GDPR – what is changing next May?

This is the second in a series of posts about the EU GDPR – now less 12 months away! If you are a marketer, a business/systems analyst or a processor of third party data, this series of posts is written with you in mind – I hope you will be able to use it and the links that we provide to save you time and point you in the right direction as you grapple with the GDPR challenge. You can of course download the 130 page guide from the Information Commissioner’s website or browse through it during your lunch break, but if you want something targeted at you and split into manageable chunks, read on! In the first post, we mentioned how a genuine Single Customer View helps to keep data accurate and up to date. In this post we cover what will change from the current Data Protection Act.

At another very informative TechUK meeting last week on this topic, Rob Luke from the ICO described GDPR as an evolution of the existing rules and not a revolution. Essentially the GDPR is tightening up and clarifying existing rules more than introducing new ones, but there are two big differences:

  • Most obviously there are now huge penalties that can be imposed as discussed last week.
  • There are now responsibilities for data processors as well as data controllers, which is particularly significant for our industry.

Other key changes include mandatory notification of breaches, stricter rules on what constitutes sensitive personal data, making it harder to obtain consent and the introduction of mandatory data protection officers for some types of usage.

We will look at the new obligations for data processors in a later post aimed solely at our professional service provider audience, as well as looking at the new obligations for data controllers in a post specific to them. The key aspect of the GDPR which bears on the relationship between data controller and data processor is the much tighter control of data transfer and the need for written agreements between the two parties detailing their respective responsibilities. We will also look at when you need to obtain explicit consent and what has changed in this respect in a later post – whether you can adopt opt-out or have to settle for opt-in is now a more complex question.

Finally, if you are designing new systems, GDPR obliges you to undertake a Privacy Impact Assessment and incorporate Privacy by Design into your system – privacy and security should not be an afterthought. You must also incorporate privacy by default into collection of personal data: Fieldfisher’s blog summarises it as “businesses should only process personal data to the extent necessary for their intended purposes and should not store it for longer than is necessary for these purposes”. They state as an example that systems should “allow suppression of data of customers who have objected to receiving direct marketing”.

In the next post we will look at the key definitions in the GDPR so you can decide whether some of the obligations do indeed apply to your business. If you can’t wait, you can get a head start by reading this table in White & Case’s excellent handbook on GDPR. To be prompted about the next instalment in our series of posts, follow us on Twitter.