GDPR stands for General Data Privacy Regulation, EU. Which is the new data protection law that was passed by EC (European Council)/EU (European Union) adopted on 14 April 2016 and has been imposed on 25 May 2018.
This law will be applicable on all organisations and companies which collect data of European citizens & residents. GDPR replaces the earlier law of DPD (Data Protection Directive). The purpose of this law is to maintain the transparency between user and organisations/companies.
For the companies this rule is to look into their processes on, what data is collectedIJ Why is it collectedIJ How it is used and the major part would be the privacy of the citizens & residents.
The Article (4) defines the few basic entities of the regulation :
Data Subject: It is any person whose personal data is being collected, held or processed.
What is Personal data/ PII (Personal Identifiable Information): Any information that identifies a user like his email, bank details, photos and even IP address
Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others determines the purposes and means of the processing of personal data. They collect this information at source with a defined purpose for the collection of that data.
Processor: The processor or data processor is a person or organisation who deals with personal data as instructed by controller for specific purpose & services.
The breach of this regulation brings a penalty upto 4% of the global turnover or €20 million, whichever may be higher.
There are 7 key rights of this law:
lUser consent
lData breach notification
lRight to access
lRight to be forgotten
lData portability
lPrivacy by design
lData protection officer
User consent : Under this key right you must use commercially reasonable efforts to disclose clearly, and obtain consent to, any data collection, sharing and usage that takes place on any site, application, email publication or other property .
Data breach notification: In the case of any personal data breach the user gets notified without due or any delay, not later than 72 hours after becoming aware of it that the personal data has breached and he can supervise it under Article (55)
Right to access: This is one of most constructive right where user can access his/her own data anytime from anywhere.
Right to be forgotten : Under this right user can also make himself/herself to forget and the site or application not only will log them off but also delete entire data that was stored in their server. This right is also known as 'right to be deleted'.
Data portability : The right to data portability allows a user to reuse his/her own data without affecting the usability it also allows to share, copy and move data from one IT Environment to another securely or may be in encrypted form.
Privacy by design: In this concept company must secure personal data and the infrastructure and technologies should be systematic. May be with data flow diagrams internally for any data that is being stored.
Data Protection Officer: A data protection officer (DPO) would be the leader, who would supervise all shared data by users and implementation to ensure compliance with GDPR requirements. If you are any public institution or have more than 250 employees you need to appoint a Data Protection Officer.
The GDPR being the first step towards the global data privacy getting initiated in widespread EU, one side ensures the rights of individuals however at other end has many untouched or unaddressed points which may have been very critical. Ex: (Article 35) Which says it is necessary to do a DPIA (Data Privacy Impact Assessment) for all High Risk Process Activities however does not define or declare which all activities would be categorised under these. Many such lacunas are still unanswered or defined however we still see a stride with intent primarily to give control to citizens & residents of EU over their personal data. This would also simplify the regulatory environment for international business by unifying the regulation within the EU.
(The author is an Economic Employment expert & IT/Cyber matters enthusiast who has been active on all such prevalent global & national issues. He is amongst the eminent panelist on various National News channels like NDTV, ZEE Business, ABP News, CNN News 18, News Nation, Prime News on these subjects)