3: EU GDPR Compliance
- Page ID
- 121314
\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)
\( \newcommand{\dsum}{\displaystyle\sum\limits} \)
\( \newcommand{\dint}{\displaystyle\int\limits} \)
\( \newcommand{\dlim}{\displaystyle\lim\limits} \)
\( \newcommand{\id}{\mathrm{id}}\) \( \newcommand{\Span}{\mathrm{span}}\)
( \newcommand{\kernel}{\mathrm{null}\,}\) \( \newcommand{\range}{\mathrm{range}\,}\)
\( \newcommand{\RealPart}{\mathrm{Re}}\) \( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)
\( \newcommand{\Argument}{\mathrm{Arg}}\) \( \newcommand{\norm}[1]{\| #1 \|}\)
\( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)
\( \newcommand{\Span}{\mathrm{span}}\)
\( \newcommand{\id}{\mathrm{id}}\)
\( \newcommand{\Span}{\mathrm{span}}\)
\( \newcommand{\kernel}{\mathrm{null}\,}\)
\( \newcommand{\range}{\mathrm{range}\,}\)
\( \newcommand{\RealPart}{\mathrm{Re}}\)
\( \newcommand{\ImaginaryPart}{\mathrm{Im}}\)
\( \newcommand{\Argument}{\mathrm{Arg}}\)
\( \newcommand{\norm}[1]{\| #1 \|}\)
\( \newcommand{\inner}[2]{\langle #1, #2 \rangle}\)
\( \newcommand{\Span}{\mathrm{span}}\) \( \newcommand{\AA}{\unicode[.8,0]{x212B}}\)
\( \newcommand{\vectorA}[1]{\vec{#1}} % arrow\)
\( \newcommand{\vectorAt}[1]{\vec{\text{#1}}} % arrow\)
\( \newcommand{\vectorB}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\( \newcommand{\vectorC}[1]{\textbf{#1}} \)
\( \newcommand{\vectorD}[1]{\overrightarrow{#1}} \)
\( \newcommand{\vectorDt}[1]{\overrightarrow{\text{#1}}} \)
\( \newcommand{\vectE}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash{\mathbf {#1}}}} \)
\( \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } \)
\(\newcommand{\longvect}{\overrightarrow}\)
\( \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} \)
\(\newcommand{\avec}{\mathbf a}\) \(\newcommand{\bvec}{\mathbf b}\) \(\newcommand{\cvec}{\mathbf c}\) \(\newcommand{\dvec}{\mathbf d}\) \(\newcommand{\dtil}{\widetilde{\mathbf d}}\) \(\newcommand{\evec}{\mathbf e}\) \(\newcommand{\fvec}{\mathbf f}\) \(\newcommand{\nvec}{\mathbf n}\) \(\newcommand{\pvec}{\mathbf p}\) \(\newcommand{\qvec}{\mathbf q}\) \(\newcommand{\svec}{\mathbf s}\) \(\newcommand{\tvec}{\mathbf t}\) \(\newcommand{\uvec}{\mathbf u}\) \(\newcommand{\vvec}{\mathbf v}\) \(\newcommand{\wvec}{\mathbf w}\) \(\newcommand{\xvec}{\mathbf x}\) \(\newcommand{\yvec}{\mathbf y}\) \(\newcommand{\zvec}{\mathbf z}\) \(\newcommand{\rvec}{\mathbf r}\) \(\newcommand{\mvec}{\mathbf m}\) \(\newcommand{\zerovec}{\mathbf 0}\) \(\newcommand{\onevec}{\mathbf 1}\) \(\newcommand{\real}{\mathbb R}\) \(\newcommand{\twovec}[2]{\left[\begin{array}{r}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\ctwovec}[2]{\left[\begin{array}{c}#1 \\ #2 \end{array}\right]}\) \(\newcommand{\threevec}[3]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\cthreevec}[3]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \end{array}\right]}\) \(\newcommand{\fourvec}[4]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\cfourvec}[4]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}\) \(\newcommand{\fivevec}[5]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\cfivevec}[5]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}\) \(\newcommand{\mattwo}[4]{\left[\begin{array}{rr}#1 \amp #2 \\ #3 \amp #4 \\ \end{array}\right]}\) \(\newcommand{\laspan}[1]{\text{Span}\{#1\}}\) \(\newcommand{\bcal}{\cal B}\) \(\newcommand{\ccal}{\cal C}\) \(\newcommand{\scal}{\cal S}\) \(\newcommand{\wcal}{\cal W}\) \(\newcommand{\ecal}{\cal E}\) \(\newcommand{\coords}[2]{\left\{#1\right\}_{#2}}\) \(\newcommand{\gray}[1]{\color{gray}{#1}}\) \(\newcommand{\lgray}[1]{\color{lightgray}{#1}}\) \(\newcommand{\rank}{\operatorname{rank}}\) \(\newcommand{\row}{\text{Row}}\) \(\newcommand{\col}{\text{Col}}\) \(\renewcommand{\row}{\text{Row}}\) \(\newcommand{\nul}{\text{Nul}}\) \(\newcommand{\var}{\text{Var}}\) \(\newcommand{\corr}{\text{corr}}\) \(\newcommand{\len}[1]{\left|#1\right|}\) \(\newcommand{\bbar}{\overline{\bvec}}\) \(\newcommand{\bhat}{\widehat{\bvec}}\) \(\newcommand{\bperp}{\bvec^\perp}\) \(\newcommand{\xhat}{\widehat{\xvec}}\) \(\newcommand{\vhat}{\widehat{\vvec}}\) \(\newcommand{\uhat}{\widehat{\uvec}}\) \(\newcommand{\what}{\widehat{\wvec}}\) \(\newcommand{\Sighat}{\widehat{\Sigma}}\) \(\newcommand{\lt}{<}\) \(\newcommand{\gt}{>}\) \(\newcommand{\amp}{&}\) \(\definecolor{fillinmathshade}{gray}{0.9}\)- Understand what General Data Protection Regulation (GDPR) compliance requires.
- Consider the specifics of an organization's compliance implementation.
This case study covers the European Union (EU) General Data Protection Regulation (GDPR)[1] that enhances data privacy law. It is an example of a compliance project that would be put in place to ensure that an organization complies with published regulations or standards.
From the frame of reference of an American company, this may at first blush appear to be an intellectual curiosity, as data privacy compliance efforts may be focused on things closer to home such as the California Consumer Privacy Act of 2018 (CCPA, amended in 2020). However, the reach of European Union Directives and Regulations can extend well beyond the EU. This was dramatically seen with the EU Restriction of Hazardous Substances (RoHS) Directive that affected American companies that wanted to sell ("place on the market") electronic products into the EU. Similarly, the GDPR extends its reach beyond the EU by including organizations that collect information about, or process data about, people within the EU.
This case study looks at the provisions of the regulation and the specific duties of data controllers (those that decide what will be done with information about people) and data processors (those that actually process that data). An organization that wants to be compliant needs to incorporate these responsibilities into its compliance framework.
It is important to understand that you may be designated as the project manager of a compliance effort like this with little prior subject matter knowledge. You may feel a lot of pressure to attain compliance in a short time because the executive team got a late start in realizing the need for compliance. As with other compliance efforts associated with new directives and regulations, there may be very few knowledgeable consultants available to help you initially because the consultants are learning on the job as well. Any useful tools and expert learnings may only be available to those in the second wave of compliance efforts.
As a result, this case study is presented in a manner to provide the salient aspects of the regulation itself, as that may be all that is available when your project is initiated. This is done deliberately to simulate what it is like on Day 0 of your project efforts.
The text of the regulation is provided with the European spellings of words as they appear in the regulation, rather than the American English spellings which do not appear in the regulation. If you see any American English spellings of regulation language, it is because somewhere in the editing process of this textbook someone tried to be "helpful."
This case study is structured as follows:
- Introduction
- The Regulation: This section describes the structure of the Regulation that is divided into a "Recitals" section that provides context and an "Articles" section that itemizes the specific rules. After itemizing each category of Articles and then the particular Articles comprising that category, the next section extracts the specifics of several salient Articles that are key to a compliance implementation. In a compliance project, you need to know with what you are being compliant to understand scope and the requirements.
- Implementing GDPR Compliance: This section discusses what an organization might consider in assessing what it needs to do to attain GDPR compliance based on its current compliance level with other prior data privacy initiatives.
- Project Management Considerations: This section looks at GDPR from the frame of reference of a project manager that has responsibility for running the GDPR compliance project.
- Legal Considerations: This section provides analysis from a legal frame of reference and looks at penalties that some organizations have incurred due to non-compliance.
- Glossary: The Glossary defines salient terms.
The necessary terms are defined when discussing the various Articles (especially Article 4) or in the Glossary at the end of the chapter.
References
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 1, corrigendum 2018 O.J. (L127) 2 (GDPR).
The Commission's reuse policy is implemented by the Commission Decision of 12 December 2011 on the reuse of Commission documents.
Unless otherwise indicated (e.g. in individual copyright notices), content owned by the EU on this website is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. This means that reuse is allowed, provided appropriate credit is given and changes are indicated.
- 3.1: Introduction
- This section discusses the scope of applicability of the GDPR and briefly discusses its historical context.
- 3.2: The Regulation
- This section provides the salient details of the GDPR's two major sections, Recitals and Articles.
- 3.2.2: Article 3 Territorial Scope
- 3.2.3: Article 4 Definitions
- 3.2.4: Article 5 Principles related to processing of data
- 3.2.5: Article 6 Lawfulness of processing
- 3.2.6: Article 7 Conditions for consent
- 3.2.8: Article 13 Information to be provided where personal data are collected from the data subject
- 3.2.9: Article 15 Right of access by the data subject
- 3.2.10: Article 16 Right to rectification
- 3.2.11: Article 17 Right to erasure (‘right to be forgotten’)
- 3.2.12: Article 18 Right to restriction of processing
- 3.2.13: Article 20 Right to data portability
- 3.2.14: Article 21 Right to object
- 3.2.15: Article 22 Automated individual decision-making, including profiling
- 3.2.16: Article 24 Responsibility of the controller
- 3.2.17: Article 25 Data protection by design and by default
- 3.2.18: Article 28 Processor
- 3.2.19: Article 32 Security of processing
- 3.2.20: Article 33 Notification of a personal data breach to the supervisory authority
- 3.2.21: Article 34 Communication of a personal data breach to the data subject
- 3.2.23: Article 37 Designation of the data protection officer
- 3.2.24: Article 38 Position of the data protection officer
- 3.2.25: Article 39 Tasks of the data protection officer
- 3.2.27: Article 83 General conditions for imposing administrative fines
- 3.2.26: Article 42 Certification
- 3.2.1: Article 1 Subject-matter and objectives
- 3.2.7: Article 9 Processing of special categories of personal data
- 3.2.22: Articles 35-36 Data Protection Impact Assessments
- 3.3: Implementing GDPR Compliance
- This section outlines what an organization might need to do to attain GDPR compliance. What an organization needs to do is based on an assessment of what the current state of compliance is and what needs to be done to achieve the desired level of compliance.
- 3.4: Project Management Considerations
- This section sketches out project management considerations in attaining GDPR compliance.
- 3.5: Legal Considerations
- This section on Legal Considerations provides some specifics of why US companies are affected by GDPR and discusses GDPR penalties.
- 3.6: Glossary
- This section provides a lexicon or glossary defining technology specific vocabulary used in this chapter.
Chapter thumbnail: GDPR for Europe by Dooffy is made available under the Creative Commons CC0 1.0 Universal Public Domain Dedication.