“Why am I getting all these Privacy Policy update emails?”

In April 2016, the European Union (“EU”) passed a sweeping new regulation, the General Data Protection Regulation (“GDPR”), which becomes effective today, May 25, 2018. Because the GDPR is a regulation, as opposed to a directive (such as the 1998 EU Data Protection Directive), it does not require EU member states to enact enabling legislation because it is directly binding and applicable on EU member states.

So, “why am I getting all these Privacy Policy update emails?”

The GDPR applies to any organization that processes or controls the personal data of any data subject in the EU whether or not the organization is based in the EU. Article 3. Because the internet makes it easy for US-based organizations to provide services to international consumers, many US-based organizations will inevitably provide their products and services to EU-based data subjects, and are thus subject to the GDPR’s requirements.

What does the GDPR require?

For the most part the GDPR is yet another iteration of the Fair Information Practices (“FIPs”) which were developed in 1980 by The Organisation for Economic Co-operation (“OECD”). These eight FIP principles for the protection of personal data, which anticipated the Internet and instantaneous exchange of personal data, have continued to be the backbone of privacy frameworks and legislation enacted by the EU and elsewhere:

Collection Limitation Principle – There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

Data Quality Principle – Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.

Purpose Specification Principle – The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.

Use Limitation Principle – Personal data should not be disclosed, made available or otherwise used for purposes other than those specified

Security Safeguards Principle – Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data.

Openness Principle – There should be a general policy of openness about developments, practices and policies with respect to personal data. Means should be readily available of establishing the existence and nature of personal data, and the main purposes of their use, as well as the identity and usual residence of the data controller.

Individual Participation Principle – An individual should have the right, among other things, to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data relating to him.

Accountability Principle – A data controller should be accountable for complying with measures which give effect to the principles stated above.

To be sure, there are additional specific requirements under the Regulation. Though, any of the GDPR’s requirements can broadly fall under one or more of the above OECD principles. Specific requirements of the GDPR include, among others:

• A particular controller or processor should use a risk-based lens to assess its data privacy risks in an “objective” manner “by which it is established whether data processing operations involve a risk or a high risk.” Recital 76. If the assessment yields a high risk, the GDPR requires a formal Data Protection Impact Assessment (“DPIA”). Article 35.

• Appointment of a Data Protection Officer (“DPO”) for controllers and processors involved in high-risk processing activities, i.e., where one of a company’s core activities is the large-scale monitoring of individuals’ data or processing of special categories of personal data (such racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like, defined in Article 9). Article 37.

• A data breach notification requirement. In the event of a personal data breach, a data controller must notify the supervisory authority (most likely the supervisory authority of the member state where the controller has its corporate headquarters) not later than 72 hours after having become aware of it. Article 33, 55, and 56. If the data breach “is likely to result in a high risk to the rights and freedoms of individuals,” the data controller must also notify the affected data subjects “without undue delay.” Article 34.

As with any sweeping regulatory regime, there is still uncertainty that is (in some cases) still being resolved by guidance from EU member states’ supervisory authorities. In the coming months and years we will see how the GDPR takes hold and how EU courts will interpret its regulatory language.