The History of the General Data Protection Regulation

Did you know

Appointment of a Data Protection Officer

• Some organisations, for instance those whose core activities involve regular and systematic monitoring of personal or sensitive data on a large scale as well as public sector organisations, will have to appoint a Data Protection Officer to ensure they comply with the GDPR.

Corrigendum to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Corrigendum to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC [First reading] - Preparation for the trilogue

Members States must have transposed the Data Protection Directive for the police and justice sectors into national legislation. It will be applicable from this day.

Did You Know

Privacy by Design

• Organisations processing personal data must take measures to ensure that the data is protected by design.
  The aim of privacy by design is to build privacy and data protection into the design and architecture of information and communication systems and technologies so that they comply with privacy and data protection principles.

The European Commission proposes two new regulations on privacy and electronic communications (ePrivacy) and on the data protection rules applicable to EU institutions (currently Regulation 45/2001) that align the existing rules to the GDPR.

Did You Know

Privacy By Default

• Organisations processing personal data must take measures to ensure that the data is protected by default.
  Privacy by default requires that technical and organisational measures are put in place so that only the necessary personal information is processed, used or accessed for a specified purpose.

Did You Know

Your Data Protection Rights

• The GDPR reinforces a wide range of existing rights and establishes new ones for individuals including:
• the right to erasure (right to be forgotten); you can request that an organisation delete your personal data, for instance where your data are no longer necessary for the purposes for which they were collected or where you have withdrawn your consent.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

Did you know

Your Data Protection Rights

• The GDPR reinforces a wide range of existing rights and establishes new ones for individuals. These include the: 
• Right of data portability: You have the right to receive your personal data from an organisation in a commonly used form so that you can easily share it with another.
• Right not to be profiled: Unless it is necessary by law or a contract, decisions affecting you cannot be made on the sole basis of automated processing.

The European Parliament, the Council and the Commission reach an agreement on the GDPR.

Did you know

International Data Transfers

• The GDPR ensures that the rights and safeguards it provides to individuals in the EU are preserved when their data are transferred outside of the Union
• The European Commission will continue to adopt adequacy decisions where a country offers a legal framework for data protection that is essentially equivalent to the EU.
• Without an adequacy decision, data can be transferred to a country if the processing organisation puts in place binding corporate rules, contractual clauses or other appropriate safeguards.
• Without these, transfers can only take place under strict circumstances, for example, with the consent of the individual or where the transfer is necessary for the conclusion or the performance of a contract. 

The European Data Protection Supervisor publishes his recommendations to the European co-legislators negotiating the final text of the GDPR in the form of drafting suggestions. He also launches a mobile app comparing the Commission's proposal with the latest texts from the Parliament and the Council.

Did you know

Fines

• The GDPR introduces fines for organisations breaching EU data protection law which can amount to €20 million or 4% of the company’s worldwide turnover.

Did you know

The European Data Protection Board

• The European Data Protection Board will replace the Article 29 Working Party. The European Data Protection Supervisor will provide the secretariat for this new, independent European body of which all European data protection authorities will be members. The role of the EDPB will be to ensure the consistency of the application of the GDPR throughout the Union, through guidelines, opinions and decisions.

The European Parliament demonstrates strong support for the GDPR by voting in plenary with 621 votes in favour, 10 against and 22 abstentions.

Did you know

One-Stop-Shop & Consistency Mechanism

• The GDPR introduces a single point of contact for cross-border data protection matters. Where the processing organisation is established in several Member States and/or where individuals in several Member States are affected, the supervisory authority in the Member State where the organisation has its main establishment will be the lead authority, responsible for adopting measures directed at the organisation, in cooperation with all involved supervisory authorities.

The Article 29 Working Party provides further input on the data protection reform discussions.

Did you know

Data breach notification

• Organisations must notify data breaches to their data protection authority within 72 hours unless the breach is unlikely to pose a risk for individuals. In specific cases, they will have to inform the affected individuals.

The Article 29 Working Party adopts an Opinion on the data protection reform proposal.

Did you know

Consent

• Consent of the individual is one of the few circumstances under which an organisation may lawfully process personal data. Consent must be freely given, informed and unambiguous. Individuals may withdraw their consent at any time. In addition, consent to process sensitive personal data as well as consent to transfer personal data outside the EU must be explicit.
• Parental consent is required for children aged 13 to 16, depending on the Member State.

The European Data Protection Supervisor adopts an Opinion on the Commission's data protection reform package.

Did you know

Accountability

• The accountability principle means that organisations and any third parties who help them in their data processing activities must be able to demonstrate that they comply with data protection principles. This includes for instance, documenting their processing activities to prove that they adopted appropriate measures and steps to implement their obligations. In certain cases, organisations will have to carry out a data protection impact assessment.

The European Commission proposes a comprehensive reform of the EU's 1995 data protection rules to strengthen online privacy rights and boost Europe's digital economy.

Did you know

Expanded territorial reach

• Organisations established outside the EU, offering goods and services to, or monitoring individuals in the EU, must comply with the GDPR and designate a representative in the EU.

The European Data Protection Supervisor publishes an Opinion on the European Commission's Communication.

Did you know

The GDPR kickstarts the updating of other regulations...

• Member States are entitled to provide specific rules or derogations to the GDPR, where freedom of expression and information is concerned; or in the context of employment law; or to preserve scientific or historical research. 
• Similarly, the entry into force of the GDPR requires the updating of other EU regulations, such as the revision of the ePrivacy directive which regulates the confidentiality of communications and the use of cookies, or Regulation 45/2001 which applies to the EU institutions when they process personal data.

The European Data Protection Directive (Directive 95/46/EC) on the protection of individuals with regard to the processing of personal data and on the free movement of such data) is adopted.

Did you know

The GDPR kickstarts other data protection actions

• The European Commission will review the existing list of countries which offer an adequate level of protection of personal data.
• Data Protection Authorities will, at national and EU level, explore data protection certification - granting seals and marks to services - to reinforce consumer confidence.