The GDPR will have a significant impact on the media industry. It expands the definition of personal data, applies globally if targeting or monitoring EU individuals, increases penalties for noncompliance up to 4% of revenue, and makes using personal data harder commercially. While compliance will be easier for companies with direct user relationships, preparation is needed as the GDPR takes effect in May 2018 and a new ePrivacy law is also proposed to align with its strict consent standards.

1. GDPR IS HERE: WHAT THE MEDIA INDUSTRY NEEDS TO KNOW
ABOUT THE NEW REGULATORY LANDSCAPE
Nick Stringer – Public Policy Consultant
Pubmatic Ad Revenue Forum - 5 October 2017

2. “The EU provides the right to have your
personal data protected by strong, European
laws…because in Europe privacy matters.”
- Jean-Claude Juncker, President of the European Commission
Brussels, 14 September 2016

3. EU General Data Protection Regulation (GDPR): Quick Overview
• An overhaul of existing EU data protection laws, aiming to:
 Update the legal framework to reflect today’s digital world;
 Give people greater control over their personal data; and
 Streamline the rules across EU markets – facilitating commerce
throughout the EU ‘single market’.
• A ‘Regulation’ to apply directly in all EU markets from 25 May 2018.
• Existing ePrivacy Directive (aka ‘cookie law’) remains in place but a
new legislative proposal is currently being discussed in Brussels.

4. But what does it mean in practice?
1.
The new law has a broader definition of personal data -
pulling more digital advertising data into the
‘regulatory net’.

5. But what does it mean in practice?
2.
The new law will have a global impact.
It will apply if an organisation – regardless of its location - is
targeting content / services directly at individuals in EU and
/ or ‘monitoring’ their behaviour.

6. But what does it mean in practice?
3.
The new law ramps up the penalties for breaches or non-
compliance:
A maximum of €20m or 4% of annual global turnover.

7. But what does it mean in practice?
4.
The new law will make the use of personal data (especially
3rd party data) harder to leverage commercially.

8. But what does it mean in practice?
5.
Organisations with a direct relationship with the user will
find compliance easier.
So is the GDPR therefore also an opportunity?

9. Are things going to get tougher? A New ‘Cookie Law’
• The European Commission published a new proposal in January to replace the
existing ePrivacy Directive & align it with GDPR.
• In a nutshell, the proposal:
 Introduces a stringent consent standard for all electronic communications
data;
 Seeks to move away from a publisher site notice approach to a browser
settings one (i.e. DNT);
 Will apply directly in all EU markets (‘Regulation’); and
 Has the same territorial scope and similar penalties as the GDPR.
• The European Commission aims to have a new law in place by May 2018.
• Proposal confuses landscape but don’t let this distract from preparing for
GDPR!

10. “Brexit should not mean Brexit when it comes
to standards in data protection”
– Elizabeth Denham, UK Information Commissioner
London, 29 September 2016

11. Thanks!
@nickstringer
nick@njstringer.com