The largest shakeup to data protection has come into force, but why is it happening and who does it affect?
The General Data Protection Regulation, or GDPR, is the reason for the deluge of emails from companies you have ever handed your contact details over to, or purchased shopping from, are now clogging up your inbox.
Many are asking you to read their terms and conditions and confirm you wish to continue receiving correspondence. But do you actually have to do anything? In this guide we explain what GDPR is and whether it affects you.
What is the GDPR?
The GDPR is an an EU-wide set of rules around personal data. It applies to data used by businesses and organisations, sets standards for how it is used, brings in rules for reporting data breaches, and provides greater protection for digital privacy.
At a glance: Your data rights under GDPR
The General Data Protection Regulation (GDPR) is a tough regulation regime for companies that gather personal data, introduced by the EU in April 2016. Enforcement begins 25 May 2018.
The GDPR legislates eight data rights for individuals:
- Right to be informed – You must be clearly informed when your data is collected and the purpose for which it is intended.
- Right of access – You must be allowed to view the data companies have gathered on you.
- Right to rectification – You have the right to correct erroneous information about yourself in a company’s data records.
- Right of erasure – Also known as the “right to be forgotten”. You have the right to request the deletion of personal data held on you, although this right is not absolute.
- Right to restrict processing – You can request the suppression of your personal data file, or restrict its processing.
- Right to data portability – You have the right to take the data a company has collected on you and share it elsewhere, eg. to get a better customer deal.
- Right to object – You have the right to object and prevent your data being used for particular purposes, eg. for direct marketing. This right is superseded by legal claims.
- Rights related to automatic decision-making – You may only be profiled with your explicit consent, where this is necessary to enter into a contract or where such processing is authorised by the state.
Post-Brexit the UK is likely to introduce its own equivalent data protection law. In any case, companies which gather data on EU citizens will have to abide by the GDPR.
How will companies treat you and your data differently?
Businesses must be able to prove that the data they collect is relevant and for a specific purpose. It must also be accurate, secure and up to date.
If your data is breached, companies must quickly inform users within a 72 hour deadline or face a €10m (£8.75m), or 2pc of their turnover, and those found not to have followed the rules around processing data could face fines of €20m, or 4pc of turnover.
These are far greater than fines currently meted out than under current rules. TalkTalk was fined £400,000 by the Information Commissioner’s Office in 2016, a record, but this could have been up to €59m under the new rules. That said, the ICO is supposed to enact “proportionate” fines, so they may not be so steep.
What do you need to do?
What about social networking sites?
In some cases you might be asked to comply with a site’s data policy, or be denied the service. Facebook has been using this tactic for EU users, explicitly stating that Facebook users must comply with at least some of its data rules or they cannot use its service.
The rules state the data collected must be necessary for the service to work, but some have argued Facebook’s demand for consent goes beyond this.