GDPR: Main Content of the European Regulation

Be careful though! This isn’t going to be about giving legal advice, but rather,  a refresher course on the changes that GDPR will make.

The Terms of the GDPR to Define

Personal Data

All information relating to a human being (or a data subject) can be used to identify that person directly or indirectly. With the arrival of the GDPR, this definition was broadened to include online data. i.e., name, photos, email addresses, bank details, social networking publications, websites, medical information, IP addresses, location data, etc.

Sensitive Data

It is personal data that directly or indirectly reveal political opinions, philosophical or religious or trade union memberships of persons, or that which is related to their health or their sexual orientation. They may only be processed with the explicit consent of individuals.

Data Processing

This broad term refers to any operations carried out on personal data, via automated or non-automated means.  Some examples of processing include collection, recording, organization, storage, use, and destruction of personal data.

Data Controller

A data controller is a person who determines– alone or jointly with others – the purposes and the means of data processing (the collecting and processing methods).

The Principles Emerging From the GDPR

Whom Does it Concern?

The Obligation to Appoint a DPO

The GDPR created a position of Data Protection Officer (DPO). Their responsibilities include:

The Responsibility

Companies must ensure that they comply with GDPR’s obligations and be able to demonstrate compliance with its principles.

Valid Consent

The controller must be able to demonstrate that the data subject has given his or her consent.

Notification of Violations

In the case of a violation, the company is obligated to inform its Supervisory Authority within 72 hours after its discovery.

Privacy Protection From the Design Stage

The controller must implement any data protection measures (pseudonymization, minimization, etc.) from the design stage; i.e., identify the means of processing.

The Opposition to Profiling

Any person may object to the automatic processing of their personal data in order to evaluate certain personal aspects relating to a physical person (analysis, prediction, etc).

Data Portability

Any person concerned by the processing of their data can obtain from the controller a copy of their processed personal data and, where applicable,  the transfer of these data to a third party.

Sanctions

Violation of basic principles including the conditions of consent or the rights of the persons concerned will be subject to a sanction of up to 20 million or 4% of annual worldwide turnover.