Know About (GDPR) General Data Protection Regulation

General Data Protection Regulation (GDPR).

The General Data Protection Regulation (GDPR) is a comprehensive and complex regulation that governs how organisations within the European Union (EU) and those that process the personal data of EU citizens, must handle personal data. The regulation came into effect on May 25th, 2018, and aims to strengthen data protection for individuals by providing greater control and protection over their personal data.

The GDPR replaces the previous Data Protection Directive from 1995, and the primary objective is to harmonise data protection laws across the EU. This means that organisations need to comply with one set of rules instead of multiple sets of national data protection laws. The GDPR is based on the principle of data protection by design and by default, which means that data protection should be an integral part of the design and implementation of any system, service, or product that processes personal data.

Personal data, as defined by the GDPR, includes any information that can identify an individual directly or indirectly. This includes a person’s name, address, phone number, email address, identification number, location data, online identifier, or any other information specific to that person. The regulation also includes special categories of personal data, which include information about an individual’s health, religion, race, ethnicity, or sexual orientation.

1. Who does GDPR apply to?

The General Data Protection Regulation (GDPR) applies to any organisation, regardless of its location, that processes personal data of individuals who are in the European Union (EU). This means that GDPR applies not only to organisations that are based in the EU but also to organisations that are based outside the EU but process personal data of EU citizens.

Under GDPR, personal data is defined as any information that relates to an identified or identifiable natural person, such as a name, identification number, location data, or online identifier. This includes data that is processed automatically, such as through computer systems and other electronic devices.

The GDPR applies to all sectors and industries, including public and private organisations, non-profit organisations, and government agencies. It applies to data processing activities that take place within the EU, as well as to organisations outside the EU that process personal data of EU citizens.

Some organisations are required to appoint a Data Protection Officer (DPO) under the GDPR. This includes organisations that process large amounts of sensitive personal data, such as health or financial data, or that engage in large-scale processing of personal data, such as profiling individuals or monitoring their behaviour.

Overall, the GDPR is a comprehensive regulation that applies to a broad range of organisations and data processing activities, with the goal of protecting the privacy and personal data of EU citizens.

2. What are the key principles of GDPR?

The General Data Protection Regulation (GDPR) is based on six key principles that organisations must follow when processing personal data. These principles are:

The law requires that personal data be handled fairly, transparently, and in accordance with the law. Organisations must obtain explicit consent from individuals for the processing of their personal data and provide clear and transparent information on how data is collected and processed.

Personal data must only be collected and processed for specific, explicit, and legitimate purposes. Organisations must not process personal data in a way that is incompatible with these purposes.

Data minimization: Personal data must be sufficient, pertinent, and limited to what is required for the processing purposes. Organisations must not collect or retain personal data that is unnecessary or excessive.Personal information must be accurate and up to date.Organisations must take reasonable steps to ensure that personal data is accurate and correct errors in a timely manner.
Storage limitation: Personal data must be kept for no longer than necessary for the purposes for which it is processed. Organisations must establish appropriate retention periods and delete personal data when it is no longer needed.
Integrity and confidentiality: Personal data must be processed in a manner that ensures appropriate security and confidentiality. Organisations must implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, or loss.

Overall, the key principles of GDPR are designed to ensure that personal data is processed in a fair, transparent, and secure manner, with appropriate safeguards in place to protect individuals’ privacy and rights.

3. What are the penalties for non-compliance with GDPR?

The penalties for non-compliance with the General Data Protection Regulation (GDPR) can be severe, and can include fines and other sanctions. The GDPR provides for two levels of administrative fines, depending on the severity of the violation:

Up to 10 million euros or 2% of the global annual revenue of the preceding financial year, whichever is higher.
Up to 20 million euros or 4% of the global annual revenue of the preceding financial year, whichever is higher.

For more serious violations, such as failing to obtain valid consent for processing personal data, failing to notify data breaches, or failing to implement appropriate security measures to protect personal data, higher fines may be imposed.

In addition to fines, organisations that fail to comply with the GDPR may also face other sanctions, including:

Orders to cease processing personal data
Orders to delete personal data
Bans on processing personal data altogether
Suspension or revocation of certifications or authorizations
Reputational damage and loss of customer trust

It is worth noting that fines and sanctions under the GDPR are imposed by national data protection authorities in each EU member state, which may have different interpretations of the law and different approaches to enforcement. Therefore, organisations that process personal data of EU citizens should ensure that they comply with the GDPR’s requirements to minimise the risk of penalties and other sanctions.

4. What is a Data Protection Officer (DPO)?

A Data Protection Officer (DPO) is an individual appointed by an organisation to oversee its data protection strategy and ensure compliance with data protection laws, including the General Data Protection Regulation (GDPR). The DPO’s primary responsibilities include:

Informing and advising the organisation and its employees on data protection laws and requirements.
tracking adherence to data protection laws, such as the GDPR.
Providing advice on data protection impact assessments (DPIAs).
Serving as a point of contact for data protection authorities and individuals whose data is being processed by the organisation.
Cooperating with data protection authorities and assisting with data protection audits.

Under the GDPR, some organisations are required to appoint a DPO, including those that:

Process large amounts of sensitive personal data, such as health or financial data.
Engage in large-scale processing of personal data, such as profiling individuals or monitoring their behaviour.
Are public authorities or government agencies.

Even if an organisation is not required to appoint a DPO, it may choose to do so voluntarily as a best practice to ensure effective data protection and compliance with the GDPR. The DPO may be an internal employee or an external consultant, but must have appropriate expertise and qualifications in data protection law and practices.

5. What exactly does a Data Protection Impact Assessment (DPIA) entail?

A Data Protection Impact Assessment (DPIA) is a tool used to assess and mitigate the risks associated with processing personal data. It is a process that organisations must follow when planning to introduce new data processing activities that may pose a high risk to the rights and freedoms of individuals, the General Data Protection Regulation’s definition (GDPR).

The purpose of a DPIA is to identify and analyse the potential risks to individuals’ privacy and data protection rights, and to determine whether the proposed processing activities are necessary and proportionate to achieve the intended purpose. The DPIA process typically involves the following steps:

Description of the processing activity: The organisation describes the purpose, nature, scope, and context of the proposed processing activity.
Assessment of necessity and proportionality: The organisation assesses whether the proposed processing activity is necessary and proportionate to achieve the intended purpose, and considers alternative approaches.
Assessment of risks: The organisation identifies and assesses the potential risks to individuals’ rights and freedoms, such as the risk of unauthorised access, accidental or unlawful destruction, loss, alteration, or disclosure of personal data.
Mitigation of risks: The organisation identifies and evaluates measures to mitigate the identified risks, such as technical and organisational measures to ensure security and confidentiality of personal data, or procedures to enable individuals to exercise their rights.
Consultation with stakeholders: The organisation consults with relevant stakeholders, such as data subjects, data protection authorities, or other experts, as necessary.
Documentation: The organisation documents the DPIA process, including the results of the assessment and the measures taken to mitigate the risks.

Under the GDPR, organisations are required to conduct a DPIA for processing activities that are likely to result in a high risk to individuals’ rights and freedoms. Failure to conduct a DPIA when required may result in fines and other sanctions.

6. What is the difference between a data controller and a data processor?

In the context of data protection, a data controller and a data processor have distinct roles and responsibilities under the General Data Protection Regulation (GDPR).

A data controller is an organization or individual that decides why and how personal data should be processed. The data controller decides why and how personal data is processed, and is responsible for ensuring that the processing is lawful, transparent, and fair. Examples of data controllers may include employers, healthcare providers, and e-commerce companies.

A data processor refers to an entity, such as an organization or individual, that handles personal data on behalf of a data controller.The data processor carries out the processing activities as instructed by the data controller and does not decide why or how personal data is processed. Examples of data processors may include cloud service providers, marketing agencies, and IT support companies.

The key difference between a data controller and a data processor is the level of control they have over personal data. The data controller has primary responsibility for ensuring compliance with data protection laws, and must ensure that the processing is lawful, fair, and transparent. The data processor, on the other hand, must only process personal data on behalf of the data controller and in accordance with their instructions.

Under the GDPR, both data controllers and data processors have specific obligations to protect the personal data they process. However, the data controller has more extensive obligations, including:

Ensuring that data subjects are provided with specific information about the processing of their personal data.
Obtaining valid consent from data subjects for processing their personal data, where necessary.
Ensuring that adequate security measures are in place to protect personal data.
Reporting data breaches to the supervisory authority and data subjects, where applicable.

In contrast, data processors have more limited obligations, including:

Putting in place the necessary organisational and technical safeguards to protect personal data.
Only processing personal data in accordance with the instructions of the data controller.
Assisting the data controller with their obligations, such as providing access to personal data or assisting with data protection impact assessments.

7. What are the entitlements of individuals whose data is being processed under GDPR?

The General Data Protection Regulation (GDPR) grants data subjects a number of rights with respect to their personal data. These rights are intended to give individuals more control over their personal data, and to ensure that their privacy and data protection rights are respected. The key rights of data subjects under the GDPR include:

Right to be informed: Data subjects have the right to be informed about the processing of their personal data, including the purposes of processing, the categories of personal data involved, and any third parties who may have access to their data.
Right of access: Data subjects have the right to access their personal data and to obtain a copy of it, free of charge.
Right to rectification: Data subjects have the right to have inaccurate or incomplete personal data corrected.
Right to erasure (or “right to be forgotten”): Data subjects have the right to request the erasure of their personal data in certain circumstances, For instance, if the data is no longer required for the original reasons it was gathered under GDPR.
Right to restrict processing: Data subjects have the right to request the restriction of processing of their personal data in certain circumstances, such as where the accuracy of the data is contested.
Right to data portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another data controller.
Right to object: Data subjects have the right to object to the processing of their personal data in certain circumstances, such as where the processing is based on legitimate interests or for direct marketing purposes.
Right not to be subject to automated decision-making: Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which have legal or similar significant effects on them.

Data controllers must respond to data subject requests without undue delay and within one month, although this can be extended by two further months in certain circumstances. Failure to comply with data subject requests may result in fines and other sanctions under the GDPR.

8. What is the EU-US Privacy Shield?

The EU-US Privacy Shield was a framework for transatlantic data transfers between the European Union (EU) and the United States (US). It was designed to enable US companies to receive personal data from the EU in compliance with the EU’s General Data Protection Regulation (GDPR).

The Privacy Shield was developed by the US Department of Commerce and the European Commission in 2016, as a replacement for the Safe Harbor agreement which was invalidated by the European Court of Justice in 2015. The Privacy Shield provided US companies with a mechanism to self-certify their compliance with the privacy principles set out in the agreement, and to receive personal data from the EU.

Under the Privacy Shield, US companies were required to comply with a number of privacy principles, including:

Notice: Companies must inform individuals about the purposes for which their personal data is collected and used, and about their rights to access and correct that data.
Choice: Individuals must be given the opportunity to opt-out of the collection and use of their personal data.
Security: Companies must take appropriate measures to protect personal data from unauthorised access or disclosure.
Access: Individuals must be able to access and correct their personal data held by the company.
Recourse: Companies must provide individuals with a mechanism for addressing complaints and resolving disputes.

However, in July 2020, the EU Court of Justice invalidated the Privacy Shield agreement, stating that it did not adequately protect the privacy rights of EU citizens. As a result, the Privacy Shield is no longer a valid mechanism for data transfers between the EU and the US. Companies that relied on the Privacy Shield to transfer personal data must now find alternative methods, such as Standard Contractual Clauses or Binding Corporate Rules, to ensure compliance with the GDPR.

9. What is the future of GDPR?

The General Data Protection Regulation (GDPR) is still a relatively new regulation, having only been enforced since May 2018. As such, it is difficult to predict with certainty what the future holds for the GDPR. However, there are a few trends and developments that may shape the future of the GDPR:

Increased enforcement: In the early years of the GDPR, many organisations focused on implementing the necessary policies and procedures to comply with the regulation. However, we may see increased enforcement action in the future, as regulators begin to investigate and penalize organizations for non-compliance.
Expansion to other regions: The GDPR has already influenced data protection laws in other regions, such as Brazil’s General Data Protection Law (LGPD) and California’s Consumer Privacy Act (CCPA). We may see more countries and regions adopt similar regulations in the future, as concerns around data privacy continue to grow.
Emphasis on accountability: The GDPR places a strong emphasis on accountability, requiring organizations to be able to demonstrate their compliance with the regulation. This focus on accountability may continue to shape the future of data protection regulations, with more regulations requiring organisations to take responsibility for the personal data they collect and process.
Technological advancements: As technology continues to evolve, so too will the ways in which personal data is collected and processed. This may lead to new challenges for data protection regulations, as they try to keep pace with technological developments.

Overall, the future of the GDPR is likely to be shaped by ongoing concerns around data privacy and security, as well as by developments in technology and the global regulatory landscape.