Key changes to the data protection regulation
As the world we live in becomes increasingly more digitized, organisations are holding more and more highly sensitive personal data; data that is like gold-dust to cyber criminals. Advancements in technology have commoditised personal data, but the EU’s new General Data Protection Regulation (GDPR) will introduce a standardised approach to data protection.
The GDPR is a regulation through which the European Parliament, the Council of the European Union and the European Commission plan to strengthen and unify data protection for citizen within the European Union (EU).
The main priority of the GDPR is to protect citizens and give them a control over their personal data and to make the regulatory environment easy for all international business by uniting the regulation within the European Union. The 1998 Data Protection Act has become outdated as technology has evolved, making much of the legislation obsolete in protecting people.
The implementation of the GDPR will effectively strengthen customer trust and provide reassurances to customers and in the long term, the regulation will provide citizens with the necessary safeguard to data privacy in a digital world.
The following are the key changes that will be activated by the General Data Protection Regulation.
- Penalties
Under the GDPR, organisations that are in breach of the regulation can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the greatest fine that can be imposed for the most serious breaches, for example, not obtaining sufficient customer consent to process his/her data. A company can be fined 2% for not having their records in order according to article 28 of the act, it is also important to know that no one is excluded, the GDPR will apply to all organisations across the world.
- Increased territorial applicability.
Arguably and most importantly, the biggest change brought about by the new regulation is the increased territorial jurisdiction of the GDPR. The new regulation applies to all companies that deal with the personal data of citizens, regardless of the company’s location. Before now, the territorial applicability of the directive had different meanings; this topic has arisen in a lot of high profile court cases. GDPR has made it clear that it will apply to all EU citizens whether in EU or not.
- Consent
Under the GDPR, the conditions for consent will be far stricter than under the previous legislation. The request for consent must be presented in an intelligent and easily accessible format. Consent requests must be clear, concise and use plain language and must be easily differentiated from other terms and conditions. Essentially, it must be as easy to withdraw consent as it is to give consent out.
- Breach Notification
Under the GDPR, breach notification will become compulsory in all member states where a data breach is most likely to “result in a risk for the rights and freedoms of individuals”. This must be compulsorily done within 72 hours of being notified of the breach. Data processors also have a duty to notify their customers, the controllers, “without undue delay” when they become aware of a data breach.
- Right to Access
One of the most important and expanded rights of data subjects outlined by the GDPR is the right for the individual to obtain clarification (from the data controller) on how, when and why their personal data is to be processed. Furthermore, the data controller must be able to provide a copy of the personal data in electronic format to the subject, without receiving any payment. This change is a key and dramatic shift to data transparency and empowerment of data subjects.
Conclusively, it is evident that the GDPR is a very positive move in data privacy that will protect the individual’s privacy and will improve the trust in the process of releasing their personal data to companies. The challenge to enterprise is the steps they need to take in order to become compliant in advance of the 25th May 2018 deadline.
Further guidance can also be found via the Information Commissioners Office website here.
Consent Management Solutions
Lead Consent is the latest data processing solution with auditable reporting and secure record storage. Lead Consent was devised with the new data protection regulation in mind to allow users to safely and securely manage their marketing data.
Lead Consent is a data processing solution that enables users to prepare their data for GDPR ‘readiness’.
Creative Lead’s entry level product ‘Lead Consent’ offers companies of all sizes, the ‘kit’ needed to bring their existing data into line with the new legislation which affects the way that the data of EU citizens is processed.
In advance of the GDPR enforcement date, this system will allow users to request the relevant consents from contacts within their historical databases. Proof of the consenting individuals is then stored safely and securely within Caboodly Consent, providing them with compliant marketing data for future processing.
The system provides a secure audit trail and storage of consents received and affords companies of all sizes the peace of mind that marketing data complies with the new GDPR stipulations. Once consent is received, organisations can continue to use this data for email, postal or telephone marketing purposes depending upon the level of consent supplied.
Once the cut-off date of 25th May is reached, organisations that do not obtain the relevant consents stipulated by the GDPR will no longer be able to market to their existing databases, irrespective of how they came across the data.
To prepare your marketing data for GDPR compliance ‘readiness’, sign up to Lead Consent today.
*This post should not be relied upon as legal guidance. If you are unsure about your obligations under the GDPR, you should seek legal guidance regarding the full scope of your compliance obligations and requirements to ensure that you are fully aware of every eventuality and consequence for non-compliance.