Pablo Meles, Of Counsel, Espinosa Martinez

The General Data Protection Regulation (GDPR) is a broad and comprehensive European Union (EU) data privacy law going into effect on May 25. This is a great example of the law trying to catch up with the technology and our digital lives. In essence, the GDPR is creating fundamental digital rights for EU residents and compliance is mandatory for organizations controlling and processing the personal data of EU residents. Thus, the scope of the law applies to entities outside the EU if they offer goods or services to EU residents, or monitor the behavior of EU residents. For example, if a U.S.-based social network or e-commerce website processes personal data of an EU resident, they would be subject to GDPR law. This is a progressive law that should eventually be adopted in some form in the United States. Privacy and data protection is at the heart of the regulations. The GDPR further requires that companies handling personal data to be accountable for managing such data.

The GDPR provides for fines up to 20 million euro or up to 4 percent of global turnover for the previous 12 months, whichever is greater. In some instances, the GDPR also provides for warnings, reprimands, or temporary suspension of data processing. Worse yet, violations of the GDPR can cause brand and reputation damage from customers complaining.

In practical terms, the GDPR applies to personal data or a broader form of what is known as personal identifiable information (PII). In the context of the GDPR, personal data can include any data associated to an individual such as names, IP, social media, email, or home addresses, cookies, personal photographs, etc. Controllers and processors have a responsibility to protect and not abuse personal data collected. A controller determines the purposes and means of use of personal data. A processor acts on the instructions of the controller and processes the personal data on behalf of the controller. Processing under the GDPR has a very broad definition and can include just merely storing the data.

Social media services or selling platforms can be considered a controller when they collect information from customers. As a vendor utilizing such services, the vendor collecting personal data for transactions or other purposes can also be considered the controller. Social media services and selling platforms can also be considered the processor when they provide services.

Fundamental under the GDPR is fairness and transparency requiring being upfront with what is being done with personal data such as providing the necessary notices and consents. More specifically, privacy notices and opt in tick boxes should be used. Additional notions under the GDPR include data minimization, accuracy, storage limitation, integrity, confidentiality and a user's right to be forgotten.

In the example of sending emails to your contacts, additional information about use of personal data must be communicated to contacts. Privacy notices and policies should be updated to reflect the new requirements of the GDPR, including clearly defining the purposes of processing personal data, how such data will be retained, and the legal basis for use of personal data relied upon.

The legal basis for use or processing can fall under a number of categories such as consent, implied consent, contractual, legal obligation, or legitimate interests. The simplest most reliable legal basis is consent, but in practical terms obtaining consent from a marketing standpoint can be the easiest way to lose a customer, as they may not want to “opt-in.”

With consent as a legal basis, an individual gives clear consent for a processor to process their personal data for a specific purpose. The GDPR creates a higher bar by requiring a clear and affirmative act that is clearly and freely given. In the GDPR world, opt outs or pre-ticked boxes are history. Additionally, bundled consent in a single tick box might not be considered freely given and therefore noncompliant. Give choice and control that is specific, informed, and detailed. Give a link to the privacy notice. Use clear, plain language that is understandable. Don't make consent a pre-condition for service.

Implied consent can form a legal basis based on an act such as dropping a business card in a bucket for entry in a contest. An initial email communication might be OK thereafter, but such implied consent would not extend to additional marketing. A contract or compliance with a public law may also form a legal basis.

Besides consent, legitimate interest is the most likely used legal basis. A legitimate interest may be necessary for direct marketing or the legitimate interests of a third party unless there is a good reason to protect the individual's personal data, which overrides those legitimate interests. In determining a legitimate interest, there should be consideration of a relevant and appropriate relationship and the expectation from such relationship. It is a legitimate interest to send emails to existing customers. Using the basis of a legitimate interest can fall into a gray area, and people can object and processors should appropriately give customers the right and the ability to opt out. In determining a legitimate interest, the processor or controller should consider a balancing test to see if the individual will be adversely impacted.

Pablo Meles is of counsel with the Miami law firm of Espinosa Martinez. He focuses his practice on patent prosecution and patent litigation support and may be reached at [email protected].