The EU aims to better protect the privacy of European citizens and has introduced the GDPR for this purpose. The GDPR is a European law and therefore also applies to the Netherlands. This new law has been formally in effect since May 25, 2016, and replaces the current Personal Data Protection Act (Wbp).
Safeguarding privacy
The Wbp was drafted back when everyone was still dialing in via 56k modems to get online. Today, almost everyone has access to high-speed internet anywhere and at any time. We handle almost everything online, both privately and professionally. In doing so, we spread our data across many different places. Due to digitalization, companies, governments, and healthcare organizations store a wide range of personal information about customers, citizens, and clients. How they protect this data and what they do with it is not always clear. That is why the EU wants to better safeguard the privacy of citizens.
Personal data
Previously, personal data primarily referred to information such as names and addresses. Under the new law, this also applies to data linked to IP addresses, MAC addresses, cookies, and the like. Therefore, all data that companies collect via cookies—even if they do not receive it directly from the individuals themselves—is considered privacy-sensitive. This applies even if, for example, no name is attached to it.
Transparent
It is now not only mandatory to store personal data carefully, but also to regularly test and demonstrate the measures taken to do so. Furthermore, it becomes mandatory to inform people of their right to modify, view, and even destroy the data that an organization collects and manages. If a retail organization or webshop registers a visitor's interests for marketing purposes, it must be possible to delete this data upon request. In addition, organizations are required to explain exactly what they do with all personal data in plain language. It is also mandatory to inform people that, in case of problems, they can file a complaint with the supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Documentation
Previously, you only had to keep track of data breaches if you were also required to report them to the supervisory authority. That changes with the GDPR. Now, you are required to document all data breaches internally, even if they do not need to be reported. And if you process privacy-sensitive data for a client, you are legally required to report data breaches to them as well, so they can, in turn, report them to the supervisory authority. All processing of personal data must also be documented, including data of your own staff or the mailing list for your newsletter. This documentation must clearly indicate which data is processed, for what purposes, and how it is secured. You can find more information about this here.
Data processing agreement
Under the new legislation, you must enter into a data processing agreement with all your suppliers and customers. After all, you remain responsible for the data stored by your organization, even if it is stored or managed elsewhere. The agreement describes how you handle personal data. When outsourcing services that involve a customer's personal data, this is a key point of attention. You must not only make agreements with suppliers and customers but also obtain consent from the relevant customer for this.
Storing data abroad
When working with foreign parties, it is of great importance that you are certain where your data is stored. This is only permitted under very strict regulations. One example is the Privacy Shield. If your data is stored within the EU, it is protected by the strictest personal data rules in the world. In that case, you are in good hands with a party like Fundaments, as we only work with data centers within the Netherlands.
No time to sit back
A transition period remains in effect until May 25, 2018. However, this does not mean you can sit back and relax. The new legislation is not optional; there is a hard deadline. Nevertheless, you certainly still have time to take the right measures, and it is highly recommended that you do so. Currently, the maximum fine is €900,000. Under the new law, this will be increased to 20 million euros or 4% of the global annual turnover. Time for action, then.
In addition to the points mentioned above, there are other aspects that will change under the new law. Would you like to know more about the impact of the GDPR on your organization? Join us on October 26th for our GDPR Knowledge Event.
GDPR in a nutshell?
The GDPR will replace the Personal Data Protection Act (Wbp) as of May 2018. In addition to the mandatory reporting of data breaches, it is now required to:
- Maintain a register of processing activities
- Periodically conduct a 'privacy impact assessment'
- Expand information obligations to data subjects
- Appoint a 'data protection officer'
Source: https://ictrecht.nl/factsheets/algemene-verordening-gegevensbescherming-verandert-er-echt/
