transparency: Processing must be done lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose Limitation: Personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data Minimization: Only adequate, relevant, and limited personal data necessary for the purposes for which they are processed should be collected.
• Accuracy: Personal data must be kept accurate and up to date. Reasonable steps should be taken to ensure that inaccurate data is erased or rectified without delay.
• Storage Limitation: Personal data should be kept in a form which allows identification of data subjects for no longer than necessary for the purposes for which the data is processed.
• Integrity and Confidentiality: Personal data must be processed securely, with protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

The data controller is responsible for demonstrating compliance with these principles.

Lawful Basis for Processing

Article 6 of the Regulation specifies that processing is lawful if at least one of the following applies:

• The data subject has given consent for processing personal data for one or more specific purposes.
• Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the data subject's request prior to entering into a contract.
• Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Processing is necessary to protect the vital interests of the data subject or another natural person.
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Rights of the Data Subject

Articles 15-22 of the Regulation outline the rights of data subjects:

• Right to Access (Article 15): The data subject has the right to obtain confirmation from the controller on whether personal data concerning them are being processed and access to such data and related information.
• Right to Rectification (Article 16): The data subject has the right to obtain the rectification of inaccurate personal data concerning them.
• Right to Erasure (Article 17): The data subject has the right to obtain the erasure of personal data in certain circumstances, such as when data is no longer necessary or has been unlawfully processed.
• Right to Restriction of Processing (Article 18): The data subject has the right to obtain restriction of processing in certain circumstances, such as when the accuracy of data is contested.
• Notification Obligation (Article 19): The controller must communicate any rectification, erasure, or restriction of processing to each recipient to whom the data have been disclosed.
• Right to Data Portability (Article 20): The data subject has the right to receive personal data provided to a controller and to transmit it to another controller without hindrance.
• Right to Object (Article 21): The data subject has the right to object at any time to processing of their personal data. The controller must cease processing unless compelling legitimate grounds override the data subject's interests.
• Automated Individual Decision-Making (Article 22): The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, that produces legal effects or significantly affects them.

Remedies, Liabilities, and Penalties

Articles 77-84 of the Regulation outline remedies, liabilities, and penalties. Data subjects have the right to lodge complaints with a supervisory authority in their state of residence, place of work, or where the infringement occurred.

Individuals who suffer material or non-material damage due to GDPR infringement can receive compensation from the controller or processor. Fines may also be imposed, with less severe infringements resulting in fines up to €10 million or 2% of the firm's worldwide annual revenue, and more severe infringements up to €20 million or 4% of the firm's annual revenue.

Given the scope of the Regulation and potential fines for non-compliance, it is crucial for entities processing personal data of EU residents to implement mechanisms to ensure GDPR compliance.