GDPR Compliance: Everything You Need to Know About the EU GDPR

Everything you need to know about the General Data Protection Regulation (EU) 2016/679 commonly known as GDPR plus GDPR compliance!

Warning. There’s a new four-letter acronym in town. No, it’s not a swear word. Until recently, no-one had heard of it, but now everyone is talking about it. And it’s getting people really worked up. 

GDPR. Or more correctly, EU GDPR.

It’s a new privacy law from Europe that potentially affects everyone from beginning bloggers to big businesses and promises heavy fines for those who don’t comply.

This is what I mean.

If you’re a blogger or other online business person.

If you have an email list.

If you collect, process or hold any other personal data for people on your list or members of your tribe. And if anybody on your list is a citizen of the European Union (EU), then the GDPR (EU GDPR) applies to you. And a breach of the EU GDPR can close your business and bankrupt you!

More about that in a moment.

But first, some more information about the EU GDPR.

What’s the EU GDPR?

The General Data Protection Regulation (EU) 2016/679 is a regulation under EU law on data protection and privacy for all individuals within the European Union. It was adopted on April 14 2016, and after a two-year transition period, becomes enforceable on May 25, 2018. The EU GDPR replaces the 1995 Data Protection Directive. Because the EU GDPR is a regulation, not a directive, it does not require national governments to pass any enabling legislation and is directly binding and applicable. 

The EU GDPR aims primarily to give control to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. It also addresses the export of personal data outside the EU.

When does the EU GDPR apply?

The EU GDPR applies if the data controller (an organisation that collects data from EU residents), or processor (an organisation that processes data on behalf of a data controller like cloud service providers), or the data subject (person) is based in the EU.

Under certain circumstances, the regulation also applies to organisations based outside the EU if they collect or process personal data of individuals located inside the EU. See for instance, Article 3(2) which provides as follows:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

According to the European Commission, “personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address.”

Who does the EU GDPR apply to?

• The EU GDPR applies to ‘controllers’ and ‘processors’.
• A controller determines the purposes and means of processing personal data.
• A processor is responsible for processing personal data on behalf of a controller.
• If you are a processor, the EU GDPR places specific legal obligations on you; for example, you are required to maintain records of personal data and processing activities. You will have legal liability if you are responsible for a breach.
• However, if you are a controller, you are not relieved of your obligations where a processor is involved – the EU GDPR places further obligations on you to ensure your contracts with processors comply with the EU GDPR.
• The EU GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.
• The EU GDPR does not apply to certain activities including processing covered by the Law Enforcement Directive, processing for national security purposes and processing carried out by individuals purely for personal/household activities.

What information does the EU GDPR apply to?

Personal data

The EU GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

The EU GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data. Personal data that has been pseudonymised – eg key-coded – can fall within the scope of the EU GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.

Sensitive personal data

The EU GDPR refers to sensitive personal data as “special categories of personal data”. This is provided for under Article 9. The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual. Personal data relating to criminal convictions and offences are not included, but similar extra safeguards apply to its processing under Article 10.

Main responsibilities of Organisations

Under the EU GDPR, the data protection principles set out the main responsibilities for organisations. Article 5 of the EU GDPR requires that personal data shall be:

a) processed lawfully, fairly and in a transparent manner in relation to individuals;

b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the EU GDPR in order to safeguard the rights and freedoms of individuals; and

f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Article 5(2) requires that:

“the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”

The Rights of Individuals

The EU GDPR provides the following rights for individuals:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

Lawful basis for processing Data Under the EU GDPR

Under the EU GDPR, you must have a valid lawful basis in order to process personal data. There are six available lawful bases for processing.

• Consent
• Contract
• Legal obligation
• Vital interests
• Public task
• Legitimate interests

It is important to note the following salient points:

• No single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual.
• Most lawful bases require that processing is ‘necessary’. If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis.
• You must determine your lawful basis before you begin processing, and you should document it. Take care to get it right first time – you should not swap to a different lawful basis at a later date without good reason.
• Your privacy notice should include your lawful basis for processing as well as the purposes of the processing.
• If your purposes change, you may be able to continue processing under the original lawful basis if your new purpose is compatible with your initial purpose (unless your original lawful basis was consent).
• If you are processing special category data you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.
• If you are processing criminal conviction data or data about offences you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.

Consent Under the EU GDPR at a Glance

For most on-line business owners including bloggers, coaches, authors, copywriters, on-line marketers and social media practitioners, consent will be the most applicable lawful basis for holding personal data. Because of that, I intend to zero in on consent in this blog post.

The EU GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis.

• Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation.
• Check your consent practices and your existing consents. Refresh your consents if they don’t meet the GDPR standard.
• Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.
• Explicit consent requires a very clear and specific statement of consent.
• Keep your consent requests separate from other terms and conditions.
• Be specific and ‘granular’ so that you get separate consent for separate things. Vague or blanket consent is not enough.
• Be clear and concise.
• Name any third party controllers who will rely on the consent.
• Make it easy for people to withdraw consent and tell them how.
• Keep evidence of consent – who, when, how, and what you told people.
• Keep consent under review, and refresh it if anything changes.
• Avoid making consent to processing a precondition of a service.
• Public authorities and employers will need to take extra care to show that consent is freely given, and should avoid over-reliance on consent.

EU GDPR Consent Checklist

Asking for consent

Recording consent

Managing consent