The General Data Protection Regulation (GDPR): Status and Importance by John Sharpe

Data protection and privacy are now a major priority for many organizations. Data breaches and leaks are happening more frequently and at a larger volume than ever before. To mitigate these risks, the European Union (EU) is currently working to introduce the General Data Protection Regulation (GDPR). The GDPR will address issues around the collection, retention, distribution and loss of personal data.

With the ultimate goal of protecting all personal information, organizations and governments must invest time and resources to meet GDPR guidelines, which revolve around:

obtaining, retaining and processing data

maintaining physical and digital security measures

overseeing necessary documentation in relation to consent, legitimate interest, etc.

coordinating safe disposal or destruction of the data

assessing risk and maintaining compliance

dealing with reporting and repercussions of any breached information

The European Commission (EC) launched the proposal for the GDPR in 2012 to replace the outdated Data Protection Directive first issued in 1995. Because the GDPR is a regulation and not a directive, it carries much more weight in the courts than its predecessor. The GDPR will apply not only to the member states of the EU, but to all non-European companies that operate there. Significant fines will be imparted for non-compliance.

The GDPR was originally received positively, but specific articles have come under scrutiny more recently. And because it requires multiple layers of approvals from various governing bodies, it has yet to be approved by all parties. No specific deadline has been determined, but the end of the year (2015) has been pinpointed as a probable time for final approval.

Let's take a look at how the GDPR differs from the current Data Protection Directive.

Overall View: Changes from DPD to GDPR

Data Protection Directive (DPD) General Data Protection Regulation (GDPR)

EU Member States use as guide Regulation applies to all member states

EU only Global Long Reach

For Data Controllers For Data Controllers, Processors, Sub-Processors

Penalties for noncompliance per Member State Sanctions are massive

Approval through DPA of each Member State Approval through one DPA (or two for >10 Member States)

DPO not required Regulation applies to all member states

Varying types of consent Explicit consent only

Protected: Personal data when name included All personal data, regardless, and encrypted

Limited definition of PII Expanded definition of PII

Copy request allowed by data subject Copy, deletion, and data portability request allowed by data subject

Data Privacy Impact Assessment Suggested DPIA required: sensitive or great in number

Legitimate interest used as basis for processing and sub-processing Cannot be used as transfer basis or sub-processing, consent cannot be used as legitimate interest

Privacy Notice required with suggestions Privacy notice requires table and specific wording

No breach notification requirements Breach notifications with time limits

No breach penalties Breach non-compliance fines substantial

This represents only a high overview of the many changes the GDPR will bring. Iron Mountain recommends you investigate this topic heavily prior to the regulation going into effect. Learn more about the importance of the GDPR and how it will affect data transfer compliance, here.

LINK:	http://blogs.ironmountain.com/2015/data-protection/general-data-protec...
	See more stories from ironmountain

Most recent headlines