Data Protection Directive repealed by European General Data Protection Regulation
Replacement by the General Data Protection Regulation
On 25 January 2012, the European Commission (EC) announced it would be unifying data protection law across a unified European Union via legislation called the "General Data Protection Regulation." The EC's objectives with this legislation included:
the harmonisation of 27 national data protection regulations into one unified regulation;
the improvement of corporate data transfer rules outside the European Union; and
the improvement of user control over personal identifying data.The original proposal also dictated that the legislation would in theory "apply for all non-EU companies without any establishment in the EU, provided that the processing of data is directed at EU residents," one of the biggest changes with the new legislation. This change carried on through to the legislation's final approval on 14 April 2016, affecting entities around the world. "The Regulation applies to processing outside the EU that relates to the offering of goods or services to data subjects (individuals) in the EU or the monitoring of their behavior," according to W. Scott Blackmer of the InfoLawGroup, though he added "[i]t is questionable whether European supervisory authorities or consumers would actually try to sue US-based operators over violations of the Regulation." Additional changes include stricter conditions for consent, broader definition of sensitive data, new provisions on protecting children's privacy, and the inclusion of "rights to be forgotten."The EC then set a compliance date of 25 May 2018, giving businesses around the world a chance to prepare for compliance, review data protection language in contracts, consider transition to international standards, update privacy policies, and review marketing plans.
abolished by revoked by annulled by cancelled by rescinded by