BY EDWARD McINTYRE
ETHICS
E
It’s a Small, Small World GDPR — not just for EU lawyers
M
acbeth and Duncan were returning from court when Clyde Tabbit caught up with them.
“Macbeth, got a question. Got a minute?” “Here’s our building. Let’s go up to the office.” “Really shouldn’t take long. Just a quick ‘yes’ or ‘no’ —” “You never know, Clyde. Come, join us.” When the trio were seated in Macbeth’s conference room, Sara joined them. “Now we’re all here. OK, Clyde, what’s the quick question?” “Well, I keep getting strange requests from a couple of clients.” “Proceed.” “So, I represent a guy who moved to Italy years ago. Permanently. But still has a business here. As well as in Italy and other places.”
CARTOON BY GEORGE BREWSTER JR.
“We get the picture. What’s the issue?”
“Well, he keeps making these flaky demands on me to identify all the information I’m ‘storing’ — Clyde used air quotes — on him. On his companies. Getting more and more insistent. I’ve blown him off. But he won’t stop.” “Let me see if I understand. He resides in Italy. A citizen there?” “Yep, dual. Some family connection.” “You provide legal services to him?” “Of course. He’s my client. Both him and his businesses. There and here. Why?” “Have you noticed all the ‘privacy updates’ you’ve been getting recently? From social media sites and other internet providers?”
“GDPR?” Macbeth nodded to Sara. “The General Data Protection Regulation. Enacted in 2016, but effective May 25, 2018. The GDPR’s purpose is to provide a uniform law governing the protection of personal data across the European Economic Area. That’s the EU plus three other European countries. It replaces the individual national laws passed under the 1995 Data Protection Directive. The GDPR is intended, among other things, to clarify, strengthen and modernize data protection. Especially in light of the changes in how companies collect and process personal information.” “So what. I’m not in Europe.”
“Come to think of it, yeah. Keep getting one from CNN about terms of service and privacy and stuff. Annoying. Even from some law firms. Can’t figure why.”
“You provide services to a European citizen, living there. Some of the services related to his businesses there. Does he pay you in euros or dollars?”
“Likely GDPR compliance. I suspect that’s what’s triggered your Italian client’s requests.”
“Euros. Conversion costs me money every time. But I’m here, not there.” Sara continued. “The GDPR applies to any organization collecting or processing anyone’s personal information. Think ‘personal data.’ If that collection or processing is done in relation to activities of the organization established in the EU. No matter where the collection or processing takes place.” “See, I’m not an ‘organization established in the EU’ — more air quotes. Doesn’t apply.” “I understand your point. But if a U.S. firm offers services to EU residents, then the firm is subject to the GDPR. It’s a fact-based analysis whether a company is offering services to EU residents, but services payable in euros likely would be.” “Ouch. Does that include my clients in France and Sweden, as well?” “France is part of the EU; Sweden, joined the EEA. So, yes.” “What does all this mean?” September/October 2018 SAN DIEGO LAWYER 13