understand the price of compliance and the costs of enforcement, we first summarize the major features of each regime below, drawing out some of the key approaches to compliance in these jurisdictions.

A. Compliance under the EU Data Privacy Regime The GDPR requires that every entity processing personal data must have a legal basis to do so, such as consent or because it is necessary for the performance of a contract.<sup>10</sup> If that basis is consent, that consent must be <mark>“freely given, specific, informed and unambiguous.</mark> ”<sup>11</sup> Personal data must be processed lawfully, fairly, and transparently; collected for specified and legitimate purposes; adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; accurate; kept no longer than necessary for such purposes; and processed in a manner that ensures appropriate security.<sup>12</sup> It gives data subjects the rights to be informed, to access and rectify data, to be forgotten, to restrict processing, to data portability, and to object to certain processing of their data. The GDPR mandates that data controllers and processors institute privacy by design, seeking to implement data-protection principles in their products, taking into account both costs of implementation and risks for data subjects.<sup>13</sup> For data processing activities posing high risks to data subjects, the GDPR requires data controllers to carry out data protection impact assessments.<sup>14</sup> In addition, data controllers and processors may have to designate data protection officers when, for example, carrying out large-scale processing of special categories of data.<sup>15</sup> The GDPR goes beyond data privacy by, for example, giving each person the right to object to automated decision-making that produces legal effects on that person.

Because the GDPR adopts a risk-based approach, an organization’s compliance obligations and related expenditures vary considerably depending on the risks posed by an organization’s data collection or processing activities.<sup>16</sup> Data collection or processing that presents considerable risks to the rights and freedoms of data subjects by virtue of the nature, scope, context, and purpose of processing are high risk under the GDPR. Examples might include processing based on new technologies, and extensive automated decision-making with legal effects. As described above, such processing requires the implementation of procedures such as mandatory data protection impact assessments in which risks in processing are identified and safeguards presented, informing controllers of measures to be taken to mitigate and risk and, in certain cases, prior consultation with a Data Protection Authority before proceeding.<sup>17</sup> Furthermore, organizations are required to take the appropriate technical and organizational measures to properly safeguard personal data pursuant to the regulation’s policy of data protection by design and default.<sup>18</sup>

> 10 Regulation 2016/679 of the European Parliament and of the Council of Apr. 27, 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 6, 2016 O.J. (L 119) 33 (EU) [hereinafter GDPR].

> 11 _Id._ art. 4(11).

> 12 _Id._ art. 5.

> 13 _Id_ . art. 25.

> 14 _Id_ . art. 35.

> 15 _Id_ . art. 37.

> 16 European Commission, _The GDPR: New Opportunities, New Obligations_ (2018).

> 17 GDPR News, _What Is High Risk Under GDPR?_ Compliance Junction, (2017); GDPR, art. 35-36. 18 Council Directive 2016/679, art. 28, 2016 O.J. (L 119) 1, 2.

4