With GDPR, EU citizens now in full control of personal data

I am sometimes critical of the European Union (EU) for its apparent propensity to regulate especially tech-related things. Not this time! In the face of the recent Facebook-Cambridge Analytical (FACA) scandal, wherein the personal data over 87 million people were compromised, and the tons of data that tech companies like Google collect on us often […]

I am sometimes critical of the European Union (EU) for its apparent propensity to regulate especially tech-related things. Not this time! In the face of the recent Facebook-Cambridge Analytical (FACA) scandal, wherein the personal data over 87 million people were compromised, and the tons of data that tech companies like Google collect on us often without our consent, the least that one can do is to shower praise on the EU for bringing civilization back to mankind via the General Data Protection Regulation (GDPR) that went into effect 24 May 2018, with enforcement starting the following day. The GDPR is a new landmark law that generously expands the privacy rights of EU citizens and places obligations on organizations that track, market, or otherwise handle the personal data of Europeans wherever they reside on the globe. With increased globalization and expansive international flows of personal data, this effort by the EU appears quite significant.

Incidentally the EU was not motivated by the FACA scandal per se; but the organization seems to be well aware of “the evil that men do.” GDPR is the result of a lengthy process that started in January 2012 with the goal of comprehensively reforming and updating the organization’s 1995 data protection rules in a way that addresses the issues of the current digital age. Pronto, on 4 May 2016, the revised regulation was published in the EU Official Journal in all the official languages of the organization. As stated above, the enforcement of the regulation started on 25 May 2018. From this moment on, any organizations that fail to meet the requirements or document their efforts to comply can be faced with penalties of up to €20 million or 4% of the company’s global revenue for the previous fiscal year, whichever is higher. Moreover, this penalty is imposed as many times as a company is found guilty of violation.

The GDPR controls the handling of the personal data of EU individuals. The personal data handling operations covered includes collection, storage, transfer, or use of such data. The concept of “personal data” in the regulation is also very broad and covers any information relating to an identified or identifiable individual (or a “natural person”). Included in the kinds of personal data covered are a person’s name and government ID numbers. Also included are any bits of information that can show a person’s activity both online and in the real world; such as location information, IP addresses, cookies and other data that allows the tracking of users as they browse the Internet.

Any organization that processes personal data of EU individuals is within the scope of the law, regardless of whether or not the organization has a physical presence in an EU country. The CNET on 25 May 2018 puts it this way: “The GDPR applies to any organization that collects, processes, manages or stores the data of European citizens. This includes most major online services and businesses that collect, process, manage or store data. Because of this, the GDPR essentially sets a new global standard for data protection.” On the same day, Martechtoday.com gives this emphasis: “Recognizing that data can travel well beyond the borders of the EU, GDPR provides protection to EU citizens no matter where their data travels. This means that any company, anywhere, that has a database that includes EU citizens is bound by its rules. Businesses of all sizes are affected – from micro to multinational. No one is exempt.”

As you can see this is serious stuff. The details are even sterner. For example, you have to be told why, how, and where your data is going to be used. You will also have access to any websites where your data is used and you will be fully aware of the functions of the website. Also, it must be easy for you to change your mind and withdraw your consent. At your request, all of your personal data must be properly deleted, and any consent you give to the use of your personal data must be recorded and documented for controls. Your consent must be renewed every 12 months. Note that there are numerous implications for cookies – those small files of text that are automatically released into your computer as you browse the web. When a cookie is used to identify you, which is actually a common use of cookies, then it is considered to be personal data.

The GDPR is a lawyer’s best friend, given the breadth of coverage and the ease with which the regulations can be violated by companies. A few hours after the enforcement of GDPR on 25 May 2018, a number of high-profile US news websites, such as The Chicago Tribune and LA Times, became unavailable. Also, The Guardian (UK) newspaper reported that Facebook and Google became the targets of the first official complaints of GDPR non-compliance, filed on the day the privacy law takes effect across the EU. 

With the global implications of GDPR, it is hoped that many countries of the world would find a good example in EU.