GDPR—A New Fundamental Right Protecting Personal Identifiable Information and More
The General Data Protection Regulation (GDPR) is a broad and comprehensive European Union (EU) data privacy law going into effect on May 25.
May 22, 2018 at 10:50 AM
5 minute read
The General Data Protection Regulation (GDPR) is a broad and comprehensive European Union (EU) data privacy law going into effect on May 25. This is a great example of the law trying to catch up with the technology and our digital lives. In essence, the GDPR is creating fundamental digital rights for EU residents and compliance is mandatory for organizations controlling and processing the personal data of EU residents. Thus, the scope of the law applies to entities outside the EU if they offer goods or services to EU residents, or monitor the behavior of EU residents. For example, if a U.S.-based social network or e-commerce website processes personal data of an EU resident, they would be subject to GDPR law. This is a progressive law that should eventually be adopted in some form in the United States. Privacy and data protection is at the heart of the regulations. The GDPR further requires that companies handling personal data to be accountable for managing such data.
The GDPR provides for fines up to 20 million euro or up to 4 percent of global turnover for the previous 12 months, whichever is greater. In some instances, the GDPR also provides for warnings, reprimands, or temporary suspension of data processing. Worse yet, violations of the GDPR can cause brand and reputation damage from customers complaining.
In practical terms, the GDPR applies to personal data or a broader form of what is known as personal identifiable information (PII). In the context of the GDPR, personal data can include any data associated to an individual such as names, IP, social media, email, or home addresses, cookies, personal photographs, etc. Controllers and processors have a responsibility to protect and not abuse personal data collected. A controller determines the purposes and means of use of personal data. A processor acts on the instructions of the controller and processes the personal data on behalf of the controller. Processing under the GDPR has a very broad definition and can include just merely storing the data.
Social media services or selling platforms can be considered a controller when they collect information from customers. As a vendor utilizing such services, the vendor collecting personal data for transactions or other purposes can also be considered the controller. Social media services and selling platforms can also be considered the processor when they provide services.
Fundamental under the GDPR is fairness and transparency requiring being upfront with what is being done with personal data such as providing the necessary notices and consents. More specifically, privacy notices and opt in tick boxes should be used. Additional notions under the GDPR include data minimization, accuracy, storage limitation, integrity, confidentiality and a user's right to be forgotten.
In the example of sending emails to your contacts, additional information about use of personal data must be communicated to contacts. Privacy notices and policies should be updated to reflect the new requirements of the GDPR, including clearly defining the purposes of processing personal data, how such data will be retained, and the legal basis for use of personal data relied upon.
The legal basis for use or processing can fall under a number of categories such as consent, implied consent, contractual, legal obligation, or legitimate interests. The simplest most reliable legal basis is consent, but in practical terms obtaining consent from a marketing standpoint can be the easiest way to lose a customer, as they may not want to “opt-in.”
With consent as a legal basis, an individual gives clear consent for a processor to process their personal data for a specific purpose. The GDPR creates a higher bar by requiring a clear and affirmative act that is clearly and freely given. In the GDPR world, opt outs or pre-ticked boxes are history. Additionally, bundled consent in a single tick box might not be considered freely given and therefore noncompliant. Give choice and control that is specific, informed, and detailed. Give a link to the privacy notice. Use clear, plain language that is understandable. Don't make consent a pre-condition for service.
Implied consent can form a legal basis based on an act such as dropping a business card in a bucket for entry in a contest. An initial email communication might be OK thereafter, but such implied consent would not extend to additional marketing. A contract or compliance with a public law may also form a legal basis.
Besides consent, legitimate interest is the most likely used legal basis. A legitimate interest may be necessary for direct marketing or the legitimate interests of a third party unless there is a good reason to protect the individual's personal data, which overrides those legitimate interests. In determining a legitimate interest, there should be consideration of a relevant and appropriate relationship and the expectation from such relationship. It is a legitimate interest to send emails to existing customers. Using the basis of a legitimate interest can fall into a gray area, and people can object and processors should appropriately give customers the right and the ability to opt out. In determining a legitimate interest, the processor or controller should consider a balancing test to see if the individual will be adversely impacted.
Pablo Meles is of counsel with the Miami law firm of Espinosa Martinez. He focuses his practice on patent prosecution and patent litigation support and may be reached at [email protected].
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllData Breaches, Increased Regulatory Risk and Florida’s New Digital Bill of Rights
7 minute readNavigating Florida's Products Liability Law: Defective Products, Warnings and the Pursuit of Justice
6 minute readNavigating Florida Property Insurance Claims in a Post-Fee-Shifting World
5 minute readTrending Stories
- 1Recent Decisions Regarding the Telephone Consumer Protection Act
- 2The Tech Built by Law Firms in 2024
- 3Distressed M&A: Mass Torts, Bankruptcy and Furthering the Search for Consensus: Another Purdue Decision
- 4For Safer Traffic Stops, Replace Paper Documents With ‘Contactless’ Tech
- 5As Second Trump Administration Approaches, Businesses Brace for Sweeping Changes to Immigration Policy
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250