GDPR

RULES FOR THE PROTECTION OF NATURAL PERSONS IN RELATION TO THE PROCESSING OF PERSONAL DATA, LAID DOWN IN GDPR - REGULATION (EU) 2016/679

THE CHALLENGES FACING BUSINESS RELATED TO THE IMPLEMENTATION OF THE REQUIREMENTS SET OUT IN THE EUROPEAN LEGAL FRAMEWORK, WHICH WILL APPLY AFTER MAY 25, 2018.

The pace of development of information technology and international trade in recent decades has led to the need for changes in the current measures for the protection of personal data.

With the entry into force, in May 2016, of REGULATION (EU) 2016/679 General Data Protection Regulation (GDРR), on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, a single legal framework is introduced that will unify the legislation protecting the personal data of European citizens.
The GDPR will apply after 25 May 2018 and aims to facilitate the free flow of personal data within and outside the EU related to international trade and international cooperation by providing mechanisms to protect against a breach of personal data when using automated and other means of data processing.
After 25.05.2018, the rights of individuals and the obligations of controllers and processors regarding the privacy and protection of personal data will have to be taken into account at the planning stage of a specific activity falling within the scope of the GDPR.
The changes introduced by the GDPR lead to changes in regulatory policies and in their implementation mechanisms.

Main changes after the implementation of the GDPR and their effect on the business:
• Territorial scope: The GDPR will also apply in third countries to controllers and processors of personal data of European citizens.

• Obligation to ask for consent for the processing and storage of personal data. Requirements are introduced for the texts related to the request for consent, namely they should be: 
- clear, concise, easily understandable (do not use incomprehensible terms from the legal jargon);
- to differ from other topics/questions;
- available for processing purposes. 
It will have to be ensured that the withdrawal of consent is as easy as the provision of consent.

• Consent from minors when using "online" services. The processing of a child's data is lawful under the GDPR if the child is at least 16 years old. For children under 16 years of age, data processing is lawful if consent has been given by the child's parent or guardian. It is envisaged that Member States may set a lower age for these purposes in their legislation, but it must not be less than 13 years old.

• Rights of individuals: The GDPR provides the data subject with the right to receive confirmation regarding:
- the purpose of the processing; 
- the category of the data; 
- the recipients of the data;
- the period or criteria for determining the storage period; 
- the right to object to processing; 
- the existence of automated decision-making, including profiling.
- the right to request the rectification or deletion of personal data or restriction of the processing of personal data relating to the data subject, the right to lodge a complaint with a supervisory authority; knowledge of data sources when they are not received by the subject; 
- the right to receive a copy of the personal data, in an accessible electronic format.

• The right to be forgotten: The data subject receives a right that allows him to request, from the data controller, the deletion of personal data and to stop their further dissemination and processing of the data. In Article 17 of the GDPR, the conditions for deletion include data that is no longer relevant for the intended processing or a request for withdrawal has been received. When examining such requests, consideration shall be taken of whether the public interest in the availability of such data would be affected.

• Data portability: The right of the data subject to receive his/her personal data, structured in a widely used and machine-readable format, is introduced in order to transfer them to another controller.

• Obligation to notify the Competent Supervisory Authority. The GDPR introduces an obligation to notify the Commission for Personal Data Protection in case of established breaches related to the security of personal data. The administrator will have to complete the notification without undue delay up to 72 hours after becoming aware of it. 

• Administrative penalties – "Fine" or "Property sanction". The penalties shall be determined on a case-by-case basis, with a maximum amount of up to EUR 20 000 000 or up to 4 % of the organisation's total annual worldwide turnover for the previous financial year, whichever is higher. There is a requirement that sanctions are effective, proportionate and discourage violations. The possibility of filing class actions against the organization that committed the violation, which could lead to losses and/or damage to the reputation of the legal entity, is introduced.

•Certainty. Privacy and security of personal data in the application of control or monitoring mechanisms are at the heart of the current declaration of applicability used in certified information security management systems (ISO 27001). The use of technical and organizational mechanisms by controllers and processors ensuring data security will be a legal requirement after May 25, 2018. The mechanisms must take into account the level of risk and its severity on the rights and freedoms of individuals (e.g. pseudonymisation and encryption of personal data; the ability to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; the process of regular testing,  assessment and evaluation of the effectiveness of technical and organisational measures with a view to ensuring the security of processing).

• Data Protection Officer (DPO). The GDPR introduces an obligation for controllers and processors to designate a DPO when:
- the data processing is carried out by a public authority or entity operating within the scope of the GDPR;
- Data processing requires regular and systematic large-scale monitoring of data subjects;
- large-scale processing of special categories of data is carried out.
The Regulation allows a group of undertakings to be able to appoint a single DPO.

• Cooperation between the competent EU authority and Member States' supervisory authorities to notify them of infringements.

• Tools to demonstrate GDPR compliance. Controllers and processors will be able to use approved codes of conduct or certification to ensure trust in the services provided tailored to the specifics and needs of a specific sector/industry or certain data flows for the implementation of the GDPR. These tools are expected to provide appropriate safeguards for the transfer of data between public authorities or bodies on the basis of international agreements or administrative arrangements.

The harmonisation of EU legislation on the reliability of security in the free flow of personal data flows is expected to lead not only to increased trust in protection, but also to financial benefits.

Regardless of the advantages expected from the implementation of the GDPR, some restrictions have also been introduced, for example, regarding the access of controllers and processors only to data that is necessary for use in their direct work. 
Violation of this requirement is considered an incident even if no information leakage outside the organization is detected within the meaning of the GDPR.