Evolve Event - GDPR

1. GDPR – the truth
about the changes
in 2018
Tim Fransen
Evolve
23 november 2017

2. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 1
General Data Privacy Regulation - Timeline
1995 2012 2015 2016 2017 2018
… …
Implementation period
EU Directive
95-46-EC
Proposal for new
data privacy
legislation
Agreement on the
GDPR
text by the European
Commission,
Parliament
and Counsel
(17/12/2015)
Publication of the
General Data
Protection
Regulation
(04/05/2016)
-
GDPR has entered
into force
(24/05/2016)
General Data
Protection
Regulation will
apply as of
(25/05/2018)
1992
Belgian
Privacy Act

3. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 2
What is (sensitive) Personal Data?
Financial information. Union
membership is sensitive data
Family and demographic information.
Religious beliefs and race are sensitive
data
Home and work information.
Sexual orientation is sensitive
data
Medical records. Health
information is sensitive data
Online behavioral patterns,
devices used, etc.
Fingerprints, and genetic
information
Leisure activities and hobbies.
Political opinions and group
membership are sensitive data
Behavioral patterns and interests
Travel history and location data

4. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 3
What is Processing?
Legislation
Processing
Examples
Some examples of processing
• Remote and read only access
• Holding but not performing
actions upon personal data
• Computer processing data
without a human viewing it
• Use of “pseudonymized” data
Operations performed on personal
data: manual or automated
The General Data Protection
Regulation protects “individuals with
regard to the processing of personal
data and on the free movement of
such data”
• consultation,
• use,
• disclosure by
transmission,
• dissemination,
• alignment or
combination,
• blocking,
• erasure or destruction
• collection,
• recording,
• organization,
• storage,
• retadaptation or
alteration,
• rieval,

5. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 4
Territorial Scope of the GDPR
Territorial scope:
1. European Union:
2. European Economic Area:
3. Switserland:
4. “Other” countries:
5. UK & the Brexit?

6. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 5
Legal basis for Processing?
Lawfulness of processing?
• Consent
• Necessary for the performance of a contract
• Necessary for compliance with a legal obligation
• Necessary to protect vital interests
• Necessary for the performance of a task carried
out in the public interest;
• Necessary for the purposes of the legitimate
interests
Consent
VitalInterests

7. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 6
Consent
Freely-Given
Specific
Informed
Provide
Evidence
Easy
Accessible
Form
Distinguishable
Right
to
Withdraw
Affirmative
action

8. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 7
Processing principles
Purpose
Limitation
Data Minimization Accuracy
Storage
Limitation
Integrity
and
Confidentiality
Accountability Transparency
Fairness
Lawfulness

9. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 8
Controller and Processors
Data Controller
Data ProcessorData Subject
Supervisory
Authority
Supervisory
Authority
EU Directive
GDPR
EU Directive
GDPR

10. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 9
Data Protection Officer?
KNOWLEDGE MULTIPLE ENTITIES
PROFESSIONAL DUTIES
REGISTERED & SPOCDPO REQUIRED?
Position of the DPO

11. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 10
Privacy by Design / Default
When?
• When determination of the means for
processing
• When processing itself
What?
• technical and organizational
measures
• implement data protection principles
• integrate the necessary safeguards
(compliance + data subject rights)
Privacy by Design
When?
• Always
What?
• technical and organizational
measures
• only personal data is processed
which are necessary for each
specific purpose
• Such as:
 amount of data collected
 extent of their processing
 period of their storage
 accessibility
Privacy by Default
1 2

12. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 11
Data Controller
Data Processor
Identify Document Analyse Report
Identify Notify Analyse
72h
Data Breach Reporting

13. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 12
Rights of the Data Subject – Existing
Information Access to
Data
Right to
Rectification
Right to
Object

14. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 13
Rights of the Data Subject – New
Right to be forgotten Data Portability
Right to restriction of
processing

15. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 14
The 2-tiered system for penalties
10MIOEURor2%*
20MIOEURor4%*
Infringement of the
basic processing
conditions for consent
Infringement of the
data subject’s rights:
transparency,
information, access,
right to be
forgotten,…)
Infringement of
personal data transfer
modalities
Non-compliance with
member state laws
Non-compliance with
temporary or definite
suspension of
processing
Etc.
Obligations with regard
to consent (incl.
Children's data)
Privacy by Design /
Default (+ PIA)
Infringement of the
processor’s obligations
on protecting the data
Records of processing
activities (retention
schedules, contact
details of the
processor,
documentation of
safeguards, etc.)
Implementing security
safeguards
Personal data
breaches
Data Protection Officer
Etc.²

16. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 15
Cross-border transfer of personal data
 Company in EU
 Server in EU
 Server in USA
 Maintenance in 3rd country

17. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 16
What do we see?

18. © 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ. All rights reserved. 17
Turning compliance into competitive advantage
Prioritising your employees’ and
customers’ privacy and branding
your organisation accordingly can
create a competitive advantage.
Brand your
organisation
Managing privacy risks will build
trust from customers, citizens and
politicians
Build trust
A transparent privacy approach will
enhance customers’ willingness
to consent.
Enhance customers’
willingness
Adhering to compliance
requirements you will be
controlling legal liability and
reducing the risk of sanctions.
Control legal liability
Decreasing privacy and security
risks will decrease risks of
reputational, brand or business
relationship damages.
Decrease risks
Aligning your compliance efforts
with existing or planned process or
technology changes and projects
will decrease the cost of these.
Decrease
cost

19. klaw.be
Effective. Proactive. Creative.
More than a law firm.
© 2017 Kratos Law, a Belgian civ. CVBA/SCRL civ.
All rights reserved.
Kratos Law civ. CVBA/SCRL civ. has entered into a cost
association with KPMG Tax Advisers civ. CVBA/SCRL civ.
Tim Fransen
Senior counsel
K law
tfransen@klaw.be
02/708.36.28