{"id":10419,"date":"2016-07-06T20:38:55","date_gmt":"2016-07-06T20:38:55","guid":{"rendered":"https:\/\/www.consilio.com\/?post_type=avada_portfolio&p=10419&lang=en"},"modified":"2023-08-16T01:10:14","modified_gmt":"2023-08-16T06:10:14","slug":"eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation","status":"publish","type":"avada_portfolio","link":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/","title":{"rendered":"Eye on Discovery – Five Steps to Take Now to Prepare for the General Data Protection Regulation"},"content":{"rendered":"

Eye on Discovery – Five Steps to Take Now to Prepare for the General Data Protection Regulation<\/h1><\/span>
<\/div><\/div><\/div>

Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner<\/a>, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework. Many of these companies are focused purely on the potential replacement for the Safe Harbor\u2014the EU-US Data Privacy Framework<\/a>\u2014instead of looking to the next, much more difficult hurdle on the horizon: the EU General Data Protection Regulation (GDPR)<\/a>. Unlike the EU-US Data Privacy Framework, which governs only data transfers between the EU and U.S., the GDPR addresses a host of issues, imposes harsh sanctions for noncompliance, and it is even stricter than its predecessor, the Data Protection Directive <\/a>(Directive 95\/46\/EC).<\/p>\n

It should be noted that the GDPR is extraterritorial; it applies to all organizations that collect or process personal information pertaining to EU citizens. With less than two years before it goes into effect on May 25, 2018, now is the time for organizations to consider the changes they may need to make to be compliant with the new law, from both a business and an eDiscovery perspective. Here is a brief overview of five aspects of the new law that are most likely to affect U.S. organizations.<\/p>\n

1. Consent<\/strong><\/p>\n

Although consent is still a viable basis for transferring personal data under the GDPR, the new law refines\u2014and restricts\u2014what constitutes consent. Consent must be \u201cfreely given, specific, informed and unambiguous\u201d for each data processing operation, and data subjects can withdraw their consent at any time. Instead of the \u201copt-out\u201d or implicit consent allowed under the Data Protection Directive, the GDPR requires \u201ca statement or a clear affirmative action.\u201d The law makes clear that \u201c[s]ilence, pre-ticked boxes or inactivity\u201d do not constitute adequate forms of consent. Moreover, consent is not considered \u201cfreely given\u201d where there is \u201ca clear imbalance between the data subject and the controller, in particular where the controller is a public authority.\u201d This language also applies to employees, and employee consent to processing of their personal information must be both distinct from an employment contract and demonstrate the employee has a genuine choice regarding the processing of their personal information.<\/p>\n

As under the Data Protection Directive, the GDPR also requires data controllers to obtain \u201cexplicit\u201d consent\u2014a higher level of clear, detailed consent\u2014when they plan to process sensitive personal data. Sensitive data is defined as any information that reveals \u201cracial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person\u2019s sex life or sexual orientation.\u201d<\/p>\n

Interestingly, though the law is designed to harmonize laws among the EU nations, the GDPR sets a standard for the age of consent for minors of 16 years old, but it allows member states to set a lower age between 13 and 16.<\/p>\n

What to do now: Companies should evaluate how they have obtained data subjects\u2019 personal information. Many organizations have relied on opt-out procedures and may need to re-obtain consent to comply with the GDPR\u2019s requirements. Going forward, businesses will need to revisit how they obtain and record consent, as they will have the burden of showing that consent was freely given, specific, and informed.<\/p>\n

2. Data Protection Officers (DPOs)<\/strong><\/p>\n

Many U.S. firms have not yet invested in a privacy professional, but they may need to with the advent of the GDPR. The new law requires organizations to appoint a DPO (either in-house or from a service provider) if they regularly and systematically monitor EU data subjects \u201con a large scale\u201d or if they process significant amounts of sensitive personal data. The DPO will need to have \u201cexpert knowledge of data protection law and practices.\u201d<\/p>\n

What to do now: Businesses should seek legal advice as to whether they will be required to appoint a DPO. If so, they should hire a qualified candidate. Alternatively, the GDPR allows companies to outsource the role to an experienced consultant or legal counsel. A next step is to draft policies and procedures to ensure the DPO is equipped to monitor compliance with the new law.<\/p>\n

3. Cross-Border Transfers of Personal Data<\/strong><\/p>\n

The GDPR export regime largely remains the same as under the Directive. The new law still permits transfers to countries that have been deemed to have an \u201cadequate\u201d level of data protection and to other nations through standard contractual clauses and binding corporate rules. When the GDPR goes into effect, standard contractual clauses will no longer require prior notice to or approval by a data protection authority (DPA). The GDPR also approves two other safeguards that enable transfers: codes of conduct and certification. A code of conduct is a self-regulatory mechanism that demonstrates adherence to information privacy standards, including international data transfers; the code may be drafted by a DPA, member state, European Data Protection Board, the European Commission, or other associations or bodies that represent data controllers or data processors. Certifications, as well as marks and seals, may be developed at the Union level by the European Data Protection Board. These alternate mechanisms for international data transfer may open the door to alternatives to Safe Harbor\/EU-US Data Privacy Framework, as well as allowing for sector-specific adequacy (e.g. a country may be considered adequate for financial information, but not health information).<\/p>\n

What to do now: Businesses should determine what data they have collected about EU residents. Next, they should trace the flow of this data, both inside the company and to third-party data processors, including their law firms and vendors. They should also evaluate their current data transfer mechanisms and ensure they are compliant. Finally, they should evaluate\u2014or develop, if necessary\u2014their procedures for managing queries about the handling of personal data. And keep in mind that transfers of employee data within a corporate group are not exempt for international data transfer rules.<\/p>\n

4. The Right to Be Forgotten<\/strong><\/p>\n

The GDPR affords data subjects a new right: the right to be forgotten. This right allows data subjects to ask companies that have collected their personal data to erase it, and, if the data is public, to require other data controllers to do the same.<\/p>\n

What to do now: Review information flows and determine how difficult it might be to delete a data subject\u2019s information. Some companies disperse personal data among various applications, systems or vendors, and it can be difficult to trace. Affected organizations should take time now to map out their data storage, including data stored in the cloud and sent to third parties such as eDiscovery specialists. They should also create a procedure for searching for, segregating and deleting this information upon request.<\/p>\n

5. The Duty to Supervise Third Parties<\/strong><\/p>\n

The GDPR sets forth new responsibilities that could turn into liability for companies that work with data processors. Data controllers\u2014defined under the GDPR as \u201cthe natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data\u201d\u2014now have an obligation to supervise the activities of their data processors; before, under the Data Protection Directive, supervision was merely recommended.<\/p>\n

What to do now: Review your contracts with any third-party data processors, including legal service providers. Ensure these contracts mirror\u2014and promise adherence to\u2014the requirements of the GDPR and any data transfer mechanisms that you use. Also, be sure to include data privacy and transfer considerations in your vendor selection process.<\/p>\n

What About Brexit?<\/strong><\/p>\n

The UK\u2019s referendum in favor of leaving the EU has raised questions as to the effects on data privacy. Following the vote, a representative from the British Information Commissioner\u2019s Office stated that \u201cthe Data Protection Act remains the law of the land irrespective of the referendum result.\u201d He went on to say that the UK would need to adopt adequate privacy controls to meet GDPR standards to maintain equal trade practices with the EU. As the UK was one of the key architects of the GDPR, it is likely that it would adopt most of the provisions.<\/p>\n

However, there will likely be some changes in the form of data transfer agreements, both between Britain and the EU and between Britain and the U.S. Much like Switzerland, the UK will likely adopt a framework similar to Safe Harbor or EU-US Data Privacy Framework to support transfers of personal information to the U.S. To simplify compliance and avoid cross-border transfers, some companies may also opt to use data centers in the EU instead of in the UK.<\/p>\n

What to do now: Companies should identify the personal information collected and stored in the UK, both for UK citizens and the citizens of other EU nations. Understanding which country personal information comes from will be a critical step toward compliance as the ramifications of Brexit unfold.<\/p>\n

Summary<\/strong><\/p>\n

Given the GDPR\u2019s breadth, it is imperative for organizations, regardless of where they are located, to take stock of their data flows and data transfer protocols as the foundations for a sustainable, compliant data protection program. Those who hesitate to take steps now toward compliance could well find themselves record penalties of up to 4 percent of annual global turnover or 20 million euros, whichever is higher.<\/p>\n<\/div>

<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":11,"featured_media":0,"menu_order":0,"template":"","format":"standard","meta":{"footnotes":""},"portfolio_category":[1006,546,141,379,134],"portfolio_skills":[236],"portfolio_tags":[1107],"yoast_head":"\nEye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation - Consilio.com<\/title>\n<meta name=\"description\" content=\"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Eye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation\" \/>\n<meta property=\"og:description\" content=\"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/\" \/>\n<meta property=\"og:site_name\" content=\"Consilio.com\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-16T06:10:14+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/\",\"url\":\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/\",\"name\":\"Eye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation - Consilio.com\",\"isPartOf\":{\"@id\":\"https:\/\/www.consilio.com\/#website\"},\"datePublished\":\"2016-07-06T20:38:55+00:00\",\"dateModified\":\"2023-08-16T06:10:14+00:00\",\"description\":\"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.consilio.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Portfolio\",\"item\":\"https:\/\/www.consilio.com\/resource\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Eye on Discovery – Five Steps to Take Now to Prepare for the General Data Protection Regulation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.consilio.com\/#website\",\"url\":\"https:\/\/www.consilio.com\/\",\"name\":\"Consilio.com\",\"description\":\"International eDiscovery and Managed Review Provider\",\"publisher\":{\"@id\":\"https:\/\/www.consilio.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.consilio.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.consilio.com\/#organization\",\"name\":\"Consilio\",\"url\":\"https:\/\/www.consilio.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.consilio.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png\",\"contentUrl\":\"https:\/\/www.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png\",\"width\":153,\"height\":51,\"caption\":\"Consilio\"},\"image\":{\"@id\":\"https:\/\/www.consilio.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Eye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation - Consilio.com","description":"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/","og_locale":"en_US","og_type":"article","og_title":"Eye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation","og_description":"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.","og_url":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/","og_site_name":"Consilio.com","article_modified_time":"2023-08-16T06:10:14+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/","url":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/","name":"Eye on Discovery - Five Steps to Take Now to Prepare for the General Data Protection Regulation - Consilio.com","isPartOf":{"@id":"https:\/\/www.consilio.com\/#website"},"datePublished":"2016-07-06T20:38:55+00:00","dateModified":"2023-08-16T06:10:14+00:00","description":"Once the European Court of Justice issued its decision in Schrems v. Data Protection Commissioner, businesses began scrambling to figure out how to cope with the vacuum created by the demise of the U.S.-EU Safe Harbor Framework.","breadcrumb":{"@id":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.consilio.com\/resource\/eye-discovery-five-steps-take-now-prepare-general-data-protection-regulation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.consilio.com\/"},{"@type":"ListItem","position":2,"name":"Portfolio","item":"https:\/\/www.consilio.com\/resource\/"},{"@type":"ListItem","position":3,"name":"Eye on Discovery – Five Steps to Take Now to Prepare for the General Data Protection Regulation"}]},{"@type":"WebSite","@id":"https:\/\/www.consilio.com\/#website","url":"https:\/\/www.consilio.com\/","name":"Consilio.com","description":"International eDiscovery and Managed Review Provider","publisher":{"@id":"https:\/\/www.consilio.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.consilio.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.consilio.com\/#organization","name":"Consilio","url":"https:\/\/www.consilio.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.consilio.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png","contentUrl":"https:\/\/www.consilio.com\/wp-content\/uploads\/2020\/10\/ConsilioBlueLogo.png","width":153,"height":51,"caption":"Consilio"},"image":{"@id":"https:\/\/www.consilio.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/avada_portfolio\/10419"}],"collection":[{"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/avada_portfolio"}],"about":[{"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/types\/avada_portfolio"}],"author":[{"embeddable":true,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/users\/11"}],"version-history":[{"count":2,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/avada_portfolio\/10419\/revisions"}],"predecessor-version":[{"id":96052,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/avada_portfolio\/10419\/revisions\/96052"}],"wp:attachment":[{"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/media?parent=10419"}],"wp:term":[{"taxonomy":"portfolio_category","embeddable":true,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/portfolio_category?post=10419"},{"taxonomy":"portfolio_skills","embeddable":true,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/portfolio_skills?post=10419"},{"taxonomy":"portfolio_tags","embeddable":true,"href":"https:\/\/www.consilio.com\/wp-json\/wp\/v2\/portfolio_tags?post=10419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}