After several years of negotiations, the new regulation was published by the European Union on 4 May 2016. The regulation provides for a 2-year adaptation period, during which the sectors and organisations with the least mature security will have to speed up their processes and adopt new technologies in order to comply with the new rules.

Why are these changes necessary?

All European Union countries currently have data protection laws in place, but these laws vary from country to country and for many years they were not changed at all. In order to keep pace with major technological developments, the EU stepped up its efforts to modernise and harmonise the laws, creating a single regulation for all member countries.

The aim of this regulation is to strengthen the privacy rights of EU citizens, restore trust in online activities and better protect customer data, requiring companies to adopt new methods for processing the data of natural persons.

Who is affected by the new regulation?

All companies that process personal data, in other words, that carry out operations involving the data of natural persons. These changes also affect all companies that do business with EU citizens, even if the company is based outside the Union.

Main changes in the regulation.

• Companies are now required to carry out a data protection impact assessment before starting to process data where "a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons" (Article 27, section 1);
• The regulation requires companies to implement appropriate security measures to protect personal data, such as encryption mechanisms that "ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services" (Article 32, section 2);
• "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority (the national data protection commission)" (Article 33, section 2);
• Data subjects must be informed of the intrusion whenever the security breach is likely to pose a high risk to individual rights and freedoms (Article 32, section 2);
• The introduction of the right to erasure of personal data (the "right to be forgotten") (Article 17, section 3);
• The introduction of the right to data portability, which means that "The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller" (Article 20, section 3);
• Companies must designate a "data protection officer" who will be involved in all "issues which relate to the protection of personal data" (Article 32, section 3). An officer must be designated whenever:
  • The processing is carried out by a public authority or body;
  • The organisation regularly and systematically monitors individuals on a large scale;
  • The organisation processes sensitive data on a large scale.
• If a company fails to comply with the regulation, it may be subject to "administrative fines up to 20 000 000 EUR, or up to 4 % of the total worldwide annual turnover" (Article 83, section 3);

In short, if companies do not adopt the right policies to protect the personal data in their possession, they will face high costs and damage to their reputation and to customer trust.

New security terms:

• Privacy by design: This means that every new business process or service that uses personal data must take the protection of that data into account. In practice, it means that the IT department must give importance to privacy throughout the entire life cycle of development or personal data processing.
• Privacy by default:This means that privacy settings are applied automatically when a customer acquires a new product or service. In other words, no manual change should be needed for privacy settings to be applied to all new data subjects in a given system.
• Accountability: This requires the implementation of a compliance programme capable of monitoring compliance throughout the organisation and demonstrating to data protection authorities and data subjects that all this personal information is secure.
• Objection to profiling: Data subjects have the right to object to the use of profiling, that is, any form of automated processing of personal information aimed at evaluating and categorising individuals on the basis of their personal data.
• Privacy impact assessments: These allow the organisation to identify problems in the early stages of any project, reducing the associated costs and the reputational damage that could accompany a breach of data protection laws and regulations.

How to comply with the new regulation?

For many companies that need to comply with the new regulation, the best way to prepare is to implement a data protection strategy.

Although the regulation does not refer to any specific technology, it makes several references to encryption as a way of protecting critical data and making it unusable to unauthorised persons.

Find out everything about the new General Data Protection Regulation with the Ebook "GDPR - The Essential Guide".

Written by:
Openlimits

August 12, 2016 - 12:05:57

Excelente posição da União Europeia que ao proteger os seus cidadãos visa já as grandes multinacionais americanas como a google, facebooks e afins com uma multa de até 4% do seu volume total de negócios mundial no actual total desrespeito e devassa dos dados dos europeus. Parece-me uma excelente posição de defesa dos interesses nacionais.

Written by:
João Silva

Tell us what you think