Europe’s data protection guidelines are undergoing their biggest change in decades, threatening huge fines for businesses that don’t comply.
Intended to strengthen and unify data protection for all individuals within the European Union, the General Data Protection Regulation (GDPR) will come into effect on 25 May 2018. In an age when more and more businesses rely on personal, anonymised data, the GDPR provides a new framework for how businesses and public sector organisations should handle the information of customers while giving greater protection and enhanced rights to individuals.
Chiara Rustici, an independent GDPR analyst*, says a big difference from the old Data Protection Directive (DPD) is that the GDPR has teeth. “Businesses must shift from collecting personal data on a just-in-case to a just-in-time basis. White-label ‘consented data’ is dead and the personal data markets are broken”, Rustici says.
The key change for individuals is that it will be easier to find out what data companies hold about them. For companies, there will be clear guidelines for acquiring consent from the people they gather information from, as well as a more comprehensive framework for penalty fines.
The GDPR has been presented as a big shift from the current DPD, but the Information Commissioner’s Office (ICO) says that many concepts and principles are much the same, and that many businesses already complying with the current law are likely to already be meeting many of the key requirements of the GDPR.
Key questions for businesses
On paper, Rustici says, there are few entirely novel obligations. In practice, however, there are a few key questions businesses will need to ask of their operations. These include:
- Are we recycling legacy personal data records without checking if we are holding these legally?
- Are we taking on unnecessary data risk by over-collecting fresh personal data (accidentally or due to lazy practices) that is not core to our business and has no ROI?
- If someone asks to see all the personal data that we have about them, do we know what it is and where to find it?
- If an individual asks us to stop using their data, can our systems cope?
- Is our marketing buying in data lists from brokers or other third parties, and are we sure our business was clearly named or correctly described in the original collection form?
- Are we using cloud-based products and services or offshore contractors with no knowledge of where our data is going and no guarantees it will receive ‘the GDPR treatment’ wherever in the world it is stored or handled?
Elizabeth Denham, the UK’s Information Commissioner, says for businesses the GDPR represents a ‘step change’ from previous laws. “It means a change to the culture of an organisation. That isn’t an easy thing to do, and it’s certainly true that accountability cannot be bolted on: it needs to be a part of the company’s overall systems approach to how it manages and processes personal data”, Denham says.
Managing personal data
Companies of all sizes will have to tell individuals—from the outset—what types of personal data are being collected; for what purpose; on what legal bases; and, how long these will be retained—as well as any rights individuals can exercise over the personal data collected. Additionally, with a few very limited exemptions for companies with fewer than 250 employees, businesses must have records of any data handling activities available for inspection by the Data Protection Supervisory Authorities.
“Businesses built on intensive data collection will have to choose between automating and litigating their reliance on data”, Rustici says. “It’s a strategic choice businesses need to make on their core data assets right from the start, because it translates into what your back-end systems must be able to cope with”.
What this boils down to for businesses is either setting money aside to automate consent management or contract-based retention schedules, or setting money aside to litigate matters when individuals object and impose their own personal data blackouts on business operations. It’s also down to a change of mindset towards data collection and retention. “Stop taking personal data for granted”, says Rustici. “It’s not a commodity you own. It’s only ever on loan. Individuals have been given control and you have been given fiduciary duty of care over it”.
Security breaches
But what happens in the event of a security breach? The biggest change for businesses is the 72-hour deadline from the moment a breach is discovered to them needing to notify the ICO. If the breach could impact individuals, those at risk may need to be notified as well.
“If you are a London-based business and you outsource data to Bangalore, even if the breach is discovered in Bangalore, you still need to notify the ICO within 72 hours of Bangalore discovering it”, says Rustici.
In recent years, there have been many data breaches affecting millions, including account details from companies such as Yahoo, LinkedIn and MySpace. Now, under the GDPR, any breach in data of destruction, loss, alteration, unauthorised disclosure —needs to be reported to the ICO—if it could have a detrimental impact on those whose data it is, such as leading to financial loss or damage to reputation.
To back this up, the GDPR comes with a new fines regime. The ICO now has the power to impose fines that are much bigger than the £500,000 limit the Data Protection Act allowed. Companies may face fines of four percent of turnover, up to a maximum of £17m.
Denham stresses that the new legislation should work to create a culture of privacy within an organisation. “It creates an onus on companies to understand the risks that they create for others, and to mitigate those risks”, Rustici says. “It’s about moving away from seeing the law as a box-ticking exercise, and instead working on a framework that can be used to build a culture of privacy that pervades an entire organisation”.
*Chiara Rustici is an independent GDPR analyst, not financially connected to Thomson Reuters. The views expressed here are her own and do not constitute legal advice.
