EU Privacy

Organizations who've long been preparing for the European Union's General Data Protection Regulation to go into effect may now have to look beyond the landmark regulation to see what other EU-based privacy requirements they may be responsible for.

U.K.-based law firm Bird & Bird recently launched a GDPR legislative tracker to help organizations manage requirements set by local Data Protection Authority groups to buttress the new regulation. The tracker denotes which EU member states have passed supplemental legislation, and what key issues organizations need to account for in each nation.

Gabriel Voisin, a partner in Bird & Bird's privacy and data protection practice, explained that member states were given regionally specific leeway to implement privacy regulations beyond the specific mandates of the GDPR. “This tracker aims to keep an eye on those national implements where the member states have been left this room, so that now organizations who have digested or started to digest GDPR, they can also look at the second layer,” he noted.

Although the GDPR's requirements have long been the top priority for privacy specialists, Voisin said organizations seem to be doing a good job of keeping up-to-speed on various local considerations across EU member states. Still, many organizations have a great deal of work to do in this arena.

“Many organizations, especially multicountry organizations, have delayed the second part of the exercise—to localize and review local laws—because, and rightly, they were not in a position to make a meaningful assessment and review, so they had a bucket approach,” he said, noting that many organizations have taken broad, GDPR-focused approaches to compliance to use their resources most effectively.

Voisin flagged a few key areas where the tracker can provide clarity for folks: specific local DPA regulation, age of children requiring parental consent, and potential medical research exemptions for pharmaceutical and clinical trial companies. “The age of children for parental consent can also be good, especially for video game companies, because they are definitely the kind of companies that will be concerned by that,” he said.

Part of the difficulty in complying with local DPA ordinances also lies in the fact that many DPAs haven't fully finalized their supplemental legislation. “It's still a work in progress,” Voisin noted. “There are still member states lagging behind and working behind where they're supposed to have prepared for, so for once we can say it's not just organizations who are behind, it's also the member states.”

Voisin hopes that DPA's lack of finalization, much like organizations subject to GDPR compliance, might be factored into the scrutiny companies are set to face under the new regulation. “That should be taken into consideration when it comes to the moment of enforcement,” he said.

Notably, some organizations are already facing scrutiny under GDPR. Google and Facebook were each hit with multibillion dollar lawsuits on the first day GDPR went into effect, and a number of popular websites simply removed services for EU customers to avoid regulatory scrutiny.

Voisin was not at all surprised to see large companies such as Google and Facebook hit by these lawsuits. “What will have to be monitored is the reaction of the DPAs,” he said. “We'll have to see how they're going to be able to, on the one hand, please those privacy consumer organizations by looking into the matter, and [also] respecting the promise of being pragmatic.”