PRIVACY

The EU General Data Protection Regulation (GDPR), which governs how personal data of individuals in the EU may be processed and transferred, went into effect on May 25, 2018. GDPR is a comprehensive privacy legislation that applies across sectors and to companies of all sizes. It replaces the Data Protection Directive 1995/46. The overall objectives of the measures are the same – laying down the rules for the protection of personal data and for the movement of data.

GDPR is broad in scope and uses broad definitions.  “Personal data” is any information that relates to an identified or identifiable living individual (data subject) such as a name, email address, tax ID number, online identifier, etc.  “Processing” data includes actions such as collecting, recording, storing and transferring data.

A company that is not established in the Union may have to comply with the Regulation when processing personal data of EU and EEA residents (EEA countries are Norway, Lichtenstein and Switzerland):
a) If the company offers goods or services to data subjects in the EU; or,
b) If the company is monitoring data subjects’ behavior taking place within the EU.

The mere accessibility of a company’s website in the EU is insufficient to subject a company to GDPR, but other evidence of the intent to offer goods or services in the EU would be relevant. 

As a general rule, companies that are not established in the EU but that are subject to GDPR must designate in writing an EU representative for purposes of GDPR compliance.  There is an exception to this requirement for small scale, occasional processing of non-sensitive data. 

Fines in case of non-compliance can reach up to 4% of the annual worldwide revenue or 20 million euros – whichever is higher.  Companies of all sizes and sectors should consider GDPR as part of their overall compliance effort with assistance of legal counsel.

The European Commission and Data Protection Authorities are releasing official guidelines to help companies with their compliance process.  These documents relate, for instance, to the role of the data protection officer, personal data breach notification, data protection impact assessment.

Note: the EU is currently updating its e-privacy legislation governing confidentiality of communications.  This legislative instrument once enacted will add several requirements in addition to the GDPR.  We encourage U.S. exporters to monitor this situation as it evolves through the EU legislative process.