Source: https://www.westerncity.com/article/us-public-agencies-may-need-comply-european-union-data-privacy-regulation
Timestamp: 2019-04-21 11:02:55+00:00

Document:
Todd Leishman and Leeann Habte are attorneys with the law firm of Best Best & Krieger LLP and can be reached at Todd.Leishman@bbklaw.com and Leeann.Habte@bbklaw.com, respectively. Elizabeth Barket, formerly with Best Best & Krieger LLP, also contributed significantly to this article.
A sweeping new global privacy law took effect in May, and its reach extends even to local public authorities in the United States. The General Data Protection Regulation (GDPR)1 of the European Union (EU) regulates the way personal data must be collected, stored and shared. Although its impact on private companies is being broadly discussed, little attention has been paid to its impact on public authorities that fall within its scope.
This article offers information to help public agencies understand if and how the GDPR might apply to them and which of their day-to-day advertising, partnership and online activities might bring them under the GDPR’s purview. This article also provides practical steps that public agencies can take to comply with the law.
Maintaining an email distribution list targeting entities or persons interested in knowing about certain events or availability related to the public authority.
Passes on personal data to third parties for monitoring or profiling purposes.
Public agencies should view the GDPR as a call to action and an opportunity to increase and clarify internal controls and policies for data gathering, use and storage activities. Key decisionmakers should be made aware of potential GDPR compliance obligations. As public authorities increasingly gather and use data for official and commercial purposes — including in partnership with private third-party entities — GDPR compliance will likely comprise an important step toward institutionalizing appropriate privacy and data security practices.
The GDPR has established new norms for privacy and data security that have already shaped California law and public perception regarding privacy rights. Earlier this year, the California Legislature enacted a privacy law similar to the GDPR. Although the California law does not appear to apply to local governments, privacy laws are evolving at a rapid clip, and local governments must diligently assess compliance obligations.
Each of these steps requires evaluation and development of new policies and procedures. Legal counsel can assist in assessing compliance needs and in implementing a compliance strategy that is appropriate for your agency.
 Regulation (EU) 2016/679. The GDPR is a comprehensive update of its predecessor, the Data Privacy Directive. Directive. Directive (EU) 95/46/EC (the “Directive”). Many GDPR provisions remain largely unchanged from the Directive, and Directive jurisprudence and guidance provides insight for GDPR compliance.
 The UK’s Information Commissioner’s Office stated that the GDPR will apply in the UK, as the UK has adopted materially similar laws in the UK Data Protection Act. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/.
 Art 3(2)(b) GDPR; Recital 24 GDPR (specifying that internet use profiling is an example of “monitoring” within the meaning of Art. 3).
 Processing is defined broadly under the GDPR to include any manual or automated “collection, recording, [organization], structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” of personal data “or on sets of personal data.” Art. 4(2) GDPR.
 Art. 4 GDPR (italics added). Data is “identifiable” if it can be used to identify a natural person using “all means reasonably likely to be used” — which is generally regarded as a low standard. Recital 26 GDPR.
 See, e.g., Art. 4(7) (specifying that a data “controller” includes a “public authority” or “agency,” acting in concert or alone to determine the “purpose and means” of processing personal data). Official EU guidance clearly provides that the GDPR covers national public bodies as well as “regional or local authorities, bodies governed by public law and associations formed by one or several such authorities or one or several such bodies governed by public law.” Article 29 Data Protection Working Party, Opinion 2/2016 on the publication of Personal Data for Transparency purposes in the Public Sector (1806/16/EN WP239), http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2016/wp239_en.pdf.
 Art. 83(5) GDPR; Recital 148 GDPR.
 Art. 82(1) GDPR (establishing right to compensation for any person who has suffered “material or non-material damage” as a result of a GDPR breach); id. at Art. 80 (data subjects can mandate consumer protection bodies to bring claims on their behalf); id. at Art 79.

References: Art 3
 Art. 3
 Art. 4
 Art. 4
 Art. 4
 Art. 83
 Art. 82
 Art. 80
 Art 79