ADVERTISEMENT FEATURE
HOW WILL THE GENERAL DATA PROTECTION REGULATIONS (GDPR) AFFECT ME? If your business processes or handles personal data then you have probably heard of the GDPR, the upcoming change in data protection regulations. You may have heard scare stories about potential fines running to millions of pounds, but you may not be sure about how the change will affect you, says Janet Lane, Associate Solicitor at Fraser Dawbarns LLP.
T
he first thing that you should know is that the GDPR is already law and has been since 25 May 2016 but enforcement doesn’t begin until 25 May 2018. You should also be aware that the large fines are real, breaching the GDPR can bring fines up to £17,600,000 or 4% of global turnover, whichever is higher.
What are the main changes?
Some of the changes under the GDPR are more significant than others, but the biggest changes are that individuals’ rights and transparency requirements have been significantly expanded. You should be aware of the following points, but understand that this is not an exhaustive list. The regulation document is 11 chapters long, spread over 88 pages and is therefore not easily digestible into a short article.
and Data Subjects must also be able to request and receive their data in a ‘structured, commonly used and machine readable format’ free of charge. Privacy policies have to be in plain English, as short as possible, and will need to lay out the subject’s rights, why the data is being collected and how long it will be held for. A firm will need to have a reason for collecting and holding data, being transparent about the data they hold is not sufficient. If a data breach occurs, controllers will be required to report this to the supervisory authority within 72 hours and to notify the Data Subject without undue delay.
Will Brexit affect the GDPR?
Unlikely, the UK government intends to bring our post- Brexit privacy laws in line with the GDPR and any company that processes the data of EU citizens will still be bound by it even after we leave.
People whose data is being collected (Data Subjects) will have to actively and unambiguously agree to have their data collected and shared. Those who hold Is this very different to the Data or process the data (Data Controllers) can no longer Protection Act? assume consent if someone hasn’t requested that Yes and no, many of the areas covered by the their data not be shared and consent must be as GDPR are covered by the DPA but transparency easy to withdraw as to give. requirements are more stringent and the rights of Data Subjects have been increased. Transparency is important, people handling data Companies outside the EU who hold data on EU must be able to show that consent has been given citizens also have to conform to the GDPR. 46
How do I make sure that I am compliant?
Companies and individuals processing data must take ‘reasonable steps’ to conform to the GDPR. Breaches of the new rules will be treated more leniently if the Data Controller can show that they have tried to implement these regulations. Fraser Dawbarns strongly recommend that anyone responsible for processing other people’s data consults a Solicitor or GDPR specialist for help with compliance, leaving sufficient time to achieve this before May 25. This article aims to supply general information, but it is not intended to constitute advice. Every effort is made to ensure that the law referred to is correct at the date of publication and to avoid any statement which may mislead. However, no duty of care is assumed to any person and no liability is accepted for any omission or inaccuracy. Always seek our specific advice. Fraser Dawbarns LLP are always happy to provide such advice.
Fraser Dawbarns 21 Tuesday Market Place, Kings Lynn, PE30 1JW 01553 666600; info@frase rdawbarns.com or visit www.fraserdawbar ns.com