GDPR: The Only Thing Clear About Regulation is That it Isn’t Clear

Over the last several months, I’ve been speaking with as many companies as possible about GDPR and the one topic that continuously comes up, is that the regulation is open to interpretation and that the upcoming law is unclear about how to achieve compliance. One must wonder; if this version of Y2K in 2018, is a huge rouse or another way for attorneys to make a boatload of money. For the latter, the lawyers are making money, but not for sinister reasons, they are here to help us interpret a sizeable law and one that is indeed, unclear.

If you haven’t read the General Data Protection Regulation or the Regulation, as it’s referred to, it’s 11 chapters, 99 articles and 173 recitals. And all of them are unclear and in some cases, contradictory.

The law was enacted a couple of years ago, but now the European Union and its Member States are getting serious with countries such as the United States – a country, where the European Union doesn’t believe that we are stringent enough, when processing their citizen’s private data.

The intent of GDPR is to regulate the collection, use, storage, disclosure and processing of personally identifiable information for a natural person. A European citizen, is also known as a natural person or a data subject.

Article 1 states:

  • To respect the fundamental rights and freedoms of the data subject
  • By ensuring a high level of data protection
  • In a framework that is based on control and certainty

Controls and certainty are a large part of the Regulation and if you take away one point from this article, please let it be that you understand that any company that is processing personal data for European Union citizens, must comply to the Regulation.

In the Regulation, there are roles, such as data protection office (DPO), data controller and data processor and terms like, subject access request (SAR), data privacy impact assessment (DPIA), and data processing agreement (DPA).

To make my point, a couple of weeks ago, I gave a presentation to a group of CIOs. At one point, I knew that I had sparked a nerve, when forty-five minutes into the discussion, we were still on slide two. The question that caused so much angst was,” Where does the European citizen need to be located to process personal identifiable information or PII?”

So, I went back to my data protection officer, who happens to be my chief legal counsel and asked the question yet again. Where does the European citizen really need to be and how does a company know whether they need to comply with the Regulation? His answer to me was “it depends.”

Alright, for those of you that are confused, let me provide you with a few examples of how GDPR works and why your company needs to pay attention to this regulation.

In my company, first and foremost, I am the Global CIO & CISO, but I also wear multiple hats in leading teams that support internal activities, where I wear the hat of the data controller and my HR partners are the data processor. Processing HR data for health care benefits, hiring and terminating employees, are all examples of PII. As CIO, I need to make sure that only a set number of individuals have access to the HR data and can process it.

In this example, in my role as a controller, I work closely with the internal teams and with our Chief Legal Counsel or data protection officer (DPO). Together, with the DPO, we make certain that the requirements of the Regulation are being followed, so that we are compliant to the Regulation; in doing so, we are making sure that data is protected and being used appropriately. With the addition of these controls, we are minimizing our risk to be subjected to a fine or charged with damages when we process data regarding our employees. Fines for non-compliance to the Regulation are up to 20 Million Euro or 4% of global revenue, whichever is higher.

In a 2nd example, in my company, from an external facing standpoint, our Engineering team produces data processing products, by creating external facing applications, where data is processed for our customers. In this scenario, our customer acts as the data controller for their customer’s PII and my company is the data processor.

Let me cite one more example, and one that may pertain to your business. This example shows the difference in where services are used and where processing occurs. An EU citizen goes to Disney World in the US. They rent a car with a US only based company and pay cash for the car. No processing of PII has been performed, therefore, GDPR is not applicable here. Then, this same EU citizen, takes the car to a US only gas station and fills up the tank with their EU credit card. The gas station is not worried about GDPR, but the credit card company is, because they have processed PII for an EU citizen, and the credit card company’s processing occurred within an EU member state.

Like any good law, there are always exceptions and GDPR does not apply to organizations with less than 250 employees. There are other exceptions regarding official requests and publicly disclosed information, but we won’t have time to go through all the nuances in this short article. Just know that the Regulation goes into effect on May 25th of this year.

While the Regulation is currently specific to the European Union, it also can pave the way for other countries to follow suit with their own compliance initiative. So, getting prepared now isn’t such a bad idea.

@2018 All Rights Reserved

Sue Bergamo is the CIO & CISO at Episerver, a global digital commerce company. She can be reached at sue.bergamo@episerver.com.

*The content within this article are the sole opinions of the author.


Add Comment

10 Things You Didn’t Know About Lisa Harp
Five Grants Created Specifically to Help Women Start Businesses
How Roseanne Barr Achieved a Net Worth of $80 Million
10 Things You didn’t Know about Fabrizio Freda
The Walmart Credit Card: Is it Worth Getting?
10 Signs You Might Be Addicted to Your Credit Card
Banks are Moving Away from Cryptocurrencies
Five Savvy Ways to Use Personal Finance Software
New Gadget Helps You Talk to Your Computer Without Words
Deliver a Better E-Commerce Customer Experience: Optimize Delivery Data, Analysis and Timing
So Exactly Where are We At With Postal Delivery Drones?
Researchers Have Proven It’s Possible to Mind-Control Living Beings Using Optogenetics
The Top Five Malaysian Island Destinations in 2018
10 Reasons You Should Visit The Berkshires in Summer
Why You Should Check Out York County Spirits Trail in Pennsylvania
The Top Ten Reasons to Visit Provincetown, MA
Trans Am Worldwide Builds a 1,100 HP Firebird Drag Car
Is The V-12-Powered Mercedes-AMG SL65 Being Phased Out?
A Closer Look at the Strange Ferrari 328 GTS-Based Conciso
A Closer Look at the 2019 Cadillac XT4
A Closer Look at The Chopard L.U.C. Quattro
A Closer Look at the 2018 Santos De Cartier Skeleton
A Closer Look at the Hublot Big Bang MP-11 3D Carbon
A Closer Look at the Berguet Marine Chronograph 5527