CHALLENGES FOR BUSINESSES IN IMPLEMENTING THE REQUIREMENTS OF THE EUROPEAN LEGAL FRAMEWORK, APPLICABLE AFTER 25 MAY 2018

The development of information technologies and international trade in recent decades has created the need to update the existing personal data protection measures.
With the entry into force, in May 2016, of Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (GDPR) – on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, a unified legal framework has been established to harmonize the legislation protecting the personal data of natural persons in the European Union.
The Regulation (GDPR) has been applicable since 25 May 2018. Its objective is to facilitate the free flow of personal data within and beyond the EU in connection with international trade and cooperation, while ensuring effective mechanisms to protect individuals’ privacy when automated or other means of processing are used.
After this date, the rights of data subjects and the obligations of data controllers and processors must be taken into account already at the planning stage of any activity that falls within the scope of the GDPR.
The changes introduced by the Regulation lead to significant modifications in regulatory policies and their implementation mechanisms.
 
Main changes introduced by the GDPR and their impact on businesses
🔹Territorial scope
The GDPR applies extraterritorially – to controllers and processors established outside the Union, where the processing is related to the offering of goods or services to data subjects in the Union, or to the monitoring of their behaviour insofar as it takes place within the Union.
 
🔹Consent for the processing of personal data
The Regulation sets out detailed requirements for valid consent. It must be:

• freely given, specific, informed and unambiguous;
• presented in clear and plain language, avoiding legal jargon;
• distinct from other statements or matters;
• related to the specified purposes of processing.

Controllers must ensure that withdrawal of consent is as easy as its provision.
 
🔹Consent of children in relation to online services
The processing of personal data of a child is lawful only if the child is at least 16 years old.
For children under that age, processing is lawful only if consent is given or authorised by the holder of parental responsibility.
Member States may provide for a lower age, but not below 13 years.
 
🔹Rights of data subjects
The GDPR grants data subjects a number of rights, including the right to obtain confirmation regarding:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients;
• the retention period or the criteria used to determine it;
• the right to object to processing;
• the existence of automated decision-making, including profiling;
• the right to rectification, erasure (“right to be forgotten”) or restriction of processing;
• the right to lodge a complaint with a supervisory authority;
• the source of the data, where not obtained directly from the data subject;
• the right to receive a copy of the personal data in a structured, commonly used and machine-readable format.

 
🔹Right to erasure (“Right to be forgotten”)
Under Article 17 GDPR, the data subject has the right to request the erasure of personal data and the cessation of further processing where:

• the data are no longer necessary for the purposes for which they were collected;
• the data subject has withdrawn consent;
• the processing is unlawful;
• erasure is required for compliance with a legal obligation under Union or Member State law; or
• the data subject has objected to processing under Article 21.

When assessing such requests, controllers must take into account the public interest in retaining the data.
 
🔹Data portability
The GDPR introduces the right to data portability, allowing the data subject to receive personal data concerning him or her in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the original controller.
 
🔹Notification of personal data breaches
Controllers must notify the competent supervisory authority (in Bulgaria – the Commission for Personal Data Protection) without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach.
Processors must notify the controller without undue delay after becoming aware of a breach.
 
🔹Administrative fines and sanctions
Administrative fines are determined on a case-by-case basis and may amount to up to EUR 20,000,000 or up to 4% of the total worldwide annual turnover for the preceding financial year, whichever is higher.
Fines must be effective, proportionate and dissuasive.
The Regulation also enables collective actions (group claims) by data subjects against infringing organisations, potentially leading to financial losses and reputational damage.
 
🔹Security of processing
The confidentiality and integrity of personal data are central to information security management.
From 25 May 2018, controllers and processors are legally required to implement technical and organisational measures appropriate to the level of risk to the rights and freedoms of natural persons. Such measures may include:

• pseudonymisation and encryption of personal data;
• ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to restore availability and access to personal data in a timely manner in the event of an incident;
• regular testing and evaluation of the effectiveness of measures for ensuring the security of processing.

ISO/IEC 27001 is not a requirement under the GDPR but may support compliance with its security obligations.
 
🔹Data Protection Officer (DPO)
Controllers and processors must designate a Data Protection Officer (DPO) where:

• the processing is carried out by a public authority or body;
• the core activities consist of regular and systematic monitoring of data subjects on a large scale;
• the processing involves large-scale processing of special categories of data (Article 9) or data relating to criminal convictions and offences (Article 10).

A group of undertakings may appoint a single DPO, provided that the officer is easily accessible from each establishment.
 
🔹Cooperation and consistency mechanism
The GDPR establishes mechanisms for cooperation and consistency between the European Data Protection Board (EDPB) and the national supervisory authorities of the Member States, including for notification and coordination in the event of personal data breaches.
 
🔹Demonstrating compliance with the GDPR
Controllers and processors may demonstrate compliance through approved codes of conduct or certification mechanisms, thereby enhancing trust in their services and providing appropriate safeguards for international data transfers between public authorities or bodies based on international agreements or administrative arrangements.
 
🔹Expected impact and limitations
The harmonisation of EU legislation on the protection and security of personal data flows is expected to enhance trust and deliver economic benefits.
At the same time, certain limitations apply – access by controllers and processors must be restricted solely to personal data necessary for the performance of their specific tasks.
Any breach of this principle constitutes a security incident, even if no personal data have been leaked outside the organisation.

Further details on GDPR implementation and consultancy stages can be found HERE.

Sources: http://www.europarl.europa.eu; http://www.eugdpr.org