The GDPR: The EU’s ‘Act’ on Personal Data Protection (Chapter 1, Section 1) — Guide to the GDPR

Put very briefly, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal EU L 119, p. 1) – the GDPR – is the new European ‘act’ on personal data protection.

Protecting individuals in the context of the processing of personal data is one of the fundamental rights in the European Union (EU) (Recital 1 GDPR). This is stated in Article 8(1) of the EU Charter of Fundamental Rights (Official Journal EU C 202 of 2016, p. 389) and Article 16(1) of the Treaty on the Functioning of the EU (Official Journal EU C 202 of 2016, p. 47), under which everyone has the right to the protection of personal data concerning him or her.

To execute and guarantee the right to privacy and data protection within the EU, the EU found it necessary to establish a stable, consistent framework for personal data protection and to enforce it in a decisive manner. Until GDPR the main problem with personal data protection was in fact enforcement (forcing compliance).

Officially, the GDPR keeps in place the personal data protection rules applicable up to now in the EU as set in Directive 95/46/EC (so-called Personal Data Protection Directive) and implemented in national legislation by all EU Member States, but is a more detailed version, giving natural persons material and enforcement rights and introducing severe penalties, direct liability of subcontractors (data processors) and obligation to report data breaches.

Despite reassurances given by supervisory authorities, in practice, the GDPR revolutionises data protection not only due to penalties and new obligations of companies and other bodies that process personal data but also due to a complete shift of approach concerning liability and interpretation of law. This is due to the so-called risk-based approach, which is the obligation of everyone to evaluate risk connected with personal data processing and match data compliance and data protection measures to that risk, and also due to introduction of the principle of accountability – the obligation to demonstrate compliance on the part of a person subject to an obligation. One hundred per cent compliance is a myth in relation to any law, but in the first years of application of the GDPR, a data protection compliance will be like the Schrödinger’s Cat mixed with Heisenberg’s uncertainty principle.

Under Article 1 GDPR:

The GDPR is comprehensive. It covers protection of privacy and personal data (of natural persons) in a broad manner and also addresses the issue of free movement of personal data within the EU. According to Recital 14, the GDPR does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. The above is enigmatic, and it is the only reference to ‘personal data of legal persons’. In particular, it is hard to tell straight from the GDPR if an employee’s professional email (john.smith@corporation.eu) is a personal data or personal data of an institution. Treating a professional email as personal data in communication with an institution leads to nonsensical consequences. In each business to business or more widely institution to institution communication we would have to check if an information obligation has been completed. In addition simple communication with non-EU entities would amount to regulated transfer of data. From the other perspective a professional email can be used to reach a particular individual and may contain data on the occupation and employer of an individual. So john.smith@corporation.eu can be used as personal data of an institution or as ‘regular’ personal data. That is why post-GDPR personal data protection is getting close to quantum physics, and we sometimes call GDPR a quantum minefield.

While the GDPR is legislation passed at EU level, it is directly applicable to any organisation that processes personal data as the controller or processor in an EU Member State. In certain cases (when you are addressing EU residents with your offer or monitoring EU residents’ behaviour) you may become subject to the GDPR even if you are not in the EU.

This direct applicability and resulting function of an ‘act’ on personal data protection are features that distinguish the GDPR from Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Official Journal EC L 281, p. 31) (Personal Data Protection Directive). Directive 95/46/EC was intended to harmonise rules on personal data protection within the EU, but in practice, due to considerable differences in the national provisions implementing that directive, the level of personal data protection and approaches to this question varied greatly from Member State to Member State.

As a new, common ‘act’ on data protection, the GDPR is intended to provide a high and uniform level of data protection across the entire EU. Due to being general in nature and effective at a high level, at the same time the GDPR allows extensive freedom of approach, broad scope for interpretation, and development of practice in individual Member States. In reality, it creates immense room for administrative discretion as well as the need for dozens of procedures and formalities, being a perfect example of so-called Brussels law.

As of 25 May 2018, EU businesses and other businesses addressing their offer to EU residents first have to directly consult the GDPR, and not, as was the case up to now, the national legislation of particular EU Member States. Which, in principle, is good news.

Bad news is that the GDPR is not at all specific on how to achieve compliance.

Meanwhile, EU Member States are enacting legislation helping to link GDPR with the local law and adapting local laws to GDPR. The process is still in progress in December 2018. At the same time, European Data Protection Board (EDPB) (formerly Article 29 Working Party) continues to issue more or rather less helpful guidelines on the interpretation of EU data protection rules.

In result, again we are facing a dynamic patchwork of regulations and interpretations, this time however accompanied by a set of new obligations and a perspective of severe administrative fines for non-compliance.

The objective of the GDPR is to construct a new, uniform personal data protection system at EU level, based on three pillars:

Each of these GDPR pillars constitutes rules to be understood and implemented, obligations to be met, processes to be executed, documentation to be drawn up and adopted within an organisation, information technology (IT) functionalities to be implemented, and any other measures enabling an organisation to affirm and demonstrate that it processes personal data in line with the intention of and in compliance with the GDPR. In practice, each pillar presents a separate challenge.

However, the pillars of the GDPR rely on the foundations of accountability and risk-based approach.

The principle of accountability is fundamental to the GDPR. In practice, this means that a business and any other organisation has to be able to account for how they comply with and implement particular GDPR provisions. This is no easy task because the provisions are very general and do not give specific and practical guidelines as to how to understand and apply a particular rule.

This approach is, in fact, a presumption of liability. The cynical and primitive way (still the most effective) to deal with accountability is documenting – designing documentation of compliance, documenting procedures, documenting compliance with procedures.

In theory, the GDPR is built around a so-called risk-based approach. The risk-based approach basically corresponds to what I call the ‘Spiderman rule’, i.e. ‘with great power comes great responsibility’. A data processing entity (controller or processor) should understand and assess the risk of data processing and apply measures corresponding to that risk.

‘Risk’ is repeated seventy-five times in the GDPR. The two main provisions directly concerning ‘risk-based approach principle’ are Article 24(1) GDPR, according to which:

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

and Article 32(1) GDPR, according to which:

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk ….

According to the GDPR you should calculate the risk of processing of personal data and then adopt measures (technical and organisational) appropriate to the risk, which would normally be measures bringing the residual risk to low level (unless, according to Article 36 GDPR, you really wish to contact your supervisory authority to ask what to do with ‘high-risk data processing’).

There is an important difference between Article 24(1) and Article 32(1) GDPR partly quoted above. Article 32 GDPR concerns the risk of data security, i.e. in fact risk of a personal data breach and its adverse consequences to data subjects (persons whose data are affected by a breach). It requires you to adopt technical and organisational measures of data security ‘appropriate’ to that risk.

However, Article 24(1) GDPR goes even further – it requires you (controllers and processors) to ‘implement appropriate […] measures to [first] ensure and [second] be able to demonstrate that processing is performed in accordance with this Regulation’. It means that you should scale your whole personal data protection system (budget, compliance tools, procedures, staffing, technology & security), up to the risk your data processing is causing for persons whose data you process. Moreover, it is up to you to prove that you are compliant appropriately to the risk you are generating (principle of accountability).

What does a ‘risk-based approach’ mean in practice can be easily manifested by quoting the current Head of the EDPB – Mrs Andreas Jelinek. In response to a request for more guidance from the EDPB she said. ‘It’s a question of which side of the table you’re sitting on’, Jelinek answered. ‘As a regulator, we have tasks too. You don’t have to fulfill my tasks, so don’t expect me to fulfill yours.’

In brief, you are processing personal data at your own risk and the supervisory authorities will not tell you the rules until you break them.

Finally, the two principles of accountability and risk-based approach underlying the three pillars of the GDPR (legality, data subjects rights, security) rely themselves on the shell of the Giant Star Turtle named A’Tuin who carries the GDPR across the galaxy. No, there is no turtle in the European data protection law. We are just kidding to check your focus.

In the past, there has not been any act of law in the legislation of EU Member States or EU legal system that imposes such high penalties for failure to comply with such unclear provisions on practically every organisation. It is tempting to say that the GDPR is difficult, intelligent, severe, and incomprehensible, but upon further analysis based on the pillars of privacy, rights of individuals, security, and the fundamental principle of accountability, the general and high-level GDPR is revealed to be simply demanding.

The GDPR is characterised by:

Under Article 5 GDPR, the GDPR should be approached according to the following principles:

In the manner described above, the GDPR formulates the basic personal data protection principles. In subsequent provisions it only gives general guidelines as to how they should be effected. It does not say what is meant by ‘large-scale’ processing, even though it makes certain obligations dependent on this. Even with regard to the issue of security, apart from the examples of vague terms encryption and pseudonymisation, the GDPR does not provide any specific answers as regards to means of secure processing personal data. For this reason, the GDPR requires significant intellectual and organisational effort on the part of controllers and processors in order to analyse these rules that are so general in nature and produce on that basis specific documents, technologies, processes, and measures suited to the organisation in question.

On the one hand the lack of specificity and on the other strict time limits for executing certain processes are the next challenges that the GDPR presents for organisations. Where individuals’ requests (so-called subject access requests) are processed (execution of an individual’s rights) a business has a month to respond to a request from a data subject (e.g., a request for erasure of data or provision of a report on the kind of data the business processes and for what purpose). This time limit can be extended by a maximum of two months, but information that the time limit has been extended and the grounds for this extension have to be provided within one month.

Where reporting breach of data to a supervisory authority is compulsory (this is a new development in relation to the old rules) organisations have to do this within seventy-two hours of learning of the breach.

Specific, measurable time limits for complying with obligations of controllers mean that the processes subject to time limits imposed by law have to be properly and carefully planned in advance. Measurability requires that the appropriate resources be provided and personnel trained and that the appropriate means and procedures are put in place, including cooperation with subcontractors.

The GDPR applies directly throughout the EU. Direct applicability means that in practice, as of 25 May 2018, all controllers or processors face the risk of prosecution. For this reason, the provisions in the GDPR have to be analysed in a detailed way and the GDPR has to be implemented with precision by every business.

Despite most of the provisions in the GDPR being general in nature, it is highly specific with regard to penalties. It introduces an exorbitant upper limit for administrative fines for breach of the GDPR. Fines are set on a case-by-case basis for each business according to a minimum of eighteen criteria. Fines should be ‘effective, proportionate, and dissuasive’ (Article 83(1) GDPR).

Under the GDPR there are two ranges for fines:

Therefore, the GDPR requires a serious approach on the part of an organisation to the issue of personal data protection, which was trivialised in the past due to being unenforceable. The severity and probably the inevitability of penalties, which we will be able to observe as of 25 May 2018, means that this area of activity of businesses cannot be treated lightly and throws an entirely new light on the question of protection of privacy and personal data.

As mentioned, the principle of accountability is fundamental to the GDPR. It creates a practical presumption of guilt (liability). This presumption of guilt requires an organisation to be able to demonstrate, account for, and prove that it complies with personal data protection, while at the same time it does not have a simple checklist of tasks or organisational and technical measures to take or implement. Presumption of responsibility follows from the following provisions in the GDPR:

Under Article 5(2) GDPR:

The controller shall be responsible for, and be able to demonstrate compliance with paragraph 1 (‘accountability’).

Under Article 24 (1) first sentence GDPR:

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.

Under Article 82(3) GDPR:

A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.

To summarise, all of the elements described above mean that the new personal data protection system requires and in fact forces organisations to make a significant effort to adapt their personal data processing procedures to comply with the GDPR. This effort has to be made at multiple levels and comprehensively throughout the organisation, not only with regard to the law and documentation but also with regard to organisational, procedural, awareness, and technological issues.

As a rule, in order to implement the GDPR properly, specialist knowledge is needed of personal data protection law, IT, cybersecurity, and organisation and project management. Hopefully, however, in the next few years, suitable templates will emerge that can be used to ensure GDPR compliance without the need for specialist knowledge in all of these fields.

The GDPR has a typical layout for EU legal acts and comprises the recitals (140 points which take up approximately 35% of the GDPR total contents) and the following chapters:

From the point of view of organisations which have to understand the GDPR and translate it into specific measures feasible in their business enterprise, the GDPR can be divided according to function by grouping the individual issues in logical streams according to subject matter. By this way of thinking, the GDPR is divided into the following streams, in which certain distinct issues can be identified:

basic data processing principles (lawfulness, fairness, transparency, specificity, being up-to-date, processing on a temporary basis, retention, period of storage) (Article 5 GDPR);
consent and notification, other grounds for processing data (Article 6 GDPR);
privacy by default (Article 25(2) GDPR);
privacy by design, i.e., incorporating privacy into plans for changes to activity, in particular technological and organisational changes (Article 25(1) GDPR);
processing of special categories of personal data (Article 9 GDPR) and data relating to criminal convictions and offences (Article 10 GDPR);
processing which does not require identification (Article 11 GDPR);
records of processing activities (Article 30 GDPR);
profiling (Article 13(2).f, Article 14(2).g, Article 22, Article 35 GDPR).

right to be informed that data is collected (Articles 13–14 GDPR);
right of access to data and copies of data (Article 15 GDPR);
right of rectification and to have incomplete data completed (Article 16 GDPR);
right to erasure (‘right to be forgotten’) (Article 17 GDPR);
right to restriction of processing (Article 18 GDPR);
right to data portability (Article 20 GDPR);
right to object to processing (Article 21 GDPR);
right to human intervention in cases of automated processing (Article 22 GDPR), as well as other requirements that give rise to obligations for businesses and other organisations, such as:
- right to have a request processed (ignoring communication prohibited) (Article 12(3) GDPR);
- right to ‘legibility’(Article 12(1) GDPR);
- right to facilitation (e.g., in the form of a handbook, ‘guide to your rights’, bookmark on a website) (Article 12(2) GDPR);
- right to timeliness of action (Article 12(3) GDPR);
- right to be informed of rights (Article 13(2) and 14(2) GDPR);
- right to withdraw consent (Article 7(3) GDPR);
- right of withdrawing being ‘as easy’ as giving consent (Article 7(3) GDPR);
- right to be informed of recipients of rectified/erased/restricted data (Article 19 GDPR);
- right to be notified of a breach likely to result in a high risk to the rights and freedoms of a person (Article 34(1) GDPR);
- right to lodge a complaint and to appeal (Articles 77 and 78 GDPR);
- right to compensation (Article 82 GDPR);
- right to support from a not-for-profit organisation.

security of data as a basic principle of personal data processing (Article 5(1)(f), Recital 39);
assessing the risk of processing data and adopting security measures that are adequate to that risk (Articles 24, 32 GDPR);
designing privacy (privacy by design) and minimisation (privacy by default) (Article 25 GDPR);
data protection impact assessment (DPIA) (Article 35 GDPR);
prior consultation with a supervisory authority if DPIA returns high residual risk of processing (Article 36 GDPR).

detailed regulation of a data processing agreement between a controller and processor (Article 28 GDPR);
processors’ liability;
principles and standards for selecting a processor (Article 28(1) GDPR);
subprocessing – engaging another processor by the main processor (Article 28(2) and (4) GDPR).

understanding and specifying within the organisation what is meant by personal data breach – classification of incidents (Article 4(12) GDPR);
reporting personal data breaches to the supervisory authority within seventy-two hours of becoming aware of the breach (Article 33(1) GDPR);
procedure and management of determining a breach;
reporting to the controller by the processor of personal data breaches (Article 33(2) GDPR);
notifying the data subject of personal data breaches (Article 34 GDPR).

analysis of whether there is an obligation to designate a data protection officer (DPO) in the organisation (Article 37 GDPR);
status of a DPO (Article 38 GDPR);
duties of a DPO (Article 39 GDPR);
scope of responsibility of a DPO.

status, independence, general conditions, competence, tasks, and powers of the supervisory authority (Articles 51–59 GDPR).

rules for data transfers to third countries.

identifying cross-border processing (i.e., in multiple EU Member States) within an organisation;
determining the lead supervisory authority;
determining the main establishment.

option for sectoral codes of conduct relating to processing of personal data (Article 40 GDPR);
monitoring approved codes of conduct (Article 41 GDPR);
certification (Article 42 GDPR);
certification bodies (Article 43 GDPR).

right to lodge a complaint with a supervisory authority (Article 77 GDPR);
right to an effective judicial remedy against a supervisory authority (Article 78 GDPR);
right to an effective judicial remedy against a controller or processor (Article 79 GDPR);
right to compensation (Article 82 GDPR);
imposing administrative fines (Article 83 GDPR);
option for criminal law provisions – derogated to national laws.

#1.1 The GDPR: The New ‘Act’ on Personal Data Protection

#1.2 The Subject Matter and the Objective of the GDPR

#1.2.1 Preliminary Remarks

#1.2.2 Protection of Natural Persons

#1.2.3 Direct Applicability

#1.2.4 What the GDPR Means for Businesses?

#1.3 Three Pillars, Two Foundations, One Turtle

Accountability

Risk-Based Approach

The Giant Turtle Underneath

#1.4 GDPR Requirements

#1.4.1 Generality

#1.4.2 Measurability

#1.4.3 Direct Applicability

#1.4.4 Severity

#1.4.5 Presumption of Guilt

#1.5 How the GDPR Is Divided from a Functional Point of View?

Basic Compliance:

Rights of Individuals:

Security:

Processor:

Managing Operational Incidents and Reporting Breaches:

Data Protection Officer:

Regulator:

Export of Data (To Outside of the EU):

Cross-Border Processing:

Codes of Conduct and Certification:

Penalties and Liability: