EU-Wide Data Protection Regulation Moves Forward – Nine Things You Should Know

I have gathered nine highlights of the new data protection rules that you should know.

One continent, one law: the Regulation will establish a single, pan-European data protection law replacing the current inconsistent patchwork of national laws. In the future, your company will only have to deal with one law, not 28.

Strengthened individual rights: companies will have to inform individuals in a clear and understandable way about the processing of their personal data. When there are no longer legitimate grounds for retaining data, an individual will be able to ask for the data to be deleted (right to be forgotten).  A right to data portability will help people transfer personal data between service providers.

Right to know if hacked: your company will have to notify the national data protection authority as soon as possible (not later than 72 hours) about data breaches and will also have to notify affected data subjects without undue delay.

Data protection impact assessment: an assessment will be required when processing is likely to result in a high risk for the individuals, such as discrimination, identity theft or fraud, financial loss, damage to reputation, unauthorised reversal of pseudonymisation or significant economic or social disadvantage.

Data protection officer: it will no longer be obligatory to appoint a data protection officer unless mandatory under national law.

Codes of conduct: the regulation will encourage codes of conduct to be drawn up for specific sectors and for specific needs of SMEs (small and medium-sized companies).

European rules on European soil: if your company is based outside the EU, it will have to apply the same rules and guarantee the same level of protection for personal data when offering services in the European market.

More powers for independent national data protection authorities: in order to effectively enforce the rules, national data protection authorities will be empowered to fine companies that violate EU data protection rules. The fine may be up to €1 million or 2% of the global annual turnover of the offending company.

One-stop shop: companies will only have to deal with a single supervisory authority, which will make it easier and cheaper for companies to do business across the EU. Similarly, individuals will only have to deal with their national data protection authority—in their own language—even if their personal data is processed outside their home country. I am optimistic that the new regulation will strengthen and harmonise data protection rules in the EU. We will be closely monitoring the progress of the new general data protection regulation and keep you up-to-date on any developments.