300 likes | 412 Views
We outline the proposed changes in the EU General Data Protection Regulation (GDPR) and its effect on the privacy of US-EU Data transfers.<br>Access the complete webinar on how the EU GDPR will affect your business https://info.truste.com/lp/truste/On-Demand-Webinar-Reg-Page.html?asset=J68IQUDK-565
E N D
What Does the Proposed EU Regulation Mean for Business September 16, 2015 v v Privacy Insight Series 1
Today’s Speakers Mr Andrea Glorioso, Counselor, Digital Economy / Cyber Delegation of the European Union to the USA Dr Kai Westerwelle, Partner, Taylor Wessing Dennis Dayman, Chief Privacy and Security Officer, Return Path Inc. Eleanor Treharne-Jones, Director, EMEA & Global Communications, TRUSTe v Privacy Insight Series 2
Today’s Agenda Welcome & Introductions Overview of the Main Changes in the General Data Protection Regulation Key Areas in the Regulation - Legal perspective and Impact on Business Actions to Prepare for the GDPR Q&A Eleanor Treharne-Jones • Mr Andrea Glorioso • Dr Kai Westerwelle • • • Dennis Dayman All v Privacy Insight Series 3
The General Data Protection Regulation (GDPR) – Overview of the main changes Mr Andrea Glorioso, Counselor, Digital Economy / Cyber Delegation of the European Union to the USA v v Privacy Insight Series 4
The GDPR: timeline • January 2012: proposal of the European Commission (draft Regulation + draft Directive on the exchange of personal data for police and judicial cooperation) • March 2014: the European Parliament adopts its "first reading" position • June 2015: the Council of the European Union adopts its "general approach" • July 2015 / ongoing: "trialogues" among the European Commission, the European Parliament and the Council of the European Union • Expected adoption: end of 2015 / beginning of 2016? v Privacy Insight Series 5
The GDPR: what doesn't change • The core legal concepts (e.g. definition of "personal data", "data subject", "data controller", "data processor") do not massively change compared to the main existing EU legislation (1995 Directive) • You still need a "legitimate basis" to process personal data • The objective remains the same: minimize differences of legal treatment among EU Member States in order to safeguard the internal / common market and ensure a coherent (and high) level of protection of privacy and personal data across the European Union • Extra-EU data transfers still need a legal basis to take place v Privacy Insight Series 6
The GDPR: main changes • It's a Regulation, not a Directive: no need for Member States to "transpose" it in their national legal systems • "One-stop shop" system: organizations operating in multiple Member States are supposed to interact only with the Data Protection Authority in their "main place of establishment" • "Consistency mechanism": the "main" Data Protection Authority is responsible for interacting with other Member States' DPAs to ensure coherency and avoid multiple, contradicting decisions v Privacy Insight Series 7
The GDPR: main changes • "Information notices" will become much more detailed and will have to be in an "intelligible form, using clear and plain language, and adapted to the data subject". • "Data processors" (e.g. sub-contractors to the data controllers) are now subject to much stricter controls, responsibilities and potential penalties. • Principle of "accountability": data controllers / processors must demonstrate existence of appropriate internal and external processes, control systems, auditing checks, impact assessment procedures and (in some cases) appoint a Data Protection Officer. • "Privacy by design" and "privacy by default" v Privacy Insight Series 8
The GDPR: main changes • Certain "data processing" operations are now more strictly regulated • E.g. "profiling" which requires explicit consent when performed on "sensitive data" • Obligation to notify breaches that lead to the loss or unauthorized dissemination of personal data • Jurisdictional scope of application of the GDPR is now broader: new rules apply also to organizations which are based outside the EU but are offering goods and services to EU residents or "monitor the behavior" of EU residents • Penalties will in general be stiffer: maximum of 2-5% of the global turnover of a company, or EUR 1 Million, whichever is higher v Privacy Insight Series 9
The GDPR: the end of the Internet? • The GDPR raises the bar of privacy / personal data protection • The rules are non-discriminatory: non-EU companies are not penalized compared to EU companies • Is this the much needed incentive for "data hygiene" within data-intensive companies (e.g. nowadays, all companies)? v Privacy Insight Series 10
EU-US data transfers • Umbrella agreement (exchange of data for law enforcement purposes): agreement reached on September 8, waiting for "Judicial Redress Act" to be adopted in the U.S. • Safe Harbor discussions: final details on "national security exemption" and "onward transfers", but overall agreement on the 13 Recommendations of the European Commission • Extra-EU transfers of non-personal data was and is still valid in principle! • Safe Harbor is not the only mechanism: list of "legitimate bases" for transfers (e.g. consent, performance of contract), Binding Corporate Rules, standard contractual clauses v Privacy Insight Series 11
More information • General information: http://ec.europa.eu/justice/data- protection/ • Supporting documents (fact sheets, background studies, surveys): http://ec.europa.eu/justice/data- protection/document/index_en.htm • Extra-EU data transfers: http://ec.europa.eu/justice/data- protection/international-transfers/index_en.htm • Step-by-step timeline: http://eur- lex.europa.eu/procedure/EN/201286 v Privacy Insight Series 12
Key Areas in the Regulation Legal perspective and impact on business Dr Kai Westerwelle, Partner Taylor Wessing (US) Inc. v v Privacy Insight Series 13
Harmonization Actual • European privacy laws based on EU DP Directive (to be transferred into local law) Result: different privacy laws in all European States (even within the states) Result: different levels of data protection (UK vs. France vs. Germany) Result: different regulatory requirements (e.g.: applications / registrations) Result: data protection officers only in some Member States Business Impact • European roll-out difficult, time consuming, and cost intensive Idea: compliance with the strictest regime and roll out to “lower levels” (pyramid) Highest level might not be required and is costly Remaining uncertainties v Privacy Insight Series 14
Harmonization Future • Regulation should create more harmonization (no transfer into local law) Result: the same law in all European states Result: the same regulatory requirements (e.g.: applications / registrations) But: room for interpretation by local authorities ? Business Impact • European roll-out easy as one-size fits all One-stop shopping possible Compliance with European law much less costly Substantial business advantage (for EU and non-EU entities) Privacy Insight Series v 15
Harmonization Level of data protection • Regulation creates the same level of data protection in all Member States For most European countries: stricter data protection rules For some European countries (e.g. Germany): lower standard Again: room for interpretation by local authorities ? Business Impact • Changes required if compliant with lower level (“upgrade” DP level) Review and amend data protection policies Review and amend data processing agreements Install required positions (data protection officer ?) Establish required data protection measures (e.g. TOMs / certificats) v Privacy Insight Series 16
Applicability To non-EU companies • Non-EU company offering goods or services to an EU data subject Non-EU company monitoring EU data subjects Unclear: applicable only to data controllers or also to data processors Direct relation • Companies having their seat outside the EU must name a contact person within the EU Direct claims of EU data subjects in the US (umbrella agreement and US transfer) v Privacy Insight Series 17
No Changes Prohibition with exemption • Collection and processing of personal data forbidden unless permitted Legitimate basis for processing required (statutory exemptions or consent) Group privilege • One of the most important issues in privacy No exemption for a data transfer to group companies (HR, group services) Every data transfer within the group is a transfer to a third party Consequence: HR centralization, group services, etc. are an issue Exemption has been highly discussed, seems not to be in the actual draft Business impact: no facilitation – difficult status remains v Privacy Insight Series 18
Minor Changes Commissioned data processing • Most important for any sort of outsourcing, cloud computing, services The legal concept (no transfer to a third party or general allowance) will not change Definition of “controller” and “processor” remain about the same Obligations for “Data Processors” will be stricter (control and penalties, liability) For Germany substantial change: limitation to the EU / EWR would be erased Business Impact • Amendment to the actual processes For Germany: major facilitation of all outsourcing processes ! v Privacy Insight Series 19
Major Changes Right to erasure of personal data / “Right to be Forgotten” • Data subjects have far-reaching rights to erasure of their data “Right to be Forgotten” Already somehow in place (Google Spain) Additionally possible research and clean-up obligation of first publisher Business impact: technical requirements to safeguard process (technically difficult) Right to data transfer • Data subjects have a right to request data transfer to another service provider Practical impact Impact on business set-up and terms Business impact: data might become less valuable v Privacy Insight Series 20
Major Changes Data Protection Authorities • One-stop shopping: interaction between the authorities in the Member States Main data protection authority clarifies and aligns decisions Lead authority in case of establishments in different states (main establishment) “Work behind the scenes” Business Impact • Enormous business impact Facilitation of processes (multi-jurisdictional projects) Hopefully: speed-up international processes May lead to substantial savings for companies dealing with international projects v Privacy Insight Series 21
Major Changes Data Protection Officer • New concept to many Member States Influenced by the strict German data protection law but higher level (50) Might also have labor law implications Needs awareness and implementation in company structure Certificates (on Technical and Organizational Measures) • Data protection certificates, seals, and marks (unclear relation to ASA or ISO) “One-stop approach” applies Supports outsourcing processes (audit requirements) Particularly supportive to data transfer to non-EU/EEA countries and cloud services High business impact: enabling / savings / selling advantage / customer requirements v Privacy Insight Series 22
Data Transfer to non-EU Countries No change • Remains generally forbidden Unless “adequate level of data protection” Exceptions • Consent of data subject Binding Corporate Rules EU Model Clauses (any changes ?) USA: Safe Harbor (important for US companies: new umbrella agreement) New: Data Protection Certificates v Privacy Insight Series 23
Actions to Prepare for the GDPR - Key Take-Aways Dennis Dayman, Chief Privacy and Security Officer, Return Path Inc. v v Privacy Insight Series 24
Actions to prepare for the GDPR • Privacy Policies • Multiple policies for different product lines • https://returnpath.com/privacy-policy/ • Required languages for partners or 3rd party developers • TRUSTe • Auditor • Mediator • Easy to read • Smaller sections • Hyper-transparent • Express Opt-in model v Privacy Insight Series 25
Actions to prepare for the GDPR • Privacy by Design • Taken steps to make sure that our systems and processes, particularly new ones, deliver data protection compliance as a matter of course. • Involved development and program staff • Reviewing and classify the personal data we hold and why we hold it to ensure that we can meet the requirement for ‘data minimization’ • Privacy impact assessments • Performing them on new/old products v Privacy Insight Series 26
Actions to prepare for the GDPR • Consent, Control and insight • Give to visitors and customers 100% control over data / accountability • Security • SSAE16 and ISO 27001 audit(s) • Access limitations/security account based roles/2Fa/OKTA • Breach management • Response plan(s) • Staff • Education/Certification • Localization • Considering EU Data Centre’s • Admin staff in local countries. • Corporate data handling directives • Data treasure maps • Centralized record of authority which allows us to programmatically manage and perform compliance on how data is used in the org v Privacy Insight Series 27
Questions? v v Privacy Insight Series 28
Contacts Andrea Glorioso Kai Westerwelle Dennis Dayman Eleanor Treharne-Jones andrea.glorioso@eeas.europa.eu k.westerwelle@taylorwessing.com @ddayman eleanor@truste.com v v Privacy Insight Series 29
Thank You! Don’t miss the next webinar in the Series –“Building an Effective Privacy Program – Six Practical Steps” on September 24th See http://www.truste.com/insightseries for details of future webinars and recordings. v v Privacy Insight Series 30