The document discusses the General Data Protection Regulation (GDPR) which replaces the Data Protection Act and has been in effect since May 25, 2018. It maintains eight data protection principles while introducing new responsibilities and liabilities for marketers, including mandatory opt-in consent and reporting of data breaches. Additionally, it requires comprehensive record-keeping and data protection measures to be integrated into processing activities.

1. The Letter of the
Law
Raoul Lumb

2. THE LETTER OF THE LAW
BY RAOUL LUMB

3. THE WHAT?
• The “General Data Protection Regulation”
• European Regulation – replacing the Data Protection Act
• Does not replace the PECR (Privacy & Electronic
Communications Regulations)
• Implementation 25 May 2018

4. HOW DOES IT WORK?
• Maintains the eight Data Protection Principles:
• “Fair and Lawful” (the ‘conditions’ for processing)
• “Purposes”
• “Adequacy”
• “Accuracy”
• “Retention”
• “Rights” of data subjects
• “Security”
• “International Processing”
• Adds significant new fines (4% global turnover or €20 million)
• Adds extensive new duties

5. WHAT ARE THE IMPLICATIONS FOR
MARKETEERS?
• E-mail, Text, Telephone marketing – new standard of ‘consent’
• Opt-in now obligatory
• Opt-in must be voluntary
• Consideration of Principle 2 in all circumstances
• Data Processors (i.e. marketeers) can now be held liable per
Article 82
• Much of the risk can be mitigated by effective contracts

6. STORAGE OF RECORDS
• Duty to build in data protection by “Design & Default”
• Consideration to be given to ‘pseudonymisation’
• Need to be able to respond to subject access requests:
• How was data obtained? For what purpose? When?
• Need to be able to respond to new stop/update/erasure
requests
• Reporting of breaches now essentially mandatory within 72
hours

7. REPORTING AND RECORD KEEPING
• Boring but important – new records of processing must be kept
• Consider mapping ‘data-flows’
• All contracts appointing/engaging as a Data Processors must
meet new requirements
• Impact assessments to be performed before any significant
new processing
• Encryption to be seriously considered