Noreen Krall: “The heavy processing requirements on corporations doing business in Europe are just tremendous. It really does pose a challenge.”

As corporate legal departments brace for new European privacy protections set to take effect in May, a top in-house lawyer for Apple Inc. on Thursday predicted the rules—known as the General Data Protection Regulation—will put “heavy processing requirements” on companies that must give consumers more control over their personal information.

Apple vice president and chief litigation counsel Noreen Krall, speaking at the ChIPs Women in Tech, Law and Policy Global Summit in Washington, underscored the challenge companies faceas they set up systems to handle consumer requests for the removal of personal data and to obtain consent for the collection of certain information.

“Basically it puts heavy, heavy processing obligations on companies” to deal with requests concerning the handling of consumer data, Krall said. She added: “So the heavy processing requirements on corporations doing business in Europe are just tremendous. It really does pose a challenge.”

The costs of failing to comply with the European Union's new, uniform privacy regulations can be steep, with a maximum penalty of 4 percent of the violating company's global sales revenue.

And the regulation is sweeping, Krall said during the Washington panel discussion, moderated by Caroline Krass, a former general counsel to the CIA who now leads Gibson, Dunn & Crutcher's new national security team.

“The challenge is that it applies to all personal data, meaning any data that can be used, ultimately, to identify who you are. So it's far beyond your name, your Social Security, your bank account. It's your IP address, or your device ID, or a reference number to a customer, or a complaint or question that you brought in. For any organization, beyond tech, it just covers just about anything,” she said.