The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU) that came into effect on May 25, 2018. It is designed to protect the privacy and personal data of individuals within the EU and to regulate how organisations worldwide handle personal data.
In the context of GDPR, personal data is any data or information that can identify or be used to help (when collected together) identify a living person. This applies even to data that has been encrypted or anonymised, so long as the encryption/anonymisation can be reversed.
Personal data can include, name, date of birth, address, location, IP address, email etc.
Some sensitive personal data, called "special categories", are subject to additional protection under GDPR, with their processing not allowed unless specific requirements are met (for example, explicit consent), The special categories include:
Data processing covers a wide range of use of personal data, both manual or automated. It includes, for example data:
Under the GDPR, there are six legitimate contexts - "lawful bases" - for processing personal data. Each of these provides a different legal justification for processing data, and organisations must determine and document which basis or bases applies to their processing activities.
You have given clear and explicit consent for your personal data to be processed for a specific purpose. Consent must be freely given, specific, informed, and unambiguous and must involve a clear affirmative action on your part. e.g., by ticking a box that says you are giving consent for your data to be processed You have the right to withdraw your consent at any time.
The processing is necessary for the performance of a contract to which you are party, or about to enter and applies when data processing is required to fulfil contractual obligations, for example providing services or goods that you have ordered.
The processing is necessary for compliance with a legal or regulatory obligation to which the data controller is subject, for example, processing data for tax reporting.
The processing is necessary to protect your vital interests, such as releasing your medical information in a medical emergency.
The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller., for example, processing data for public health, education, or government functions.
The processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by your interests, rights, or freedoms. This is a bit of a grey area; "flexible" is the word often used to describe this use. An example of legitimate interest might be a company keeping job applicant details on file because, while they weren't suited for the role being advertised, they might be a good fit for future positions. Processing examples considered legitimate interest by GDPR include fraud prevention and network security.
The key objectives of GDPR are to:
The key principles underpinning GDPR are:
GDPR is intended to protect individuals against excessive sharing or use of their personal data and therefore privacy rights have been enshrined in the legislation:
Obviously, GDPR puts the onus on organisations to comply and therefore companies have some obligations to fulfil:
Each EU member state has its own supervisory authority responsible for enforcing GDPR. In Ireland, this is the Data Protection Commission (DPC). The DPC has other roles and functions relating to privacy legislation.
Laws and regulations that are not enforced are sometimes ignored. Therefore, to ensure adherence to GDPR, organisations can face significant fines for non-compliance. The maximum fines are up to €20 million or 4% of the organisation's annual global turnover, whichever is higher.
The GDPR is a far-reaching piece of legislation that has transformed the privacy landscape and helped raise the standard for privacy and security in the digital age.
GDPR has raised public awareness about data privacy and protection, leading individuals to be more conscious of their rights and more deliberate about how their data is shared.
To operate in the EU, the world's largest single market area, companies must be GDPR compliant.
Rather than comply, or being able to comply with GDPR, some organisations have had to withdraw or have chosen to withdraw access to their websites from within the EU. Many of these sites are US (local) news organisations.
An organisation may choose not to comply with GDPR because:
Because of the global reach of GDPR, there is raised awareness of, and improved data protection practices worldwide. More and more countries are enacting data privacy legislation, often based on GDPR itself
Organisations are required to demonstrate compliance with GDPR principles and those that engage in large-scale systematic monitoring or processing of sensitive data must appoint a DPO to oversee compliance with GDPR. They must also maintain detailed records of data processing activities and be able to provide these records to supervisory authorities upon request.
Organisations active in the EU are more transparent about their data processing activities and provide better information to people about their rights and must implement appropriate technical and organisational measures to ensure data security.
In addition to more high-level impact, the GDPR also has day to day implications for web users.All those cookie pop-ups and banners that you see when you arrive at a website? The GDPR is responsible for this. To comply with the GDPR, websites based in any EU country or has visitors from the EU must:
As an aside, some sites try to get round these requirements by using what are called dark (or deceptive) patterns - tricks to make you do things that you didn't mean to or wouldn't have wanted to do, like agree to have non-essential tracking cookies placed on your device. Some cookie-related dark patterns to watch out for:
Cookie pop-ups can be annoying (banners less so, as they are part of the page) but there are some browser extensions/addons that block them and decline the use of non-essential cookies (see the Links and Resources page).
Image sources:
GDPR: Dooffy, CC0, via Wikimedia Commons
http 451 error: Miserlou, CC BY-SA 4.0 , via Wikimedia Commons
