On May 25, 2018, the EU General Data Protection Regulation (GDPR) came into force. For approximately five years, EU bodies worked on this cross-European data protection reform. Until May 25, the 1995 Data Protection Directive (Directive 95/46/EC) was still in force, but the technological changes of recent decades made it necessary to revise data protection legislation; after all, the Internet was still in its infancy in 1995. These days, EU-wide data protection has to deal with big data, industry 4.0, robotics, and artificialintelligence, meaning that there was an urgent need for a new regulation. May 2018 saw the launch of these measures.
Above all, the GDPR serves one purpose: to uniform the regulation of data throughout Europe. This raises at least two questions for companies: Which regulations affect my website? And what steps do companies and website operators have to consider when handling internal and external data? Since the law has come into force, several things have also changed for online trade and employee data protection in companies.
Below, we provide a summary of the uniform legal situation, and provide a GDPR checklist summarizing which measures you need to take in your company.
- GDPR: Not a directive, but a regulation
- Amendments: Opening clauses
- Aims: European uniformity when it comes to data protection
- Content: Developing proven principles
- Who is affected? Businesses and data protection officers
- How the GDPR effects on companies
- How the GDPR effects on website operators
- GDPR checklist for businesses and website operators
- Reactions to the GDPR: Praise and criticism
- Effects of the GDPR on companies and consumers so far
GDPR: Not a directive, but a regulation
When it comes to European bureaucracy, laws can take a long time – even after they have officially come into play. After long debates in parliament in Brussels, the 28 member states will often be granted generous transitional periods to incorporate new EU laws into their national legislation. A lot of time can pass before the pressure of implementation reaches individual companies.
But in addition to directives there is a second type of EU law: regulations. They offer almost no wiggle room when it comes to content and time. They are immediately and uniformly legally binding for all member states – this includes the business practice of every SME. This is also the case with the GDPR: it’s not a directive, but a regulation.
In May 2016, the GDPR came into force with a transitional period of two years – and since 25 May 2018, it has been the official data protection law in all EU states, overriding national legislation. This means no more transition periods, or “buffer” times. All companies and public entities working with personal data must comply with the EU data protection rules and implement appropriate measures in their businesses.
But even today, not all companies seem to be aware of these changes. In September 2020, a Bitkom survey on the GDPR showed that only 20% of 504 surveyed companies with 20 or more employees were fully GDPR-compliant. However, the proportion of companies that have not yet initiated any measures has now fallen sharply (10%).
Two of the biggest hurdles are legal uncertainty and not knowing how much effort it takes to implement the GDPR. Many businesses and companies think that needing to obtain a concrete agreement before exchanging personal data is unnecessarily complicated, and the need to be able to prove this agreement makes it even more so. Even just keeping hold of a business card could have legal complications, when the GDPR is seen in the strictest light.
“People burying their head in the sand will soon be violating the law and risk fines at the expense of their company.” – Susanne Dehmel, Bitkom (2018).
Now, many companies are potentially facing heavy fines. Up to 20 million euros ($23 million, which is 4% of worldwide sales in the last financial year) is the potential fee which may be charged as a punitive measure. And don’t be fooled by the fact that this is “just” an EU law. It can affect your US-based business too – if you collect personal data or information from anyone residing or browsing in an EU country, your company needs to comply with the regulations of the GDPR. Renowned companies like Google have already received fines because they missed out on implementing the changes. British Airways ($230 million) and Marriott ($124 million) have been among the companies that were issued some of the largest fines for violating the GDPR so far. British Airways received a penalty following a data breach whilst Marriott was fined for failing to carry out due diligence after an acquisition.
Amendments: Opening clauses
EU regulations take precedence over national laws and take precedence in the event of contradictions. However, the GDPR contains some opening clauses that allow states to weaken or strengthen certain data protection rules.
For companies, this means that there are no further changes to the regulations. Those who have been following the draft laws in recent years have probably lost track of the details of the legislative changes discussed. No more of that: since the regulation came into effect, the guidelines have been fixed, and it’s essential that you know what the final version of this regulation was before it came into play.
The European General Data Protection Regulation can be found online on the Europa.eu website.
Aims: European uniformity when it comes to data protection
The primary objective of the GDPR is the harmonization of European data protection. Whereas the 1995 Data Protection Directive was implemented differently in each EU country, the regulation offers less scope for action on an individual, national level.
A second primary aspect addressed by the GDPR relates to the serious technological changes which have occurred over the past 25 years – as well as of course the technical developments still to come. That’s because many of the challenges of data protection still lie ahead for us. For example, the collection of biometric data from employees is mandatory for certain work with intelligent machines. If a company is sensitive to such data, this is not in itself a problem. However, if this information is first with the employer, there is also the temptation to use it for other purposes – such as performance monitoring. The EU GDPR is set up to react to developments of this kind.
Content: Developing proven principles
Any summary of the General Data Protection Regulation must first address the changes related to personal data. This is where the most significant changes are taking place because of the EU GDPR.
For example, the accountability of companies has been extended. There are now more comprehensive obligations pertaining to the documentation of data and proving what data a company collects. These obligations also cover the purpose for which it uses the data and how it is processed. Above all, the GDPR means more work when it comes to documentation. Companies who already value data protection and have kept a register of data processing procedures find implementation of the regulation easier.
The most important principles are as follows:
- Ban failing authorization: This means that any processing of personal data is prohibited unless specifically permitted. This has been the case so far and is therefore not uncontroversial. At the end of the day, not all data is of equal importance. However, according to the GDPR, the prohibition principle applies indiscriminately to all personal data.
- Appropriation: Companies may only collect and process data for specific purposes. To this end, the purposes must be clearly outlined at the beginning of the survey and the future use of the data must be documented. For example, data that a company has collected relating to the fulfillment of a contract and rightly stores may not be used for advertising purposes. This is another, separate, purpose which requires special justification. Subsequent changes of purpose are only permissible under certain circumstances.
- Data minimization: The principle of data minimization requires companies to collect as little data as possible. The general rule is: as little as possible, as much as is necessary. You are not permitted to collect more than is necessary for the purpose of the survey in question. Thus, this principle prohibits any “blind” data collection for unspecified future purposes.
- Transparency: Data processing should always be comprehensible to those affected. On the one hand this requires understandable data protection declarations, and on the other hand users enjoy extensive rights with the innovations of the GDPR. As in the past, companies are required to provide information on what data they have and how they use it.
- Confidentiality: Companies need to ensure that they technically and organizationally protect the personal data of their customers – be it against unauthorized processing, alteration, theft, and/or destruction of data. This explicitly stated obligation to take technical protective measures is new. Nevertheless, these measures are not exactly and precisely outlined in the General Data Protection Regulation and therefore are open for interpretation. In the case of data theft, it will depend on whether the technical and organizational protective measures were appropriate to the risk as well as the type of data being stored.
Who is affected? Businesses and data protection officers
All in all, the GDPR is a good basis for every consumer and all those affected by data processing. This is because they are protected by the GDPR. In addition, GDPR regulations also affect the rights of employees.
These rules are relevant for all companies with employees. This then means that numerous companies are doubly affected, as it concerns the privacy of employees (employment data protection), as well as those of customers, suppliers, and website visitors.
Of course, the GDPR is of relevance for those employed as data protection officers. The regulations considerably increase the number of these throughout the continent. All public authorities and all companies, whose core activity relates to the handling of personal data, have to appoint a company-wide data protection officer. Even if a business’ core activity is not related to data processing, if it is the case that at least ten people are constantly engaged in the automated processing of personal data on the premises, then a data protection officer must be appointed. This is most likely the case for many medium-sized companies. Companies affected by this scheme must have taken the appropriate measures already.
Even for data protection officers who are already employed by a company, the GDPR represented a major change. This is because their role in the company has fundamentally changed. If the data protection officer has been working towards data protection conformity previously, they are responsible for monitoring the implemented measures. This increased their range of responsibility and subsequently increased their potential for liability.
Overall, the regulations increased the workload for data protection officers. They had to familiarize themselves with the new legal situation. However, the laws also had positive aspects for them. Without a doubt, their expertise is in great demand and, as well as this, their position in the company is enhanced due to the increasing number of tasks. Article 39 of the GDPR actually refers to the tasks of a data protection officer. Some of these include informing and advising in relation to the GDPR as well as other data laws, monitoring GDPR compliance, advising on the impact of the regulations, and being available for any enquiries.
The following is a summary of the General Data Protection Regulations, focusing particularly on the core tasks and effects for website operators and companies.
How the GDPR effects on companies
Even if there is no fundamental upheaval of data protection, the EU GDPR brought many changes into focus. It is imperative that companies take these alterations into account and, as early as the conceptual design phase, integrate them into their workflows that involve people (Privacy by Design principle). Otherwise, they end up being in violation of European law. Below you will find some of the most important regulations that companies, especially those in the area of online commerce, need to comply with.
General data security for businesses
- Privacy Impact Assessment (PIA): Companies are obliged to carry out risk assessments. They are also required to specify what safeguards are in place for minimizing risks. This rule becomes particularly relevant when a company is working with cloud computing. Cloud computing is something which often involves handling large amounts of personal data. Companies who store data relating to individuals’ health are likely to be hit even harder, as they are considered to be particularly sensitive and dissemination of the data can be extremely damaging for those involved.
- Employee data: Something which is always tested is the way in which a company processes its employees’ data. Therefore, the regulations in the GDPR relevant to this aspect also concern human resources, something which must be included in the changes.
- Data protection officers: For many companies, a data protection officer has become mandatory. These individuals monitor the individually-developed data protection strategy and GDPR conformity. This does not only apply to companies who work with personal data on a large scale. However, every company that has more than 10 people regularly dealing with personal data must appoint a data protection officer in the future.
- Reporting requirements: The EU GDPR guidelines on how to deal with breakdowns are considerably stricter than previous regulations. Security incidents need to be reported within 72 hours of becoming aware of them. If in doubt you should always report these to the affected persons as well as the relevant authorities.
- Responsibility and fines: It is much easier for companies to be held responsible for violations relating to data they have collected. Punishments for this can include heavy fines.
Security of personal data
- Mandatory documentation: A major focus of the GDPR is on the accountability of companies. Unlike in the past, companies are now obliged to document their data protection compliance by means of in-house documentation. They need to be able to always inform the authorities about the relevant data that is being stored, for which purpose it is stored, how the data is being stored, as well as when it is deleted by the company. If required, the company should be able to provide a list of all this relevant information.
- Privacy by Design: The Privacy by Design principle means that companies have to take data protection into account as early as during the technical structuring of their business processes. It is not permitted to implement data protection measures retrospectively (i.e., see them being of secondary importance) but instead are required to integrate them into the work process during the development phase. Both products and processes should therefore be designed in such a way that they require as little personal data as possible.
- Privacy by Default: This particular provision of the GDPR stipulates that, in principle, the data protection variant that is most friendly must be implemented in advance. This saves consumers from having to struggle through complex technical settings when trying to impose restrictions on data processing.
- Permission (agreement, works agreement): Individuals still have to explicitly agree to the use of their personal data. In addition, the consent of the employee or consumer is only valid for the stated purpose. And the declaration of consent must be formulated in a way that is comprehensible and should also be easily revocable. Revoking the agreement needs to be as easy for the customer as the original consent. Under the EU GDPR, the requirements for effective consent have increased. A gross imbalance between the parties involved can lead to both the voluntary nature of the contract being void, as well as bring about the conclusion of the contract.
- Deleting data: Personal data may only be stored for as long as it is necessary for its intended purpose. If the authorization expires (e.g., if the consent is revoked or the contract is fulfilled), then the data must be deleted.
- Right of access and cancellation: EU citizens have the right, on request, to know which of their data is held by a company and how it is being used. In addition, consumers can also request companies to delete their data. Being able to delete personal data with Google is part of the law.
How the GDPR effects on website operators
The GDPR contains few rules that are specific to the area of online trading. Instead, it formulates general principles of data protection, the sub-areas of which are regulated by other laws and regulations. Nevertheless, the abstract standards of the General Data Protection Regulation also feature some innovations relating to online trading. More information on this can be found in the following two sections.
Things stay the same – for the moment at least!
First and foremost, in addition to the mentioned regulations for companies, the GDPR initially means relatively few changes when it comes to online trading. The core themes for website operators – cookies, user tracking, spam, and direct marketing – are regulated.
However, in many ways the GDPR is just a transitional solution. Originally, together with the General Data Protection Regulation, another new regulation on data protection was set to come into force, the EU’s ePrivacy Regulation. However, it is now impossible to predict when this additional regulation will come into force, as the EU member states have so far been unable to agree on a common policy. The draft under discussion provides for a strict consent requirement for cookies. If this draft were to become law, it would have serious implications for tracking, targeting and personalized advertising. What changes will be made in the further legislative process is still unsure.
Therefore, website operators and online retailers should keep an eye on the ePrivacy regulation. In contrast to the GDPR, which regulates principles of data protection law, the ePrivacy regulation will relate to a very special area: the protection of privacy in everyday digital life. This is where website operators are expecting further regulations.
What changed with the GDPR
But what changed in May 2018? Here are the most important changes in the EU’s GDPR for website operators:
- Obligation to possess comprehensive mandatory documentation of the GDPR
- Complex consent forms
- The principles of Privacy by Design and Privacy by Default
- Extensive information rights and the right to be deleted
- The right to data portability
- More substantial information requirements (e.g., a website’s data protection declaration)
- No linking of consents
- Very high fines
Several points have already been explained in previous sections. The two themes of a data protection declaration and coupling of consent forms are described below. These mainly concern website operators.
There is a strict difference between data protection consent and data protection declaration. The user’s consent – required for any data processing that is not permitted by a legal norm – refers to the active confirmation by a user that they agree with the company’s data protection conditions. The data protection declaration is within the text in which a company presents its data protection measures to its customers. It is something which is obligatory on every website.
“The controller shall take appropriate measures to provide any information […] relating to processing to the data subject in a concise, transparent, intelligible, and easily accessible form, using clear and plain language.” – Art. 12 Par. 1 of the GDPR “Transparent information, communication and modalities for the exercise of the rights of the data subject” (Source: www.privacy-regulation.eu/en/article-12-transparent-information-communication-and-modalities-for-the-exercise-of-the-rights-of-the-data-subject-GDPR.htm/)
On the other hand, experts see the prohibition of linking consent forms as the greatest restriction imposed on the network industry by the GDPR. It means that a web page operator may not subject its potential customers to the future release of data, which is not necessary for the current service. For example, if you are required to sign up for an online newsletter to conclude a contract, this is now a violation of EU law. The most important thing is that there is nothing forced, and such measures are always voluntary. Up until now, many linked consents are unlikely to have been voluntary. Therefore, any consent obtained in this way is invalid.
“When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” – Art. 7 Par. 4 of the GDPR in relation to “Conditions for consent”
Finally, it is imperative that you observe the changes to documentation requirements, consent bases, storage, information rights, and the right to deletion. It should also be remembered that other regulations may also affect website operators and companies.
GDPR checklist for businesses and website operators
Even if you met the deadline for the European General Data Protection Regulation, it is important that you are aware that the measures required vary from company to company. This means you can check what you have done and update as necessary. There are several precautions that every company should consider. These precautions have been summarized here in a GDPR checklist for you.
- Establish documentation processes for handling personal data.
- Set up a list of processing operations.
- Establish communication methods for any customer inquiries on data protection.
- Check whether you need to appoint a data protection officer.
- Consult with the head of your technical department and the data protection officer to determine whether the current technical measures for data protection are sufficient. Under certain circumstances, further measures may have to be undertaken or existing measures may need to be better integrated into the IT infrastructure.
- All personal data collected which violates the coupling of consent rules must be collected differently and seen as voluntarily provided data.
- If you have commissioned external service providers to oversee handling your company’s personal data, you should clarify with them whether the agreements made correspond to the data protection reform. If necessary, you can adjust the agreements to the specifications. Check how you obtain the consent of your customers in your online shop and adapt the procedure to the GDPR.
- Stay up to date when it comes to ePrivacy regulation. This legislates how online retailers deal with analysis and tracking tools in the future.
- If you are at all unsure about anything, make use of relevant professional advice.
Reactions to the GDPR: Praise and criticism
As is to be expected with such an extensive and wide-ranging change to an already huge and complex issue, the reaction to the GDPR was mixed. Some welcomed its introduction, praising its comprehensiveness and transparency. Others have criticized it, noting the very high fines and strictness of some of the legislation. Below we have highlighted a few quotes from experts in the industry who had something to say about the European General Data Protection Regulation.
“The change in EU data laws is a significant breakthrough in how online organizations will engage with consumers and end users. The last 2 or 3 years have seen major changes in attitudes to how online data – such as personal information, browsing history, purchase and transaction history – is used, stored, and shared.” – Simon Moffat, Solutions Director, ForgeRock
“This regulation [shook] things up, forcing companies to scrutinize how they process and handle data. In particular, the ruling that they must report breaches ‘that are likely to harm individuals’ has the potential to expose a swathe of breaches that [were] being swept under the carpet – and the corresponding fines are likely to be keeping a few CFOs awake at night!” –Tony Pepper, CEO, Egress Technologies
“The latest agreements on EU data protection rules should raise a red flag to all components of the data supply chain. Far beyond the traditional realms of financial penalties, this latest development could threaten businesses’ viability.” – Steve Murphy, SVP, GM EMEA, Informatica
“We regret that much of the ambition of the original data protection package was lost, due to one of the biggest lobbying campaigns in European history. However, we congratulate the European Parliament and, in particular, the successful Luxembourg Presidency of the EU last year, for saving the essence of European data protection legislation.”– European Digital Rights
Effects of the GDPR on companies and consumers so far
The possible consequences of the GDPR have been the subject of heated debate for years. Since May 25 2018, some of the positive as well as some of the negative predictions seem to have come true. Here you will find a brief overview of all past developments in connection with the GDPR that affect companies and/or consumers:
SME’s hit worst by failing to implement regulations
Both the German digital association Bitkom, as well as the forsa Institute for Social Research and Statistical Analysis, which conducts market, opinion and social research, independently concluded that almost three quarters of German businesses alone were not prepared to implement the GDPR – this picture is unlikely to change across Europe, or globally. Small and medium-sized enterprises in particular currently have a lot of catching up to do. This could theoretically be reflected in their economic performance, but precise statistical findings are not yet available at this time.
Impact on the international digital economy
The GDPR has created confusion across the globe. Instead of adapting their own data protection guidelines to the European regulations, many companies and news sites simply block users with European IP addresses, reduce the information offered, or only activate it for an additional charge. In addition, many small websites have been taken off the internet for fear of fines and have not been online since. These developments play a direct role in the “data flight” scenario feared by many critics of the GDPR.
At the same time, the change that came with the GDPR has triggered an international discourse about data protection, which – as data protection activists agree – was long overdue to this extent. Large internet companies such as Google and Facebook are now more frequently the focus of media attention and are also being critically observed by their users.
US companies are cutting their ties
Many US companies and news sites such as the New York Daily and Chicago Tribune are cutting ties with users with European IP addresses. However, according to the error messages that appear on many of the websites during the visit, it is currently being examined whether the services can continue to be made available to European interested parties.
Fear of the phantom “wave of warnings”
The GDPR continues to cause confusion in many places. Although the concrete changes in the legal text are only minor, the fear of the consequences of disregarding the legal situation has increased. SMEs express their fear of warnings, with small bloggers and forum operators taking their web projects off the net. However, it was found that many of these sites have only temporarily disappeared – publishers want to check their own data protection efforts in relation to the GDPR before going online again. In any case, the dreaded “wave of warnings” seems – at least for the time being – to be absent. This means that no widespread abuse of the GDPR for targeted warning fraud has yet been recorded.
Fear of fraud
The great “warning wave”, which many economic players feared for a long time, continues to prove to be a phantom. More and more emails with reminders have entered the mailboxes of many companies. These are often fraudulent and can contain dangerous malware in the attachment and should therefore quickly be classified as spam and deleted.
The “buffer” period is over: Fines after GDPR
Although the fear of a wave of warnings turned out to be exaggerated, in December 2018 German authorities already released numbers of complaints regarding data privacy, as did authorities in other European countries. Numerous indications of violations of the GDPR in companies were received by the data protection officers.
The authorities in Europe had unofficially agreed on a temporary “buffer period” during which no penalties were imposed. But that is now over: In November 2018, the social media service provider Knuddels.de had to pay a fine of 20.000 Euro after it had stored passwords and email addresses in an unencrypted format, meaning data leaks or hacks would have been all too easy.
Furthermore, France’s data protection regulator CNIL fined Google the sum of €50 million ($57 million), considered to be a landmark in the GDPR ruling. This shows that authorities are willing to fine – and it looks like the sums of money are becoming increasingly significant.
Even more praise and criticism
For-and-against arguments on the GDPR continue to balance each other out. Some voices speak of unnecessary scaremongering and call the many website closures overcautious, other people expect that this may just be the beginning of a new age of data protection. There are many different implications to the regulation, spanning from a professional level to a personal one. Regardless of opinion, however, seeing as the GDPR is now in action, it is essential that you wise up and ensure your website or other online presence conforms to the regulations.