General Data Protection Regulation: Difference between revisions

Revision as of 14:09, 3 January 2013

Revision as of 14:18, 3 January 2013

Line 10:

The proposal for the European Data Protection Regulation contains the following key changes: <ref>[http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf Proposal for the EU General Data Protection Regulation]. European Commission. 25 January 2012. Retrieved 03 January 2013.</ref>

=== Scope ===

The regulation applies if the data controller or processor (companyorganization) is in the EU or the data subject (person) is based in the EU. UnlikeFurthermore (and unlike the current Directive) the Regulation also applies to companies based outside the European Union if they process personal data of EU citizen. According to the European Commission "personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address." <ref>[http://europa.eu/rapid/press-release_IP-12-46_en.htm?locale=en European Commission’s press release announcing the proposed comprehensive reform of data protection rules]. 25 January 2012. Retrieved 03 January 2013.</ref>

=== Single Set of Rules ===

One single set of rules applies to all EU member states and there will be one '''Single Data Protection Authority (DPA)''' responsible for each company depending on where the Company is based or which DPA it chooses. A European Data Protection Board will coordinate the DPAs.

Line 16:

The notice requirements remain and are expanded. They must include the retention time for personal data and contact information for data controller and data protection officer has to be provided.

[[Privacy by Design|'''Privacy by Design''']] and by Default (Article 23) require that data protection is designed into the development of business processes for products and services

privacy settings are set at a high level by default.<br />

'''Data Protection Impact Assessments''' (Article 33) have to be conducted when specific risks occur to the rights and freedoms of data subjects. Risk assessment and mitigation is required and an prior approval of the DPA for high risks. '''Data Protection Officers''' (Articles 35-37) are to ensure compliance within organizations. They have to be appointed for all public authorities and for enterprises with more than 250 employees.

of the DPA for high risks.<br/>

Data Protection Officers (Articles 35-37) are to ensure compliance within organizations. They have to be appointed for all public authorities and for enterprises with more than 250 employees.

=== Consent ===

Valid consent must be explicit for data collected and purposes data used (Article 7; defined in Article 4). Consent for children under 13 must be given by child’s parent or custodian, and should be verifiable (Article 8). Data controllers must be able to prove “consent” (opt-in) and consent may be withdrawn. <ref>[https://www.privacyassociation.org/media/presentations/A12_EU_DP_Regulation_PPT.pdf "How the Proposed EU Data Protection Regulation Is Creating a Ripple Effect Worldwide"]. Judy Schmitt, Florian Stahl. 11 October 2012. Retrieved 03 January 2013.</ref>

Text

=== Data breaches ===
(Articles 31, 32)

Text

=== Fines ===

Text