General Data Protection Regulation: Global Scope, More Duties, Big - - PowerPoint PPT Presentation

General Data Protection Regulation: Global Scope, More Duties, Big Fines October 5, 2017

Presented By: Etienne Drouard, Partner, K&L Gates (Paris) Ignasi Guardans, Partner, K&L Gates (Brussels) Ewelina Madej, Senior Associate, K&L Gates (Warsaw)

• Dr. Thomas Nietsch, Associate, K&L Gates (Berlin)

General Data Protection Regulation*

Adopted on April 27, 2016 In force as of May 25, 2018

* http://eur-lex.europa.eu/eli/reg/2016/679/oj

1

Regulation vs. National Law

• Directly effective in EU Member States without need

for implementing law

• BUT, EU Member States still can implement laws on

certain data protection matters

2

Personal Data

3

CATEGORIES OF PERSONAL DATA

• PROFILING
• PSEUDONYMOUS DATA
• GENETIC DATA
• BIOMETRIC DATA
• DATA CONCERNING

HEALTH

New definitions (Article 4)

4

EXTRA-TERRITORIAL SCOPE (Article 3)

• established in the EU;
• not established in the EU but
• ffering goods or services to

data subjects in the EU; or

• not established in the EU but

monitoring behavior of data subjects in the EU.

GDPR applies if controller or processor is:

5

“ONE STOP SHOP”

Cross – border data processing Lead supervisory authority

6

PRINCIPLES OF PERSONAL DATA PROCESSING

• Lawfulness, fairness and transparency
• Purpose Limitation - specified, explicit and legitimate

purpose

• Data Minimization – adequate, relevant and limited to

purpose

• Accuracy – accurate and up-to-date
• Storage Limitation – no longer than is necessary for

the purpose

• Integrity and confidentiality – appropriate security

7

DATA SUBJECTS RIGHTS

consent is explicit, informed and freely given enhanced rights to (i) access personal data and (ii)

• bject to processing personal data

“right to be forgotten” (right to erasure) right to data portability new principles regarding profiling

8

CONDITIONS FOR CONSENT

Freely given, specific, informed and unambiguous Right to withdraw consent at any time Unbundled

9

CONDITIONS FOR CONSENT

clear, simple and easily understandable Controller bears burden of proof that consent was granted Clear affirmative action

• r statement

10

CONSENT OF CHILDREN

• Older than age 16: processing is lawful
• Younger than age 16: processing is lawful
• nly if and to the extent that the consent is

given or authorized by the child’s parent or custodian

• Compare U.S. COPPA which requires verifiable parental

consent before personal information is collected from children under age 13.

11

CONSENT OF CHILDREN

BUT:

• EU Member States can implement younger age but

not younger than age 13.

• Controller must make “reasonable efforts” to verify that

child’s parent or custodian provided or authorized consent.

12

BASICS OF DATA PROCESSING

Consent Execution of contract with data subject Controller’s obligations Protection of vital interests of data subject or other person

13

BASICS OF DATA PROCESSING

Processing carried out in the public interest or in the exercise of official authority vested in the controller Legally justified reasons carried out by the controller or by the third party

14

CONTROLLER AND PROCESSOR

Controller

Natural or legal person Establishes purposes and means of data processing Joint controllers

Processor

Natural or legal person Processes data on behalf of the controller Contract to ensure processing is lawful

15

CONTROLLER – DUTIES

Provide technical and organizational safeguards for data protection, conduct PIA, appoint Data Protection Officer Guarantee rights of data subjects – documentation (including notification), deletion, portability Duties regarding DPA or other regulators – reporting security breaches, consultations prior to processing

16

CONTROLLER

Compliance with GDPR by adherence to codes of conduct and certifications approved by regulatory body Applying codes or certifications does not eliminate responsibility Documentation of data processing - registers

17

PROCESSOR

Technical and

• rganizational means

Documentation of data processing Reporting breaches to controller Appointment of Data Protection Officer More detailed contract for provision of data Share personal data with third parties only with controller’s prior approval

18

PERSONAL DATA BREACH

Broad definition of personal data breach Reporting unless no risk to rights and freedom of individuals Processor must inform controller Controller – if high risk to rights and freedom of individuals, then inform data subjects 72 hours to inform local regulatory body where the controller is established

19

DATA PROTECTION OFFICER

Rights

Independence Adequate resources Expertise

Duties

Informing and training Involved in all material data protection matters Cooperating with regulatory body

20

WHEN DATA PROTECTION OFFICER APPOINTMENT IS MANDATORY

Public authorities (apart from courts in the scope of judicial power) Regular and systematic monitoring of subjects on large scale Processing data on large scale is core business activity One Data Protection Officer for group of companies

21

PRIVACY BY DESIGN

Consider privacy when designing product Consider security of personal data:

• prior to data processing
• throughout entire product life cycle

Compliance with data processing principles, e.g., data minimization Pseudonymization

22

PRIVACY BY DEFAULT

Default settings protect users’ privacy Only necessary personal data is automatically processed Protect privacy even if user does not take any affirmative action

23

PRIVACY IMPACT ASSESSMENT (PIA)

Identify and minimize data protection risk PIA is mandatory when “high risk” processing, e.g., when data is processed by new technologies Mandatory consultations with local regulatory body whenever PIA indicates high risk of data protection if no minimizing means will be applied Recommended – conducting PIA before making choice of processor

24

WHAT SHOULD PIA CONTAIN?

Description of processing and its purpose Assessment of necessity and proportionality of processing Assessment of risk of infringing rights and freedoms of data subjects Assessment of safeguards for personal data and ensuring compliance with GDPR

25

RESPONSIBILITY: Controller vs. Processor

controller is not responsible for unlawful processing if:

can prove absence

• f guilt

processor is responsible for unlawful processing if:

it did not fulfill duties directly imposed on it by GDPR it acted outside of scope of or against controller’s instructions

26

RATE OF PENALTIES

Fines may amount to maximum of € 10m or up to 2% of world annual turnover, whichever higher, for each breach duties of collector and processor e.g., children, consent, default data protection duties of certifying entity duties of monitoring entity

27

RATE OF PENALTIES

Financial penalty may amount to maximum of € 20m or up to 4% of world annual turnover, whichever higher for one breach basic principles of processing, including consent rights of data subjects cross-border data transfers 28

THE EU-US PRIVACY SHIELD

European Commission and the United States agreed on new rules for EU personal data transfers - 2.02.2016 (EU-US Privacy Shield) Compatible with rules set out CJEU Schrems ruling (October 10, 2015) Enhanced duties for protection of EU citizens’ personal data Supervised by U.S. Department of Commerce and US Federal Trade Commission in cooperation with European data protection authorities. Access to personal data will be limited and supervised Questions and complaints connected with data transfers can be presented to new regulatory body Implemented July 2016

29

RECOMMENDATIONS:

Investigate current technical and organizational safeguards Determine whether to appoint Data Protection Officer Check contracts regarding data processing Conduct PIAs Update policies / create record of processing Introduce system for managing new/enhanced data subject rights

30

Q&A SESSION

31