Complete reform of EU data protection law announced. Requirements to harden

RELATED AREAS Intellectual Property United Kingdom European Union   Your Subscription Details

• Big fines: Fines of up to 2% of global annual turnover for companies that fail to comply with EU data protection requirements;
• Requirement to declare security breaches: Organisations to be required to notify national authorities of a serious security breach as soon as possible and within 24 hours if feasible;
• Requirement to appoint data protection officer: Businesses that have 250 or more employees will have to appoint a data protection officer, responsible for monitoring and implementing compliance with data protection requirements within those businesses;
• Businesses outside the EU that serve Europeans must also comply: Businesses that offer goods or services to individuals in the EU or monitor their behaviour will have to comply with EU data protection requirements when doing so irrespective of where those businesses are based in the world. Individuals will be able to refer those businesses to the national data protection authority in the individuals’ home country if they wish to make a complaint or ask for sanctions to be taken against them;
• Consent will not be valid unless explicitly obtained: Where an organisation relies on having obtained consent for the processing of personal data, it will no longer be able to infer or assume from the circumstances that consent has been obtained by the individuals concerned, it will have to demonstrate that those individuals have given their explicit consent to the processing;
• Right to move data: Individuals will have the right to ask businesses to move their records to alternative service providers; and
• Right to be forgotten: Individuals will be able to ask organisations to delete all data that those organisations hold on them unless there is a legitimate reason for those organisations to retain it.