7 December 2017

Privacy in Europe and the GDPR
An overview

Nicolas Seidler
Senior Policy Advisor
seidler@isoc.org

Presentation title – Client nameInternet Society © 1992–2016

1

OVERVIEW: EU General Data Protection Regulation• Privacy context in Europe > EU General Data Protection Regulation (GDPR) > 25 May 2018
• GDPR now recognized as law across EU > 2 years for Member states to ensure
implementable in their countries.
• Replaces 1995 Data Protection Directive (DPD) > Internet was in its infancy• 100+ countries have data protection laws > many modelled after 1995 DPD > same likely forGDPR• Impact of GDPR: beyond EU. Obligations relate to location of data subject, not data controller.
Given cross-border services, will likely generate global consistency around data protection
laws.
• Stick: heavy fines for non-complying businesses• Japan: already in process of convergence and adequacy with GDPR requirements
2

The privacy: historic context in Europe

3

Privacy context in Europe• History: World War 2 and Cold War > surveillance and unchecked use of
personal data (e.g. race, ethnicity)• Consumer protection and regulation against market abuse (e.g. Google,Microsoft)• High levels of consumer adoption of ICT services and technology

Source: Flash Eurobarometer 433 on ePrivacy, December
2016
4Deconstructing the GDPR

5

GDPR in a nutshell• 4 years of negotiation• Adopted in April 2016
• Entering effect on 25 May 2018
• 99 articles setting:Rights: for people to access the information companies hold about them
 Obligations: for better data management by businesses Fines: for non compliance up to €20 million or 4% of a firm's global turnover
7

Applicability & scope8

Extra-territorial applicability (art. 3 GDPR)• Individuals, organisations, and companies that are either 'controllers' or 'processors' of
personal data will be covered by the GDPR.
• Extraterritorial effects: applies to any entity, no matter its geographical location, which collects
or processes the data of people ordinarily resident in the European Union, regardless of:••the location of the company processing the data
whether the processing takes place in the EU or not• Non-EU businesses processing the data of EU citizens will
also have to appoint a representative in the EU.
• In summary: it’s not about which country you are in,
but where the customer is.

DATA CONTROLLER: A controller
is an entity that decides thepurpose and manner that personal
data is used, or will be used (e.g.
bank)
DATA PROCESSOR: The person
or group that processes the data
on behalf of the controller.
Processing is obtaining, recording,adapting or holding personal data
(e.g. data center)9Personal data: definition• Detailed definition of personal data: broadly means a piece of information thatcan be used to identify a person.
• Extended definition covers for a wide range of personal identifiers (i.e. IPaddress) to constitute personal data, reflecting changes in technology and theway information is collected• [New] Pseudonymised personal data can fall within the scope of the GDPR
provided that it is sufficient enough to attribute the pseudonym to a particular
individual• Sensitive data (special categories of personal data) specifically include
genetic data, and biometric data where processed to uniquely identify anindividual
10

Obligations11

Privacy by design (art. 25 GDPR)• Privacy by design: the inclusion of data protection from the onset ofthe designing of systems, rather than an addition after the fact.
• GDPR Art 23 calls for controllers to hold and process only the data
absolutely necessary for the completion of their duties (dataminimization), as well as limiting the access to personal data to
those needing to act out the processing.

12Consent/opt-in (art. 7 GDPR)
Strengthened conditions for consent and explicit opt-in:• The request for consent must be given in an intelligible and easily accessible
form, with the purpose for data processing attached to that consent.
• Consent must be clear and distinguishable from other matters and provided
in an intelligible and easily accessible form, using clear and plain language.
• It must be as easy to withdraw consent as it is to give it.​13

Data Protection Impact Assessment (art. 35 GDPR)• The controller is obliged to carry out a DPIA prior to processing for cases thatpose a high risk to the rights and freedoms of natural persons.
• In particular concerning the use of new technologies and systematic
evaluation of personal aspects (e.g. profiling, automated processing)• Includes an assessment of the necessity and proportionality of the processing
operations in relation to the purposes.

14

Data Breach Notification (art. 33 GDPR)• Mandatory breach notification in all member states where a data breach islikely to “result in a risk for the rights and freedoms of individuals”.
• Notification will be done within 72 hours of first having become aware of thebreach.
• Data processors will also be required to notify their customers and thecontrollers, “without undue delay” after first becoming aware of a data breach.

15

Data Protection Officer (DPO) (art. 37 GDPR)• Mandatory for companies that have "regular and systematic monitoring" ofindividuals at a large scale or process a lot of sensitive personal data
• Will be main liaison with relevant countries’ Data Protection Authorities (DPA)• DPO must be based in the EU (guidelines exist to define place ofestablishment)• One-stop-shop mechanism: if organisation active in multiple EU countries,
allows to work with just one DPA in a consistent manner across the EU (samebenefits for data subjects)• Overall objective: turn data protection and privacy into a boardroom issue
16

Transfer of data to third countries / adequacy (art. 45 GDPR)• Transfer of personal data to third countries and international organisations can only be madewhere adequate level of privacy protection exists• The overall evaluation does not require a level of protection identical to that offered within theEU, but requires a level of protection that is “essentially equivalent”.
• Once an adequate level of protection is recognized by the EU Commission, transfers can bemade without specific authorizations• In the absence of an adequacy decision a controller or processor may transfer personal datato a third country or an international organisation only if the controller or processor has
provided appropriate safeguards and on condition that enforceable data subject rights andeffective legal remedies for data subjects are available. (e.g. EU-US Privacy Shield)• Japan: advanced process to have formal adequacy with EU data protection laws by early2018. Could be first in Asia to be given adequacy status.
17Rights

18

Rights to access (art. 15 GDPR)• Data subjects have the right to obtain from the data controller confirmation asto whether or not personal data concerning them is being processed, whereand for what purpose (transparency).
• The controller shall also provide a copy of the personal data, free of charge, inelectronic format.
• = crucial change for data transparency and empowerment of data subjects.

19Data portability (art. 20 GDPR)• Right for a data subject to receive the personal data concerning them in a 'commonly used
and machine readable format’.
• Only applies portability to data provided by the data subject (e.g. leaves out inferred data or
personal data added by others)• Gives the right to to transmit those data to another controller without hindrance from thecontroller• Direct transfer of data from one controller to another “where technically feasible”

20Right to erasure (art. 17 GDPR)
Gives individuals the power to get their personal data erased in somecircumstances.
This includes:• where it is no longer necessary for the purpose it was collected• if consent is withdrawn• if it was unlawfully processed
Controllers are required to compare the subjects' rights to "the public interest in
the availability of the data" when considering such requests.

21

Penalties

22

Penalties (art. 83)• Organizations in breach can be fined up to 4% of annual global turnover or€20 million (whichever is greater)• A tiered approach to fines e.g. a company can be fined 2% for not having theirrecords in order (article 28), not notifying the supervising authority and data
subject about a breach or not conducting impact assessment.
• Applicable to both controllers and processors.

23

Challenges

24Challenges• Enforcement (e.g. Right to erasure > can you really remove something fromthe Internet?)• Cost of measures• Limitations for data intensive innovations (e.g. AI)• Coverage of data not provided by the individual• Is regulation the right tool? What about ethics?

25

Next steps

26

GDPR: Compliance assessment• Compliance assessment for businesses dealing with EU personal data
• Also for Internet technical players (e.g. ICANN and WHOIS)• In doubt, get legal advice!

27

ePrivacy regulation in Europe• Intended to complement and particularize the GDPR on electronic communications• To replace E-Communications Privacy Directive•

Originally set the obligations for telecom operators and ISPs to ensure communications privacy withregard to the services they provide.

Key changes:• OTT providers are being covered along with traditional telecoms operators and ISPs (e.g.
Skype)• Alignment and synergies with GDPR around data breaches, transparency, etc.
• Opt-in regime is adopted for unsolicited commercial communications

28

Thank you.
Visit us atwww.internetsociety.org
Follow us@internetsociety

Galerie Jean-Malbuisson 15,
CH-1204 Geneva,
Switzerland.
+41 22 807 1444

1775 Wiehle Avenue,
Suite 201, Reston, VA
20190-5108 USA.
+1 703 439 2120

29