It’s time to wake up and figure out how GDPR affects you!

by Eddie Block in Legal, Technology. Posted September 23, 2017

As I’ve spoken with people (security people and “civilians”), I’ve found many who had no idea that the GDPR was a thing. I know Americans tend to have a very US-centric view of the world, but the GDPR is critical for any business with a presence, customers, or clients in or from the EU.

The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC with an effective date of 25 May 2018 (so about [half] a year to get ready).

The GDPR clearly expresses the central difference between the views of American and EU. The GDPR “[p]rotects [the] fundamental rights and freedoms of natural persons and in particular their right to protection of personal data.”

In the US, personal data is typically seen as the property of the holder of the data. The EU expressly views personal data as the property of the person. This difference makes the GDPR distinct from US data breach notification laws.

There are a number of key items to review in the GDPR:

Increases extra-territorial applicability
Conditions for consent strengthened
Privacy policies may “no longer be able to use long illegible terms and conditions full of legalese . . . the request for consent must be given in an intelligible and easily accessible form. . .”
Breach notification must be made within 72 hours
The GDPR guarantees the Data Subjects’ Right to Access. The Data Subject may:

“Obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. . .
Further, the controller shall provide a copy of the personal data, free of charge, in an electronic format.”“Data Subjects have the right to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.”So, get ready folks. You don’t have much time to explore and internalize the GDPR.
Non EU companies that do business in the EU or have customers that are citizens of the EU or live in the EU will have to comply with these regulations for their EU data subject. Any non-compliant organizations will face heavy fines.
The GDPR also formalizes the “Right to be Forgotten”

“Data Subjects have the right to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.”

Non EU companies that do business in the EU or have customers that are citizens of the EU or live in the EU will have to comply with these regulations for their EU data subject. Any non-compliant organizations will face heavy fines.

So, get ready folks. You don’t have much time to explore and internalize the GDPR.

Eddie Block

http://www.gardere.com/Professionals/Edward-H-Block

Edward (Eddie) Block has over 20 years of experience as an information security professional, primarily focused on the effects of new technology and emerging law on personal privacy at the state, federal and international level. Eddie holds both the Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional/Government (CIPP/G) certifications. Eddie has performed hundreds of penetration tests and is a Certified Information Systems Auditor (CISA) and Certified Ethical Hacker (CEH). He has managed technical teams performing all aspects of information security, including credentialing functions, firewall and IDS/IPS deployment and monitoring, as well as incident response. Eddie, a Certified Information Systems Security Professional (CISSP), has also developed information security policies, standards and guidelines that balance protection of information assets with legal and functional requirements. In his role as Chief Information Security Officer (CISO) and cybersecurity coordinator for the state of Texas, Eddie modernized Texas’ information security rules (1 TAC § 202), developed statewide security controls and worked with the Texas legislature to implement strong information security standards in law. As a former CISO for a large and diverse enterprise, Eddie understands the challenges that organizations face as they address emerging cybersecurity threats. Using a risk-based approach to security planning, Eddie is able to develop strong protections that provide defense-in-depth and are aligned with business needs. As an attorney, Eddie uses his technical and practical security knowledge to ensure clients understand and are in compliance with state, federal and international regulations. He also counsels clients to ensure they are prepared in the event of a security breach and provides guidance on their cyber insurance needs.

It’s time to wake up and figure out how GDPR affects you!