On 14 April, the European Parliament passed the General Data Protection Regulation (GDPR). Read the press release. It should enter into force in June/July 2016 and will have impact on all entities that process personal data within the EU (that is EU-based organisations and enitites outside the EU operating in the EU).

Key Changes

The GDPR replaces the current European data protection regime consisting of the 1995 Data Protection Directive and 28 national data protection laws. The GDPR will be directly applicable in every EU Member State, without the necessity of national implementing laws. 

The Regulation contains many key changes, such as:
1. Harmonisation: There will be a single set of rules on data protection, directly applicable in all EU Member States, thereby mitigating the current fragmentation of national data protection laws.

2. Stronger Enforcement: Non-compliance could lead to heavier sanctions. The revised enforcement regime is underpinned by power for regulators to levy financial sanctions of up to 4% of the annual worldwide turnover of the organisation.

3. Off Shore Processing: The GDPR will apply to companies established outside the EU that process data related to the activities of EU organisations. Non-EU companies will also be subject to the Regulation if they target EU residents by profiling, or proposing products or services.

4. Governance: Organisations will have increased responsibility and accountability on how they control and process personal data.

5. Consent: The Regulation requires a more active consent based model to support lawful processing of personal data; wherever consent is required for data to be processed, consent must be explicit, rather than implied.

6. Transparency: Organisations will have increased transparency obligations; privacy notices will need to include much more detailed information.

7. Data Breaches: Organisations will be required to notify the local supervisory authority, and (in some cases) data subjects, of significant data breaches.

8. Data Portability: Organisations must ensure data subjects can easily transfer their data files from one service provider to another.

9. Right To Be Forgotten: The GDPR consecrates the "right to be forgotten", allowing data subjects the right to require a controller to delete data files relating to them if there are no legitimate grounds for retaining it.

10. Data Processors: Organisations processing data on behalf of other companies will be required to comply with a number of specific data protection related obligations. They will be liable to sanctions if they fail to meet these criteria.

11. Data Protection Officer: Companies will have to appoint a Data Protection Officer when they are, for example, processing sensitive data. The DPO will report to the highest management level.

12. One-Stop-Shop: A single national data protection authority will act as the lead regulator for compliance issues in the EU, where the organisation has multiple points of presence across the EU.

13. Privacy Impact Assessment: A PIA will become a mandatory pre-requisite before processing personal data for operations that are likely to present higher privacy risks to data subjects due to the nature or scope of the processing operation.

14. Privacy By Design & Privacy By Default: Companies must take privacy risk into account throughout the process of designing a new product or service, and adopt mechanisms to ensure that, by default, minimal personal data is collected, used and retained. An approved certification mechanism can be used to demonstrate compliance with the applicable requirements.

It should be noted, the 2002 E-Privacy Directive regulating cookies and spam remains in place and is currently under review. Organisations should continue to follow national rules on cookies and spam.

(Source: DLA Piper)