GDPR Lock Cybersecurity

The deadline to be compliant with the European Union's General Data Protection Regulation is at the end of next week. Yes, seriously. So, are you and your organization ready?

No, really think about it. Do you know that you're ready?

The GDPR has a number of provisions that could prove costly to unaware organizations. While the maximum penalty of the greater between $20 million or 4 percent of an organization's annual revenue may not be widely applied, compliance will still be expected for all organizations that touch EU citizens' data in some way. And in the internet age where even having an online store could mean interacting with EU citizens' data, that means just about everybody.

There's a lot to learn, no matter where you are in your GDPR prep. That's why we've pulled together these stories to aid both novices and experts. We'll continue our GDPR coverage as well up through the May 25 deadline and beyond.

1. The Basics: The GDPR has six guiding privacy principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; integrity and confidentiality; and storage limitation. Getting down those definitions is a good place to start, because as GDPR Article 52 notes, ““The [data] controller shall be responsible for, and be able to demonstrate compliance with,” the above principles.

2. A Legitimate Interest: One of those basics that may be tough to grasp is the idea of having a “legitimate interest” to process data, as mandated by the GDPR. As reported in Legaltech News, the wording in the EU's Data Protection Directive and the GDPR concerning a legitimate interest is exactly the same, save for a few additions the GDPR has on protecting the data of children. In 2014, EU's Article 29 Working Party released an opinion explaining how legitimate interest operates under the directive, noting that the concept of legitimate interest is “open-ended” so that it can be “relied upon in a wide range of situations, as long as its requirements” are met. In one Avepoint study, 47 percent of respondents said they needed more clarity on the concept of “legitimate interest” in the GDPR.

3. The Issue of Consent: Another basic that some may struggle with has to do with confidentiality, and how to actually obtain consent from EU users to utilize their data. LTN's Ian Lopez explored this issue in the case of Facebook earlier this month and found that for many companies that rely on user data, the GDPR's requirements may not be easy. In particular, GDPR Article 17 allows a data subject to demand controllers, such as Facebook, erase data “without undue delay.” Also known as “the right to be forgotten,” the law established in previous EU privacy laws and rulings takes on new weight with the looming GDPR.

4. The Data Protection Officer: One of the unique positions created by the GDPR is that of the “data protection officer,” which the regulation states should be “designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices.” This doesn't necessarily mean a new hire, as the law permits a compliance chief, for example, to add the DPO designation, or even the DPO to be an outside contractor who can serve more than one company. In Microsoft's case, the company hired an outside IT expert. One recent survey found that 63 percent of companies already have a DPO in place.

5. Your Employee Data: Much of the GDPR focus has been on customer data too, but it's important to remember that the regulation covers all data, including that of your own employees. These rights include the aforementioned right to be forgotten. Notably though, Cooley partner Ann Bevitt told Corporate Counsel last week that under the GDPR, employers do not need to obtain consent from their employees to process data. She said employee consent is not valid because the “balance of power in the employment relationship” is weighted so heavily toward the employer.

6. Ensuring Insurance: Double-checking the organization's insurance coverage in case of an emergency is another thing that can get lost in the GDPR weeds, but more mature organizations should probably double-check. Writing for Legaltech News, cyberinsurance expert Judy Selby says any analysis should include a thorough review of the various mandates contained in the GDPR, as well as the company's practices around protected data, its current insurance policy(ies), and the law governing interpretation of those policies. Importantly, even companies that currently have cyberinsurance in place may not have optimal coverage for the variety of exposures under the GDPR.

7. Firms Doing Double Duty: So what are organizations doing to prepare? Large law firms told The American Lawyer that the GDPR has sent “paper flying” at their firms. London-based Ropes & Gray partner Rohan Massey explained, “Some businesses run on the value of data, that's their entire business model,” he said. “Others have it as a byproduct, it's not their core purpose. They're the ones that are behind.” As a result, said London-based Squire Patton Boggs partner Anne LaFrance, extremely sophisticated data-rich, consumer-facing businesses—the “pick and mix clients”—come in the door with particularly complex issues, such as how to manage the new regulation on a pan-European basis. But there are companies handling business-to-business data—the “soup to nuts clients,” LaFrance calls them—that have never focused on these issues before and need help with everything.

8. ALSPs to the Rescue: But it's not just law firms that corporate legal departments are turning to. For help in a pinch, a number of alternative legal service providers have also rolled out GDPR-specific packages, primarily in high-volume work such as information and contract management. Legaltech News' Gabrielle Orum Hernández explored how many GDPR response teams are comprised of a mix of corporate attorneys, outside counsel, and ALSP experts. “There's a constant flow of regulatory change,” said Chris DeConti, executive vice president of global solutions at Axiom. “They start realizing that, they set up organizations to respond to that, and those organizations tend to be a mix of lawyers, operations people, tech people, and project management folks.”

9. But the Work's Not Done: Although many in-house counsel are aware of changes that need to be made, those changes still need to actually be implemented. An Association of Corporate Counsel report released in early May looked at what still needed to be done. Some 47 percent of respondents reported that, in order to comply with GDPR, they must change data security standards. Meanwhile, 45 percent said they must change their breach notification procedures to do so, and 43 percent said they need to modify incident response plans. This is particularly pressing in the health care and financial services sectors, where a separate April survey found that 7 percent of health care companies said they are unlikely to be fully compliant by the deadline, while 3 percent of financial services companies reported they haven't even begun the process to do so.

10. A Marathon, Not a Sprint: And it's important to note: Even though May 25 is the deadline for compliance, it doesn't mean compliance can lapse after that date. The GDPR is an ongoing process. McDermott Will & Emery partner Mark Schreiber told Legaltech News: “What we're beginning to realize is that May 25 is not a stopping point. It's in some respects just a beginning.” The race toward GDPR compliance, Schreiber said, “is going to be more like a marathon than a 100-yard dash.” He added, “These obligations are going to go on for years with a number of new adjustments and modulations, further investment and compliance. It's not a one-stop, one-point-in-time obligation.”