The global reach of the General Data Protection Regulation

The EU-US privacy shield should have brought some relief, but critics claim it won’t hold before the Court of Justice. Recent developments, such as President Donald Trump’s controversial travel ban which includes an attempt to exclude privacy protection for refugees and immigrants (Sec 14, Executive Order: Enhancing Public Safety in the Interior of the United States, January 25, 2017), fuels that criticism.

The EU is also moving forward on its own in another direction with the General Data Protection Regulation (EU) 2016/679 (GDPR) which replaces the Directive on the protection of individuals with regard to the processing of personal data (95/46/EC). The GDPR applies to controllers and processors established in the EU, but also to non-EU controllers and processors who target or monitor EU data subjects. Therefore the scope and effects of the GDPR are global and can also apply to US companies and organisations. The GDPR contains an elaborate legal system for data protection, such as data subject consent, profiling limitations, data anonymisation, breach notification, trans-border data transfer requirements and the mandatory appointment of data protection officers, to name a few. Penalties are severe. The GDPR authorises regulators to levy substantial fines in amounts exceeding EUR 20 million or 4% of annual global turnover. For GGI members, the GDPR is a huge opportunity to seek cross-border opportunities to provide tailor-made services for their clients.

---

Image: pixabay.com