Menu
The General Data Protection Regulation (GDPR) is a world-leading piece of data protection and privacy legislation which applies across the European Union, and to any organization dealing with EU residents.
The GDPR sets out some key principles for controlling and processing data, and consequences for those who breach the relevant rules and principles.
The new EU AI Act adopts the same risk-based regulatory philosophy which underlies the GDPR.
As artificial intelligence (AI) continues to advance and reshape our world, the need for regulatory safeguards becomes increasingly evident. The European Union’s (EU) AI Act is a groundbreaking legislative measure that sets the stage for a global ripple effect, influencing AI regulations and standards across the globe.
In this in-depth guide, we look at how the EU AI Act works, and how it balances innovation with security and privacy concerns.
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that was adopted by the European Union (EU) in April 2016 and came into effect on May 25, 2018. It replaced the 1995 EU Data Protection Directive, representing a significant overhaul of the EU’s approach to data protection and aiming to harmonize the data protection laws across the member states.
The GDPR was designed to enhance and unify data protection rights for EU citizens, and its provisions apply to organizations both within and outside the EU that process the personal data of these citizens. In essence, it provides individuals with greater control over their personal data, ensuring that organizations treat such data with the utmost care and responsibility.
The General Data Protection Regulation (GDPR) has a broad scope of applicability that covers a wide range of entities and situations, particularly in its attempts to protect the personal data of EU citizens. Here’s a detailed explanation of who the GDPR applies to:
The GDPR applies to all organizations that are established in the European Union, regardless of where they process personal data. “Established” here refers to any effective and real activity through stable arrangements, which can be a branch, subsidiary, office, or other forms of presence in the EU.
It’s not merely about the geographic location of data processing. For instance, if a company has an office in an EU member state and makes decisions about processing personal data there, the GDPR will apply even if the actual data processing happens outside the EU.
If an organization is not established in the EU but offers goods or services (irrespective of whether a payment is required) to individuals in the EU, then the GDPR applies.
Similarly, if an organization not established in the EU monitors the behavior of EU residents (e.g., tracking online activities for advertising purposes), then it also falls under the purview of GDPR.
This is a particularly significant aspect for service providers and entities that might act as data processors. If, for example, an EU-based company outsources data processing to a service provider outside the EU, that service provider must comply with the GDPR.
Public authorities and bodies, except for courts acting in their judicial capacity, are covered by the GDPR when processing personal data in the course of their official duties.
The GDPR distinguishes between “data controllers” and “data processors”. A data controller determines the purposes and means of processing personal data, while a data processor processes the data on behalf of the controller. Both have obligations under the GDPR, but the responsibilities vary. For instance, a data controller decides what data to collect and for what purpose, while a data processor might be a cloud service provider storing that data.
The GDPR aims to protect the personal data of natural persons (living individuals) and does not extend these protections to legal persons such as companies or organizations.
It’s important to note that GDPR’s penalties for non-compliance can be severe, including significant fines. Therefore, any organization that processes the personal data of EU individuals, whether they are established in the EU or not, should thoroughly assess their GDPR obligations and ensure compliance.
The GDPR, or General Data Protection Regulation, is a transformative piece of legislation that establishes robust data protection standards. Here’s a detailed breakdown of its scope, penalties, and key provisions:
The GDPR introduced significant administrative fines for non-compliance, which can be broadly categorized into two tiers:
It’s important to note that these are the maximum fines and national Data Protection Authorities (DPAs) have the discretion to impose lesser fines based on the specific circumstances of each case.
Under the GDPR, personal data can flow freely among the Member States of the European Union, as they all follow the same rigorous data protection standards. However, transferring personal data outside the European Economic Area (EEA) requires special considerations to ensure that the level of protection guaranteed by the GDPR is not undermined.
The GDPR has a set of rules governing such transfers to ensure that the personal data of EU citizens remains protected, even when it leaves the EU/EEA borders. Here’s how transfers to non-EU countries work under the GDPR:
The European Commission has the authority to determine whether a country outside the EU/EEA offers an adequate level of data protection.
If the Commission has made an “adequacy decision” about a particular country, personal data can flow from the EU/EEA to that country without needing any further safeguard. Some countries that have received such decisions include Canada (for commercial organizations), New Zealand, and Japan.
These decisions are continuously reviewed and can be revoked if the third country no longer provides adequate protection.
If a country has not received an adequacy decision, transfers are still allowed if the data exporter has provided “appropriate safeguards”. These can include:
Given the challenges posed by certain legal systems where surveillance regimes might infringe on the rights of EU citizens, data exporters are expected to assess the context of the transfer and put in place supplementary measures, when necessary, to ensure an equivalent level of protection. These measures can be contractual, organizational, or technical.
For certain sectors or types of data processing activities, the competent supervisory authority can approve binding and enforceable instruments for data transfer.
The famous “Schrems II” ruling by the European Court of Justice in July 2020 invalidated the EU-US Privacy Shield, a major mechanism that facilitated data transfers between the EU and the US. This ruling emphasized the importance of ensuring the protection of EU citizens’ data rights even in the face of foreign surveillance laws.
Organizations that wish to transfer personal data outside the EU/EEA should always be aware of these provisions and ensure they have the necessary mechanisms in place. It’s also advisable to keep abreast of evolving regulations and jurisprudence, as the landscape of international data transfers continues to change.
The GDPR is a comprehensive data protection regulation, but there are certain activities and situations which it does not cover. Here are some examples of activities not subject to the GDPR:
It’s crucial for individuals and organizations to be aware of when the GDPR applies and when it does not. However, just because an activity might be exempt from the GDPR doesn’t mean there aren’t other data protection or privacy regulations that apply. Always check local laws and regulations in specific contexts.
The General Data Protection Regulation (GDPR) and the EU Artificial Intelligence (AI) Act are both regulatory frameworks from the European Union, aiming to ensure the protection of individual rights in the face of technological advancements. While the GDPR focuses on data protection and privacy, the AI Act zeroes in on the regulation of artificial intelligence applications and their potential risks. Here’s the connection between the two:
Any business based in the EU or doing business there needs to ensure that they are in compliance with the General Data Protection Regulation. If you would like further information on how to comply with the GDPR, get in touch and we can put you in contact with some of the top EU GDPR compliance specialists.
If a data breach poses a risk to individuals’ rights and freedoms, you must report it to the relevant data protection authority within 72 hours of becoming aware of it. In cases where the breach poses a high risk to individuals, you must also inform the affected individuals without undue delay.
Always consult with a legal or data protection expert for your specific circumstances, especially when dealing with the intricacies of the GDPR in research or other professional activities
Yes. If you are collecting or processing personal data within a GDPR-covered country, even temporarily as a visitor, that data is subject to the GDPR. If you transfer it to the U.S. or another third country, you need to ensure appropriate safeguards are in place, especially if transferring personal data.
Some notable breaches and fines under GDPR include British Airways (£20 million), Marriott International (£18.4 million), and Google (€50 million by the French regulator CNIL). For the most recent breaches and fines, you’d need to consult the websites of relevant national data protection authorities or other recent sources.
The GDPR establishes several rights for individuals: right to be informed, right of access, right to rectification, right to erasure (or “right to be forgotten”), right to restrict processing, right to data portability, right to object, and rights related to automated decision-making including profiling.
Drew is regulatory expert, specializing in AI regulation and compliance
Trust Innovate are the leading online AI compliance educators
© All Rights Reserved.