Does it apply to me?
Coming into effect on Friday 25 May 2018, the European General Data Protection Regulation, aka the GDPR, is the new privacy kid on the block in the EU. It is the most extensive and far reaching privacy protection legislation for individuals who live in the EU, but don’t be fooled – although it is European legislation, its reach is far broader than the European Union.
You may have noticed that you are receiving emails from your various service providers and software and app developers, who may or may not be in the EU, seeking express consent from you to continue to market their product or service to you.
This is because, if you evidence an intention to market your goods or services (free or paid) to any resident in the European Union – you will need to comply with the GDPR.
This intention might be demonstrated by a variety of factors such as:
- listing your product pricing in Euros
- using any European language; or even
- having testimonials from European residents on your website
Importantly, the GDPR differs from the Australian Privacy Act in that there are no turnover thresholds, or activity related thresholds…
If you offer goods or services in the EU, regardless of the size of your business, you will need to comply with the GDPR.
So how is it different to the Australian Privacy Act?
Both the Australian Privacy Act and the GDPR place significant focus on consent, transparency and accountability for personal information. Under both regimes an individual has the right to access their information, have it de-identified or corrected.
Under the GDPR, however the rights go further:
- individuals have the right to have their data completely erased or destroyed
- the right to restrict processing; and
- the right to request their data file or records are in a portable format.
Rights under the GDPR also extend to employees within the EU, including employment records, performance management, health and any other relevant personal information recorded.
The GDPR requires business to obtain active consent from users to collect any personal data including websites, cookies or simply email addresses. This consent request must be clearly written using plain language.
Business are also required to have a legitimate purpose for collecting personal information i.e. they must collect information in order to fulfil a contract with the individual. Collection of personal data without a legal and legitimate purpose is an offence.
How do I comply?
If you are already an Australian Privacy Principle Entity under the Australian Privacy Act, then you have a good head start!
If you market your products or services in the EU you must:
- Have a clearly visible and plainly written privacy notice and consent button on your website every time you collect information collect or process personal information.
- Have undertaken a review of your data processing activities and record types of data and the legal purpose for collection.
- Ensure your IT systems and technology are appropriately secure having regard to the type and sensitivity of Personal Information you collect. This may mean utilising encryption services, two-factor authentication, and emergency back-up systems if necessary.
- Make sure you have processes in place to efficiently and appropriately respond to any request by an individual for access to their Personal Information, including the capacity to provide them with their data in a portable format or file.
- You must have a Data Breach Notification process so that you can quickly and effectively mitigate any loss caused by a Data Breach. You will have 72 hours from when you become aware of a breach to notify affected individuals and the relevant EU authority.
If another entity processes Personal Information of EU residents on your behalf, you are deemed a Data Controller under the GDPR and are ultimately responsible for the processes of that entity. You should be requesting a Data Processing Agreement to ensure they are compliant with the GDPR!
Similarly, if you process Personal Information of EU residents on behalf of another entity you must have a Data Processing Agreement in place.
What should I do now?
These changes are significant in the privacy protection evolution and cannot be ignored.
For a FREE strategy session as to how these changes might specifically impact your business – you can schedule a consultation with me online by following this link.
You can read the Office of the Australian Information Commissioners guidance on the changes for Australian businesses here.