Data Protection and Privacy European Regulation

What?

The French Data Protection Act dated of 06 January 1978 was revised in may 2018 in order to transpose the General Data Protection Regulation (GDPR) of 27 April 2016 in the national law (Eng. version & Fr. version). Since 25 may 2018, companies and other types of organizations have to comply with the regulation’s new rules and principles of the GDPR.

Who?

Contrary to the former legal framework, the GDPR foresees an extension of the responsibility and liability of data processing traditionally known to data controllers to data processors. The GDPR is applicable to data processing implemented within the scope of an entity’s activities that is established within the European Union.

It also applies to companies located outside of the European Union as long as they offer goods or services to EU citizens or if they monitor the activities of EU citizens for behavioral analysis purposes.

What is it changing with the GDPR?

Companies have to:

• Respect the Transparency principle;
• Obtain individuals’ consent for cases of profiling;
• Keep a register regarding the personal data processing activities;
• Document and prove the legal and technical measures implemented for their personal data processing compliance (“Accountability”);
• Analyze the risks regarding the nature of the data and the processing activities;
• Notify security breaches impacting personal data;
• Perform Data Protection Impact Assessments in high risk cases;
• Adopt and implement Data Protection by Design measures;
• Designate a Data Protection Officer (DPO) in the following cases: public administrations, operations that imply regular and systematic monitoring of physical persons on a large scale, data processing on a large scale of special categories of personal data.
• Respect the rights of individuals regarding the right to data portability, the right to be forgotten, the right to oppose data processing and the right to have an access to their Personal data

Wether you are already processing personal data or you are bringing a new product or service to market with personal data processing, it’s important to consider the privacy implications from the very beginning of the development process.

What are you risking with the GDPR?

In case an Organization does not comply with the GDPR resuirements, the sanction may be of 4% of the global sales of a group (or 20 M €) for the maximum.