The EU’s General Data Protection Regulation (GDPR)

Data protected by the GDPR

The GDPR protects the personal data of individuals in the EU. Personal data is defined as: “any information relating to an identified or identifiable natural person (‘data subject’).” An identifiable person is one who can be identified, directly or indirectly, through an identifier such as:

• Name
• Identification number
• Location data
• Online identifier
• Physical, physiological, genetic, mental, economic, cultural, or social identity

Information collected from a data subject can constitute personal data regardless of whether the business collecting it uses the data to identify individual users. The GDPR identifies additional special categorizations of personal data that must be collected and processed in compliance with the law: sensitive personal data, personally identifiable information (PII), and pseudonymized data.

Generally, the stricter requirements on the processing of these special categories of personal data can be satisfied in instances where the data subject has given consent, or when the data processing is necessary for carrying out legal obligations, matters of law, or the public interest, or for protecting the vital interests of the data subject. For example, a health or pharmaceutical company would need to provide statutory justification before using a data subject’s health data for a medical diagnosis or preventive care.

Sensitive personal data

Under the GDPR, certain personal data is considered “sensitive” and is subject to specific processing conditions. Examples of sensitive personal data include:

• Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership
• Genetic data
• Biometric data processed for the purpose of identifying a person
• Health-related data
• Data concerning a person’s sex life or sexual orientation

Personally identifiable information (PII)

Also protected under the GDPR, PII can overlap with sensitive personal data. However, this kind of data might not always be sensitive by nature, such as a person’s postal code or birthday.

Pseudonymized data

Although pseudonymized data is meant to conceal identity, it is considered personal data and is protected under the GDPR since the process can be reversed and information can be traced back to a data subject.

GDPR’s seven principles of data usage

Companies collecting or processing data of individuals in the EU must follow the GDPR’s seven main data protection principles:

1. Lawfulness, fairness, and transparency

Personal data must be processed in a lawful, fair, and transparent manner.

2. Purpose limitation

Personal data must be used for legitimate purposes that are explicitly spelled out to a data subject when their information is collected.

3. Data minimization

Personal data collection should be limited to what is necessary.

4. Accuracy

Personal data must be updated and accurately kept.

5. Storage limitation

Personal data can be stored only for no longer than necessary.

6. Integrity and confidentiality

Personal data must be processed using security measures, like encryption, to ensure integrity and confidentiality.

7. Accountability

The person in charge of processing personal data must be held accountable for complying with GDPR.

GDPR rights of data subjects

A key difference between the GDPR and many other consumer data privacy laws around the world is that it gives data subjects specific, legally enforceable rights concerning their personal data:

Right to be informed

Data subjects have the right to receive certain information about the collection and processing of their personal data.

Right to access

Data subjects have the right to obtain and review personal data that has been collected and generally do so free of charge.

Right to rectify

Data subjects have the right to correct any incorrect information about them swiftly, clearly, and without undue delay.

Right to erasure or be forgotten

Data subjects have the right to delete personal data (subject to certain exceptions) if, for example, holding data is no longer necessary to the purpose for which it was collected, data has been unlawfully processed, or the data subject is exercising their right to object to processing.

Right to object

Data subjects have the right to object to the use of personal data for direct marketing use, scientific research, or historical research.

Right to restrict processing

Data subjects have the right to stop the processing of personal data and to require a notice lifting the restriction and permission for any future use of that data.

Right to data portability

Data subjects have the right to obtain their personal data for the purpose of sharing it from one service provider to another through a safe and secure transfer process.

Who must comply with the GDPR?

The GDPR applies to organizations that process the personal data of individuals in the EU, even if the organization operates from an establishment outside of the EU. For example, a U.S.-based web developer that targets businesses in the EU must comply with the GDPR.

However, there are exceptions:

• If an EU citizen is living abroad in a non-EU country, then their data rights are governed by the laws of the country where they are located.
• The regulation doesn’t apply to the “processing of personal data for purely personal or household activity.” As an example, if a person collects emails for a personal book club, encryption isn’t needed as it would be under typical GDPR requirements for commercial data collection purposes.
• If an organization has fewer than 250 employees and their processing of user data isn’t a risk to the data subject, GDPR requirements don’t apply.

What happens if you violate GDPR requirements?

Penalties for noncompliance with the GDPR are imposed by EU data protection authorities. If a business infringes on multiple provisions of the GDPR, it will be fined according to the most serious offense, as opposed to being penalized for each provision.

Businesses that violate the law can be fined up to €20 million, or 4% of their worldwide annual revenue for the prior financial year, whichever is higher. Member state data protection authorities also can issue sanctions, such as bans on data processing or public reprimands. The public sector isn’t exempt.