The European Union’s General Data Protection Regulation (the “GDPR”) goes into effect in a little over fourteen months and from a quick glance at our bullet points analysis you can see there is a lot to consider.  One crucial aspect you need to be thinking about now is how your organization collects and manages consents from individuals for processing their personal information.  Without a strong understanding of what valid consent means under the GDPR, before long you may find yourself holding valuable data that you are not able to process as you need to for your business.

To this end, the Information Commissioner’s Office (the “ICO”), the data protection authority for the UK, last week published a consultation draft of its GDPR consent guidance.  This is a practical resource meant to help organizations get to grips with the GDPR’s consent requirements and align their internal procedures and processing activities, as well as their customer-facing websites, marketing materials, and product infrastructure.   Although the UK ICO cannot speak for the other EU data protection authorities, they have a good track record of producing practical guidance set out in accessible language, which makes the ICO website a good first stop for US companies seeking to understand their obligations in the EU.  We encourage you to review this helpful resource and provide feedback to the ICO using their comment form by March 31.  We also offer this high-level snapshot of a few key points: Continue Reading It’s Not Too Early! ICO Guidance Regarding Consent Under GDPR

It’s likely that 2017 will see still more data breaches and hacking stories, and companies should be looking closely at cybersecurity as a risk management issue, and not as an IT issue (we’ve been saying that for years ….).

One of the issues for 2017 will continue to be global changes in data protection laws, and how US companies operating in a global environment prepare for compliance with competing regulations.

To that end, we continue our ongoing series of webinars on the European Union’s General Data Protection Regulation (GDPR).

The upcoming webinar, the fifth in our GDPR Series, will explore the ways in which the Regulation creates new avenues for data transfers, and narrows others. In particular, we will consider sector-specific Commission decisions, privacy seals/certifications, the exception for non-repetitive, limited transfers, and the outlook for BCRs and Model Clauses.

Registration is online here.

 

For the past few months, the Mintz Levin Privacy Webinar Series has focused on the upcoming EU General Data Protection Regulation (GDPR) to help businesses understand the reach and scope of the GDPR and prepare for the potentially game-changing privacy regulation. The GDPR will affect how US businesses handle and process personal data originating in the EU and may require changes to business process.

This week, we’ll present a webinar examining the criteria that determines whether or not your organization needs to appoint a Data Protection Officer. We will discuss the role of the DPO, the significance of the “independence” requirement, and the qualifications required to hold the position. Make sure to join us for this important webinar!

Registration link is here.

 

For the next few months, the Mintz Levin Privacy Webinar Series is focusing on the upcoming EU General Data Protection Regulation (GDPR) to help businesses understand the reach and scope of the GDPR and prepare for the potentially game-changing privacy regulation.   The GDPR will affect how US businesses handle and process personal data originating in the EU and may require changes to business process.

Next week, we’ll present a webinar focusing on the data security and accountability requirements of the GDPR, including reviews and documentation of internal policies and procedures and data impact assessments.   We will also take a look at the onerous breach notification requirements and recommend actions that companies can take in advance to mitigate the need for breach notification.

Make sure to join us for this important webinar!

Registration link is here.

 

As we’ve discussed previously, the GDPR significantly limits user consent as a basis for processing personal data.  One interesting question is whether the new rules on consent will kill free apps in Europe.  Free apps typically involve the offer of a service (the app) in exchange for access to personal data (whatever data the app siphons off from my phone, for example, per the terms of use that I probably didn’t bother reading).  Under the GDPR, that may not be a bargain that I, as a consumer, am allowed to make. Continue Reading Will free apps soon be dead in Europe?

The European Union Commission has issued a fact sheet on the new General Data Protection Regulation (final post-trilogue text available via Statewatch).  The Commission claims that the Regulation is good for individuals and good for business.  We’ll leave that to readers . . . and history . . . .to decide.

As regulations go, the GDPR is a page-turner, but if you don’t have time to read all 204 pages before the holidays, consider joining our webinar at 1 pm ET today. Registration is here.

 

 

As expected, the EU Parliament’s Committee on Civil Liberties, Justice and Home Affairs (also known as LIBE) voted today to adopt the new General Data Protection Regulation (see the summary we provided yesterday here).  A LIBE press release announced the vote with the proclamation “New EU rules on data protection put the citizen back in the driving seat.”  The vote was 48 for the GDPR, 4 against, and 4 abstentions.  The GDPR will go to a vote of the full EU Parliament in March or April of 2016.  It is expected to be passed based on LIBE’s endorsement.

Companies will have a grace period of two years to come into compliance, measured from the date that the GDPR is formally adopted and published in the Official Register.  That means that the key compliance date will probably fall in March or April of 2018.  Given the complexity of the 200 page Regulation and the likely need to audit and change business processes throughout organizations, we recommend starting the compliance review process immediately.

We will announce a series of webinars to drill down on specific topics under the GDPR early in the new year.

 

Updated at 8:50 pm GMT on 16 December 2015.

The new General Data Protection Regulation is effectively a “done deal” following the final trilogue meeting on December 15.  One might assume based on UK media coverage that the biggest change in EU privacy law is that kids under 16 will need their parent’s consent to sign up for social media services and apps.  As much consternation as that will cause at the breakfast table, it’s really the least of our worries.

It will take some time to process the new Regulation, and of course we don’t have the complete, official version yet (please read the important caveat at the end of this summary), but here are the key features of the Regulation in bullet point form so we can start mapping out the new legal landscape.  This summary focuses more on what’s new than what has stayed in place; generally speaking, rights of data subjects that existed under the Directive also exist under the Regulation.  On the other hand, the burdens on data controllers and processors have substantially increased. We’ll explore all of this in more detail over the coming weeks. Continue Reading The General Data Protection Regulation in Bullet Points

The EU has announced that the Commission, Parliament and Council have reached agreement on the final shape of the General Data Protection Regulation.  The official version will be available early in 2016, but we will be reviewing the details that have been made available so far and providing further information here over the next couple of days.  We’ll start with the bottom line:  the maximum fine for breaches is four percent of annual worldwide turnover.  Big numbers, big goals on the part of the EU.

 

 

 

Giovanni Buttarelli, the European Data Protection Supervisor (EDPS), recently announced the formation of a new external Ethics Board that will do a deep dive into the complex ethical issues that surround the use of  personal data in the “big data” economy.  (See press release and full opinion links here.)  The EDPS is particularly concerned about the rise of artificial intelligence and its implications for personal data protection.  If the EDPS Ethics Board begins issuing opinions before the new General Data Protection Regulation (GDPR) is finalized, it could certainly help shape its final form.

What would a EDPS Ethics Board have to offer once the GDPR  is finalized?  Clearly it would offer guidance to European Union institutions as to how to apply the GDPR to their own data protection practices, given that the EDPS’s official function is to monitor EU institutions and ensure that they follow EU data protection laws.  But it would also potentially supersede the Article 29 Working Party’s role as the EU’s primary data protection commentator, at least on ethical as opposed to more technical issues.  Also, given the prominent role of the EDPS in the EU’s self-governance structure, the EDPS’s Ethics Board’s opinions are likely to influence judicial decisions, future privacy legislation, and the national implementation of the GDPR in areas that allow national discretion (and there are quite a few of those).  A new EDPS Ethics Board will be a commentator to reckon with.