Technology Law | Law Offices of Steven J. O'Neill

The Top 10 Things to Know About GDPR

10. What is it?

GDPR (European Union General Data Protection Regulation) is a comprehensive new law protecting the data privacy of EU citizens. Enforcement begins on May 25, 2018. It consists of 99 articles and will have sweeping impact on U.S. enterprises. It requires that all personal data be handled according to the GDPR Data Protection Principles. These includes the famous right to be forgotten, as well as transparency, data portability, and information security. It incorporates the concept of “privacy by design.”

9. Who does it protect?

The GDPR protects “personal data” of EU citizens. So, if you are only doing business outside the European Union then you don’t have to consider it at all, right? Think again. What about any business with a website? What about an app or game?

The upshot of a new privacy and data security regulation of this scope and breadth is that non-EU companies must either comply or forego the market. Outside of the EU this regulation will impact call centers, sales management, advertising and promotion campaigns, marketing and customer relationship management, data processing including cloud computing, SaaS, IaaS, R&D, information security management, and information governance (IG).

8. What data does it protect?

The GDPR defines personal data as “any information relating to a data subject.” (Article 4(1)). A data subject is not only a person who is actually identified by the data but is also a person who is identifiable. A person is identifiable if he or she “can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, economic, cultural or social identity” of that person. (Article 4(1)).

Personal Data is broadly protected including details about a person’s family, lifestyle, medical condition, genetics, education, training, employment, finances, contracts, IP addresses, cookie identifiers, RFID tags, website use, search history, and any other data that would be commonly understood as being personal.

Without special protections, GDPR prohibits the processing of personal data that reveals: race, ethnicity, politics, religion, philosophy, trade union membership, genetic data, biometric ID data, health data, sex life, and sexual orientation. Processing of this data is governed by strict limiting provisions in Article 9(2).

7. When does Personal Data require protection?

According to a Working Group (W29) analyzing the impact of the GDPR, personal data that must be protected must implicate at least one of three elements:

Content: Information that is about a particular person regardless of the purpose of the data or the potential impact of the data on that person is covered.
Purpose: When data is or can be used in a way that can impact or influence the behavior of an individual, it is covered.
Result: When the use of data is likely to have an impact on a person’s rights and interests. For example, a gig-economy phone app tracks a person’s location ostensibly to provide better service and allow the app’s developers to improve the software. The app hypothetically contains evidence of: speeding, visiting marijuana dispensaries, and engaging in political demonstrations, perhaps resulting in termination of employment. Under the result element, it is covered.

6. Data Controllers vs. Processors

Under the GDPR, controllers of data have more obligations than processors of data. However, processing of data is very broadly defined as carrying out any operation or set of operations on the data, including:

Collection	Recording	Organization
Structuring	Storage	Adaptation or Alteration
Retrieval	Consultation	Use
Restriction (marking as subset)	Erasure	Destruction
Disclosure by transmission	Dissemination	Alignment or combination

Obviously, almost any conceivable processing or storage of data is covered. Controllers have the auditable obligation to ensure that all their processors and sub-processors follow the GDPR Principles.

5. What are the GDPR Data Protection Principles?

Both data controllers and data processors must comply with the GDPR Article 5 principles when processing personal data. Article 5 includes the following data protection principles:

Lawfulness, fairness and transparency. (Article 5(1)(a)). Transparency reflects the notion that EU citizens have rights to knowledge of their personal data and a meaningful understanding of its impact upon them. The requirements for lawful processing are in Article 6.
Purpose limitation. (Article 5(1)(b)). Personal data can be collected for specified, explicit, and legitimate purposes only. It cannot be processed in any way that is inconsistent with those purposes or enlarges those purposes. Think about the EU equivalent of Cambridge Analytica’s harvesting of Facebook user data or just banner website ads.
Data minimization. (Article 5(1)(c)). Similar in concept to Massachusetts’ and other jurisdictions’ mandate that the amount of data collected be kept to a necessary minimum, the GDPR requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. It is not appropriate for data controllers to collect information just in case a future need might arise. (Think server logs.)
Accuracy. (Article 5(1)(d). Not only must personal data which is collected and processed be accurate but it must be kept up to date. If inaccurate for its purposes, it must be rectified or erased without delay.
Storage limitation. (Article 5(1)(e)). Personal data must not be kept in a form in which data subjects can be identified from the data for longer than is necessary to accomplish the purpose. Longer periods are allowed for archiving purposes in the public interest or for purposes of scientific, historical or statistical research. These longer-term purposes are subject to data security safeguards, including anonymization.
Integrity and confidentiality. (Article 5(1)(f)). Technical and organizational security safeguards are required to ensure protection against unauthorized/unlawful processing and against accidental loss, destruction, and damage.
Accountability. (Article 5(2)) The data controller is responsible for and must document compliance with the data protection principles. This principle is critical because it requires data controllers to enforce and audit the effective application of the other principles with all data processors. Non-EU companies must analyze whether they “touch” a sufficient quantity of EU personal data records such that the GDPR is triggered. This could occur in a wide variety of examples such as payroll service, call center, medical records service, server hosting company, or app developer.

4. What is lawful processing?

A data controller must be able to justify that the processing of personal data is lawful. Article 6 sets up a regime of legal grounds focused on the basic concept of freely given, informed, opt-in consent. The consent must be for specific purposes, necessary for the contract with the data subject. Article 4(11) defines consent as a “freely given, specific, informed and unambiguous” indication of the data subject’s wishes by a statement or by a clear affirmative action. A statement can be in writing, by electronic means, or oral. Examples of affirmative action include: checking a website dialog box; choosing settings for an online service; and any other clear affirmative act of acceptance. (Recital 32, GDPR).

Unlike many current opt-out practices, under the GDPR consent is not implied by silence, pre-selected dialog boxes or the burying of the consent inside the legalese of a Terms of Service statement. Also unlike current practices, the GDPR requires that data subjects have the right to withdraw consent at any time – consent must be as easy to withdraw as to give.

3. What are data subjects’ rights?

The GDPR gives data subjects the right to obtain from a data controller access to his or her personal data. Also, the data controller must disclose:

The specific purposes of the processing of the data
The categories of personal data involved
The recipients or type of recipient of the personal data, especially recipients in third countries or international organizations
Period of anticipated storage of data
A statement of the right to request correction of, restriction on the processing of, or the erasure of the data – this is the “right to be forgotten” in Article 17
The statement of the right to file complaints about the processing with the appropriate authorities
Source information on the personal data that was not collected from the data subject
Information about automated decision making, including profiling, together with meaningful information about the logic involved and the possible consequences to the data subject of such profiling
If the data controller or processor transfers personal data to a third country or international organization, they must inform the person of the safeguards put in place – this impacts the right to data portability in Article 20
The controller must provide a copy of the personal data undergoing processing free of charge – generally in format that is readable without specialized software tools

Breach Notification. Another key provision of the GDPR is a mandate that information breaches be reported to authorities and to data subjects within 72 hours. This is a major change in the way security breaches have been handled.

2. What are some other obligations of controllers and processors?

Unlike the prior European Data Protection Directive, the GDPR places significant new burdens on the data processor, as well as requiring effective audit trails by the controller to promote the key principle of accountability.

The controller must have legally binding contracts with data processors imposing the following obligations:

Limit processing only to the documented instructions
Because of concern with third country and international organization transfer, the instructions should clearly define any authorized cloud computing use
Comply with information security obligations imposed on controller in Article 32 of the GDPR
Require that all data processor staff with access to the personal data have a written confidentiality agreement or statutory obligation
Not to assign or subcontract to another sub-processer without the prior written consent of the controller
Assist the controller in carrying out its obligations to the data subjects such as access and the right to be forgotten
Assist the controller with its data security obligations in Articles 32 and 36 of the GDPR

Significant numbers of processors based in the U.S. who handle the personal data of EU citizens have been impacted by this contractual flow-down provision.

1. What are the penalties?

The law has teeth. It authorizes administrative fines on controllers and processers (Article 83) reaching up to 20 million Euros (roughly $24M) or 4% of annual revenue (whichever is higher). It also authorizes a private right of action, which will be fleshed out on a country by country basis as time passes.

Green Light for Defensible Data Remediation

In December 2015, the electronic discovery provisions of the Federal Rules of Civil Procedure (FRCP) were amended to substantially expand the Safe Harbor against sanctions for destruction of electronic data. In my November 2015 white paper, C-Level Guide to Covering Your Information Governance Assets, I predicted that the amended rules signaled a pivot away from one of the main sources of eDiscovery uncertainty – the inconsistent imposition of severe sanctions for the loss of electronically stored information (ESI) relevant to dispute resolution. The prediction holds. The prior Safe Harbor under the 2006 FRCP provided modest protections against sanctions where ESI was lost due to routine and automatic deletion. Because of the inconsistent standards previously applied by courts around the country, organizations fearful of doomsday sanctions would over-preserve. The new discovery rules greatly expand this protection. A cursory review of sanctions cases decided under the new rules in influential U.S. District Courts indicates that the Federal bench is successfully applying the new rules as the Rules Advisory Committee intended – limiting judicial discretion to impose case-killing sanctions to situations where a party intentionally deprives its opponent of documents covered by a “legal hold.” An excerpt from a Northern District of California …

Information Governance Challenges in the Life Sciences, and Financial Services Industries

While many of the high-level principles of Information Governance (IG) and the technologies supporting their implementation are almost universally applicable, each industry sector presents different challenges – one-size solution does not fit all. For example, unregulated privately held technology start-ups that are experiencing rapid growth may not have any retention / destruction policies in place; they will expand their IT storage until they crash into a big event, such as litigation, an IPO, or a merger. At that point they might require a top to bottom reconstruction – akin to an emergency room visit after a car crash. Other organizations already function within the constraints of a regulatory regime such as life sciences or financial services. Especially in publicly traded companies, regulated industries are further along the continuum in almost all of the metrics associated with IG principles such as: existence of a RIM program; adoption of a retention schedule; legal hold procedures; and protection of sensitive information. Unlike the emergency room metaphor above, the relative maturity of IG initiatives in these organizations requires more of a performance coach than an emergency room doctor to improve their well-being. Organizations also differ greatly in the need for dispersal of their information …

Legally Defensible Data Remediation

A document retention policy is in reality a document destruction policy. Therefore, a key reason for an organization to adopt a document retention policy is to establish a program for the deletion/destruction of information that is not required for business, regulatory and other needs. This reality is made necessary by the fact that digital information is growing at an unprecedented rate and that much of it is contained in “unstructured” storage such as email, SharePoint and shared network drives. Data hoarding not only increases direct information technology costs but it presents other substantial risks and costs to an organization ranging from discovery of “smoking gun” documents during investigation, litigation or audit; to reputational damage from information security breaches (hacking). Document retention/destruction policies have long been recognized as a good business practice. Inherent in the practice is the notion that information has a life cycle and that there are valid reasons to protect that information from competitors, thieves, snoops and even government investigators. In the context of an appeal of an obstruction of justice conviction against Arthur Andersen LLP, this practice was blessed by the U.S. Supreme Court. Chief Justice William Rehnquist delivered the opinion of the Court: ‘Document Retention Policies,’ …

Legal Hold 101 – Data Retention and Destruction

Every gambler knows That the secret to survivin’ Is knowin’ what to throw away And knowin’ what to keep ‘Cause every hand’s a winner And every hand’s a loser And the best that you can hope for is to die In your sleep The Gambler lyrics © Sony/ATV Music Publishing LLC Some of the more frequent questions asked of eDiscovery attorneys when teaming with IT professionals on archiving and other retention policy projects, relate to the timing, scope and especially the release of legal holds. Misconceptions about “Legal Hold” abound, many of them (unfortunately) coming from litigation attorneys stuck in the paper document past or those who do not understand data systems architecture. One common source of over-broad Legal Hold retention is the misapprehension of the risk of severe judicial sanctions for the destruction (aka spoliation) of evidence. Too many attorneys take what they consider to be the safe route and continue to advise enterprises to keep too much for too long. As Kenny Rogers’ Grammy award-winning song reminds us, risk can cut both ways. Not only does an overbroad legal hold increase the cost of maintenance and infrastructure, it increases the cost of legal review of held documents, and …

In 2005 the ABA Business Law Section published a short book titled, Sailing in Dangerous Waters: A Director’s Guide to Data Governance. It warned in stark terms: Those Directors who defer or delegate to specialized personnel their understanding and command of data governance will be at increasing risk of incurring personal liability for failing to fulfill their fiduciary duty of care to ensure that their companies comply with rapidly emerging legal requirements concerning deficiencies in data governance.[i] To say that information is an asset to business enterprises is to recognize the obvious. Certain intellectual property such as trade secrets and customer lists are universally considered to be assets and deserving of protection. But, as enterprises have shifted to digital systems where work-flows, communications, collaboration systems, data analytics and other metrics now condition and drive business decisions, the value and integrity of these systems has become ever more fraught with risk. Consider that the Ashley Madison hacking uncovered email correspondence between executives and legal counsel. While Coca Cola might have been able to lock away a few copies of its secret formula in a steel safe a generation ago, today’s information assets, by their nature, must be widely distributed and available …

Information Governance – A Principled Framework

Gartner defines Information Governance as an accountability framework that includes the processes, roles, standards, and metrics that ensure the effective and efficient use of information in enabling an organization to reach its goals. One of the core requirements of a legally defensible Information Governance program is a reasonable and consistently applied records & information management (RIM) system. Accountability and defensibility hinge on the ability of an organization to govern its information in all formats and on all media, and to ensure or prove that it is compliant with all legal requirements. Building an information governance framework is by necessity a …

Cover Your Assets

C-Level Guide to Covering Your Information Assets The management and protection of information assets increasingly represent both the greatest potential value and the greatest risk to the enterprise. Big Data and analytics are now being leveraged by companies well beyond Amazon, Facebook, Uber and Google. Beginning with the Enron scandal and the advent of penalties (civil and criminal) for the improper destruction of electronically stored information (ESI), the existential risk from the disclosure of corporate mistakes or malfeasance through investigation, litigation discovery, or hacking has increased on pace with the explosion of digital data. The reputational damage to Target, Sony, …

Cloud computing presents innumerable opportunities and brings with it enormous security and legal challenges. While there is no single accepted definition of the “cloud,” the National Institute of Standards and Technology created a reference model in 2011. NIST defined cloud computing by describing its five essential characteristics, three service models, and four deployment models. (NIST Special Publication 800-145): Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Essential …