What are the new obligations for companies regarding GDPR in Europe?

The personal data and information of consumers is an invaluable resource for any business. By utilising this data, companies may more effectively focus their marketing. However, in order to protect the rights of individuals and privacy, this data is subject to the General Data Protection Regulation. More commonly known as GDPR, this legislation aims to regulate and harmonise the processing of data by the member states of the European Union. To mark International Data Protection Day, we thought it important to review the obligations of European companies regarding the GDPR.

What are the principles of the GDPR in Europe?

Since its adoption in 2016 and its implementation on the 25th of May 2018, the European GDPR aims to safeguard the privacy of every European citizen by protecting their personal data. This is done through six main lines of approach.

1 – Lawfulness, fairness, and transparency

Personal data must be collected and processed in a lawful, fair, and transparent manner. To this end, data subjects must be informed of how their data is used.

2 – Purpose limitation

Personal data must be collected for specific, explicit, and legitimate purposes. The company must inform the data subject before collecting their data and not go beyond the scope of the initial consent.

If a company wishes to use this data in the future for other purposes, it must pay particular attention to this new purpose. Here are some things to consider:

• The link between the initial and future purpose;
• The context in which the data is collected;
• The sensitivity of the data (health, scientific research, etc.);
• The impact of this new data processing on the data subject;
• Are there appropriate safeguards?

If the new purpose falls outside the original consent, new consent will have to be obtained.

3 – Data minimisation

As far as possible, personal data should not be processed. Otherwise, they must be limited, relevant, and suitable for the purpose.

For example, there is no point in asking a person for their date of birth if it is not intended to be exploited. The GDPR therefore requires that the collection of data be limited to that which is relevant.

4 – Accuracy

Personal data must be accurate and therefore updated when necessary to reflect the current status of the data subjects.

5 – Storage limitation

All data should be stored for a limited period, as short as possible (e.g. project duration). When data is no longer needed it must be deleted.

In some cases, data must be legally stored for several years (data of company employees, etc.).

6 – Integrity and confidentiality

Appropriate security measures must be implemented to protect personal data from any form of:

• Falsification;
• Loss;
• Destruction;
• Damage;
• Unauthorised access.

Is the GDPR mandatory in Europe?

The GDPR applies to all companies and organisations that collect, use, or process personal data of EU citizens, regardless of their size, activity, or location. The European regulation is also applied to processors.

It is important to highlight the fact that a country outside the European Union processing personal data of EU citizens is obliged to follow GDPR compliance. The general services manager has a role to play in enforcing the legislation.

In case of non-compliance with the rules, the European Commission imposes penalties, such as fines of up to  (€20 million) or 4% of the company’s annual turnover.

But who is affected by the GDPR? Here is the list of countries where the GDPR applies in Europe:

• France;
• Germany;
• Italy;
• Spain;
• Portugal;
• Netherlands;
• Belgium;
• Luxembourg;
• Denmark;
• Ireland;
• Finland;
• Sweden;
• Austria;
• Greece;
• Croatia;
• Bulgaria;
• Romania;
• Cyprus;
• Czech Republic;
• Estonia;
• Latvia;
• Lithuania;
• Hungary;
• Malta;
• Slovenia;
• Slovakia;

How to communicate about data collection

In the age of digitalisation and artificial intelligence, data-driven decision-making is an integral part of corporate CSR policy. It is therefore important to stress that an organisation has an obligation to explain very clearly to its customers why their data is collected, how it is used and how long it will be stored.

The following information must be communicated to the individuals whose personal data is being collected:

• Who the business is;
• The purposes of the data collection;
• The categories of personal data involved;
• The legal reason for the collection;
• How long the data will be stored;
• Possible further recipients in Europe;
• If the data will be transferred outside the EU;
• Their rights in terms of data copying and protection;
• Their right of complaint;
• Their right to withdraw consent at any time.

GDPR in Europe: what are the developments in data protection legislation?

The GDPR in Europe replaces the 1995 Data Protection Directive and aims to strengthen the protection of online privacy. Over the years, the legal framework has had to adapt to keep up with the developments in society and technology, including the rising use of digital technology and the development of e-commerce.

As a result, new regulations have been introduced to strengthen the protection of personal data.

Companies must now notify the supervisory authority in the event of a data privacy breach that is likely to affect the rights and freedoms of data subjects.

A DPO (Data Protection Officer) must be appointed in companies that systematically process sensitive data on a large scale.

The data protection principle must be respected at the design stage (privacy by design).

Companies are no longer required to declare data processing operations to the dedicated national body except for specific processing). However, they are obliged to keep records of personal data processing to prove their compliance with the EU GDPR in the event of an audit.

As soon as a processor has access to the processing files, the company must draw up a subcontract which includes the GDPR obligations. This responsibility is applicable to all processors in the chain.

Citizens have the right to refuse that their personal data be used for commercial prospecting or automated analysis for classification or prediction purposes (profiling technique). They can also make the decision to request to receive the data collected about them (right to data portability).

GDPR in Europe: what is the impact for employees?

The implementation of the GDPR has consequences for the employees of companies, particularly regarding the processing of their personal data. Under the GDPR, companies must inform their employees in a transparent manner about the processing of their personal data, as explained above (purpose of collection, expected retention period, and data recipients).

Employees have the right to access their data and request that it be corrected or deleted if it is inaccurate.

Finally, the GDPR includes measures to protect the personal data of employees, particularly in the event of the transfer of their data to third parties, a data breach, or dismissal. These measures aim to ensure that employees’ data is treated confidentially and to protect their rights and freedoms.

We invite you to download our “Procurement Policy and CSR” white paper to expand your knowledge of corporate responsibility.