The agency management tool,
Firms and ESNs

The General Data Protection Act (GDPR) will replace the 1995 Data Protection Directive.

The GDPR regulates the processing of personal data about individuals in the EU, including its acquisition, storage, transfer or use. It is important to note that under the GDPR, the concept of “personal data” is very broad and covers any information relating to an identified or identifiable person (also called a “data subject”). It gives data subjects more rights and control over their data by regulating how companies must process and store the personal data they collect. The GDPR also raises the stakes for compliance by increasing enforcement and imposing higher fines if the provisions of the GDPR are not met. The GDPR strengthens the privacy rights of EU citizens and imposes significantly stricter obligations on organisations that process data. In short, here are some of the main changes that will come into effect with the GDPR:

Extended rights for individuals:
The GDPR provides extended rights for individuals in the EU by granting them, among other things, the right to be forgotten and the right to request a copy of any personal data stored about them.

Compliance obligations:
The GDPR requires organisations to implement appropriate security policies and protocols, conduct privacy impact assessments, maintain detailed records of data activities and establish written agreements with suppliers.

Data breach notification and security:
The GDPR requires organisations to report certain data breaches to data protection authorities and, in certain circumstances, to data subjects. Le GDPR impose également des exigences supplémentaires en matière de sécurité aux organisations.

New profiling and monitoring requirements:
The GDPR imposes supplementary obligations on organisations engaged in profiling or monitoring the behaviour of individuals in the EU.

Strengthening law enforcement:
Under the GDPR, authorities can issue fines up to €20 million or 4% of a company’s annual global turnover, depending on the extent of the breach and the damage suffered. Furthermore, the GDPR provides a central point of enforcement for organisations with operations in multiple EU Member States by requiring companies to work with a lead supervisory authority for cross-border data protection issues.

If you are a business located outside the EU, you should still consider this. The provisions of the GDPR apply to any organisation that processes personal data about individuals in the EU, including monitoring their online activities, whether or not the organisation has a physical presence in the EU.