Table of Contents
WHEN IS THE GDPR COMING INTO EFFECT?
The GDPR was approved and adopted by the EU Parliament in April 2016.
The regulation was to take effect after a two-year transition period and, unlike a Directive it does not require any enabling legislation to be passed by
government; meaning it will be in force May 2018.
WHAT WAS THE NEED?
WHY IS THE GDPR SO IMPORTANT?
The phrase “data is the oil of the 21st century” could not be more true than it is today. For a lot of businesses (personal) data processing is a significant activity. Nearly every company is processing some personal data on a regular basis.
IMPLICATIONS
The potential consequences of this widely-defined remit for personal data was demonstrated by Facebook’s Cambridge Analytica scandal, where a third party app saw millions of users’
profile data scraped, allegedly to influence the outcome of the 2016 US election.
WHAT IS THE GDPR?
The European Union’s (EU) General Data Protection Regulation (GDPR), which takes effect
from 25 May, envisages strict rules for handling personal data of users and specifies new protocols for handling and storing private data, and sharing it with third parties.
WHO DOES THE GDPR AFFECT?
•The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behavior of, EU data subjects.
•It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.
WHAT ARE THE PENALTIES FOR NONCOMPLIANCE?
Organizations can be fined up to 4% of annual global turnover for breaching GDPR or €20 Million. This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts.
NOTES
• The new Regulation replaces the General Rules on Data Protection, 1995 and the 2008 framework decision on cross-border data processing in police and judicial cooperation within the EU.
WHAT CONSTITUTES PERSONAL DATA?
• The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
• This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
IMPLICATIONS ON INDIA
• Why should we bother about a European data protection rule?
•Europe is a significant market for the ITeS, BPO and pharma sectors in India. The size of the IT
industry in the top two EU member states (Germany and France) is estimated to be around
$155–220 billion.
GDPR IS JUST THE BEGINNING
Following the Supreme Court’s verdict, a data protection framework has been proposed by
the Srikrishna Committee in India. Expect recommendations of the Srikrishna
committee by June on data protection law: Ravi Shankar Prasad (Union minister for electronics
and IT ).
WhatsApp