Roughly a year after the European Union's General Data Protection Regulation (GDPR) went into effect, a panel of Philadelphia-area general counsel said they are still explaining the regulations new requirements to their corporations and still figuring out how to comply.

The GCs spoke at the “Beyond Borders: GDPR, CCPA and the Tightening Restrictions on Consumer Data Monetization” panel during Fox Rothschild's second annual Privacy Summit on Wednesday.

Panelists included Jacquelyn Caridad, chief privacy officer and associate GC at Dow Jones & Co.; Cynthia Gage Kellam,TE Connectivity's global security director; Tanya Madison, chief privacy and cybersecurity counsel at TD Bank; and Sheila Phillips Hawes, vice president and chief privacy officer at AmerisourceBergen Corp. The panel was moderated by Fox Rothschild partner and GDPR compliance and international privacy chair Odia Kagan.

The panelists noted that the GDPR takes an individual rights approach to data privacy, which is an essential aspect to stress when explaining how a company can use individuals' data. Caridad noted that those in her company have to understand data collected can't be used for a new purpose without prior consent.

“We need to be clear on what we are collecting and why,” she said. “And if you have other purposes you might think of later, come and talk to me and see if they've already disclosed it and the individual already knows that or expects that. … It's definitely an evolving conversation. and the more you have these conversations, the more the teams understand.”

Having those data consent conversations also includes explaining why a company's processes must meet certain data privacy requirements, even if they do not directly fall under GDPR's purview.

Kagan noted, “You may not need to worry about regulatory enforcement, but you usually have to worry about clients subject to GDPR that are telling you, 'We are not going to work with you if you can't show we can use you without interfering with our client.' That comes up a lot.”

Indeed, Hawes said she had to explain to her company that although it's a B2B business that does not process sensitive data, it is still held to extensive contractual obligations. “Even though we have this business contact data and no sensitive personal data, we still are required by our clients to comply with these huge contract obligations and finish huge questionnaires.”

While Hawes highlighted being on the receiving end on those time-consuming contracts, Madison said creating those contracts also takes consideration and looking at once routine activity through new GDPR lenses.

“In both B2B relationships and your normal vendor services, we are really having to stop and rethink, how do we this without creating contractual agreements that are 30 pages long with standard contractual clauses and full GDPR amendments for the exchange of name and corporate email address for a conference registration,” Madison said. “Those are some of the in-the-weed things that aren't thought about when the [GDPR compliance] project is first rolled out, but as you start to live with GDPR on a day-to-day basis, you start to see those issues raised.”

Adding to the compliance challenge is the upcoming California Consumer Privacy Act (CCPA), panelists said.

“If GDPR didn't get you, the chances are CCPA and or one of the associated other state laws is going to,” Caridad said. “Some of what CCPA requires is different from GDPR, so you can't just take what you did with GDPR and replicate it for CCPA.” Data mapping, while challenging, will be essential for being in compliance with CCPA, GDPR and other state data privacy laws, she added.

While there are stresses in ensuring companies are compliant with the GDPR and CCPA, the regulations' financial penalties, and the prospect of reputational damage, provide in-house counsel leverage to push forward protocols that may have fallen on deaf ears in the C-suite before.

“As difficult as it's been to work through all the GDPR issues, I really do appreciate it for the leverage it's given the privacy office,” Caridad said. “It really has given us the ability to push the privacy issues [and] the privacy program to the next level very quickly—whereas that was always my plan, I don't think I would have gotten there as quickly without the GDPR's tailwind.”