EU General Data Protection Regulation

The EU General Data Protection Regulation may be passed by the European Parliament this week, but if so, it will not take effect until early 2018. The GDPR provides for single set of rules governing data transfers between European countries and non-European countries. The current EU Data Protection Directive regime allows different countries to have different rules. The new regulations do provide varying degrees of protective measures based on the risks posed by different businesses' activities.

Under this new regime, all businesses operating in the EU will be accountable to only one authority. The old 'Directive' had to be voted into force by national legislatures, whereas the new 'Regulation' can be implemented in states directly. The GDPR will replace the European Data Protection Directive, discussed in the Tip of the Night for February 27, 2016, and provide for uniform data protection regulations throughout the EU. [Note the EU does not include Switzerland, Norway, Serbia, Bosnia, Serbia, Albania and Montenegro, but does include the rest of Europe west of the Belarus and Ukraine, and does include the Baltic States].

Note that the GDPR does not apply to the review of data in the interest of national security or for law enforcement activities relating to criminal law. While each EU state will have its own Supervising Authority, every business will have a single 'lead authority' to monitor all of its processing activity. The regulations require Data Protection Officers be appointed to assist data controllers and processors in complying with the GDPR. The DPO has to have knowledge of both the law and information technology processes. Any data breaches are to be reported by the DPO to the Supervising Authority promptly.

Violations of the GDPR can lead to sanctions of either the greater of 20 million Euro, or 4 per cent of the global turnover [sales revenue] of a business. Data subjects will no longer have a Right to Be Forgotten, but will instead have a Right to Erasure which is has a smaller scope.

The GDPR, unlike the DPD, covers non-EU businesses which process the data of EU citizens.

EU Data Protection Directive Article 26(2) Contracts

As discussed in the Litigation Support Tip of the Night for February 27, 2016 Article 26(2) of the EU Data Protection Directive (Directive 95/46/EC) provides that model contracts can be created to transfer personal data outside of the safe harbor or privacy shield framework. Word versions of the these contracts, or contractual clauses can he found here. There are two for the transfer of data to controllers outside the European Union and European Economic Area and one for the transfer of data to processors outside the EU/EEC.

The first contract, Decision 2001/497/EC, for transfer to data controllers contains some interesting provisions in Appendix 2 which sets forth the mandatory data protection principles:

Special categories of data: where data revealing racial or ehtnic origin, political opinions, religious or philosophical beliefe or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC, in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of access to sensitive data.

I have left spelling mistakes in the original Word documents downloaded from the European Commission's site. It's very odd to find these in official documents. Be sure to watch out for them. This provision puts an onus on the data controllers to either encrypt or log access to data about not only an individual's ethnic background, personal health data, political beliefs, and sexual activity, but also apparently security measures meant to protect this information by the individual it concerns.

Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this Appendix, in particular because the data are incomplete or inaccurate. He should also be able to object to the processing of the data relating to him on compelling legitimate grounds relating to his particular situation.

An individual can request access to data about herself or himself and correct or erase data that is incomplete or inaccurate. The Appendix also gives an individual the right to opt out of any programs using her or his data for the purposes of direct marketing. When the data is transferred to other controllers the data subjects must be notified in detail and give their consent, or the new controllers must assent to the provisions of the contractual clause.

The second contract for the transfer of data to controllers, Decision 2004/915//EC, is a revision of the first and contains similar provisions but was modified so that the data exporter and the data importer are not jointly liable for breaches to the data subject, but each have their own due diligence responsibilities.

The third draft contractual clause, for the transfer of data to processors, Decision 2010/87/EU, in addition to provisions guarding against the inadvertent destruction or disclosure of data; notification obligations to the data exporter about access by law enforcement agencies, accidental or unauthorized access, & data requests by subjects; and the right of a supervising authority to conduct an audit of the data importer, the draft contract also provides that the data importer will, "return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so"