The GDPR: The Impact of EU Privacy Law on US Organizations. Orla O Hannaidh February 8, 2019

Transcription

1 The GDPR: The Impact of EU Privacy Law on US Organizations Orla O Hannaidh February 8, 2019

2 Agenda 1) Top 10 Facts about the GDPR 2)Discussion on Day-to-Day Impact 3) Q&A

3 #10: Geographic Scope GDPR prote cts pe rsonal data of individuals located in the European Economic Area (EEA) European Union = 28 states (soon to be 27) EEA = 28 + Ice la nd, Norway Lichte nste in

4 #10: Geographic Scope Quiz: Doe s the GDPR protect a US citizen studying abroad in Flore nce, Italy?

5 #9: Applies to Organizations Outside of the EU The organization does not have to be physically located in the EU/EEA for the GDPR to apply to its activitie s 3 te sts : -Establishment test -Offering goods and services -Monitoring the behavior

6 #9: Extraterritorial Scope Quiz: Doe s the GDPR apply to a US company shipping makeup products to France?

7 #8: Personal Information is Very Broad Any information re lating to an ide ntifie d or ide ntifiable individual dire ctly or indire ctly Name Photo addre ss Bank de tails Computer IP address Account information

8 #8: Personal Information Quiz: Yes or No personal information under the GDPR: Handwritten notes on a job applicant Employee ID number Business contact information

9 #7: Serious Fines Risk of serious consequences for non-compliance Fine s of up to 4% of annual global turnover or 20 million

10 #7: Serious Fines Quiz: Yes or No - Google was recently fine d 50,000,000 under the GDPR

11 #6: Key Principles Data Protection Principles Article 5 Personal data must be: a b Processed lawfully, fairly and in a transparent manner Collected for specific / explicit / legitimate purposes c d e f Adequate, relevant and limited to what is necessary Accurate (every reasonable step must be taken to rectify/erase inaccurate data without delay) Kept in a form which permits identification for no longer than is necessary Kept secure

12 #6: Key Principles Quiz: The GDPR sets forth clear and exact standards on the type of security a company must implement. True or False?

13 #5: Individuals Have Rights Right of access to personal data Right of re ctification/corre ction Right to erasure / to be forgotten Right to restrict processing Right to data portability

14 #5: Individual Rights Quiz: How long does a company have to respond to a request from an individual? 30, 60 or 180 days?

15 #4: Consent is Not Always Misconception that consent is always required to collect and use personal data There are 5 other lawful bases Required (e.g., pe rformance of a contract, compliance with le gal obligation, le gitimate inte re sts) Each use must have a lawful basis

16 #4: Consent Continued Quiz: True or False: Consent can be colle cte d with a general notice and pre-ticked box?

17 #3: CCPA versus GDPR California Consumer Privacy Act comes into effect on January 1, 2020 There is some overlap with the GDPR, but also many differences Se parate imple me ntation plan like ly required

18 #2: GDPR Requires a lot of Documentation Documentation and accountability is a key part of the GDPR Data must be mapped Who has the data? Where is it locate d? Who do we share it with? What do we colle ct? Why do we colle ct it? Decisions about data uses must be analyzed and supported Responses to requests documented

19 #1: 100% GDPR Compliant Caution against claims of 10 0 % compliance Risk-based approach GDPR is meant to harmonize privacy laws across the EU, but many differences at the local level Re gulators are still issuing guidance Still young law with limite d enforcement actions

20 Discussion and Questions