EU's General Data Protection Regulation (GDPR)

An EU's General Data Protection Regulation (GDPR) is a EU data privacy and security law that regulates how organizations must protect the personal data and privacy of individuals within the European Union and the European Economic Area.

• Context:
  • It can (typically) require organizations to adhere to strict data protection principles, including lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, and integrity and confidentiality. This is:
    • It can have a Purpose Limitation Data Privacy Principle.
    • It can have a Data minimization Data Privacy Principle.
    • It can have an Accuracy Data Privacy Principle.
    • It can have a Storage Limitation Data Privacy Principle.
    • It can have an Integrity Data Privacy Principle, and a Confidentiality Data Privacy Principle.
    • It can have an Accountability Data Privacy Principle.
  • It can (typically) grant individuals several rights over their data, including the right to access, rectify, delete, or restrict the processing of their personal data.
  • It can (typically) necessitate that data controllers and processors implement appropriate technical and organizational measures to ensure and demonstrate compliance with the regulation.
  • It can (typically) mandate the appointment of a Data Protection Officer (DPO) under certain conditions.
  • It can (typically) impose hefty fines for non-compliance, with penalties reaching up to €20 million or 4% of the organization's global turnover, whichever is higher.
  • ...
• Example(s):
  • Data Consent,
  • Right to be Forgotten,
  • Data Breach Notification,
  • ...
• Counter-Example(s):
  • California Consumer Privacy Act (CCPA),
  • Children's Online Privacy Protection Act (COPPA),
  • Federal Information Security Management Act (FISMA),
  • Electronic Communications Privacy Act (ECPA).
  • China's Personal Information Protection Law (PIPL).
  • Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
  • EU's Artificial Intelligence Act (AIA).
• See: Privacy Law, Directive 95/46/EC, Directive (European Union), Data Protection Directive, Regulation (European Union), European Union, Privacy by Design, Data Protection Impact Assessment, Information Commissioner's Office, Data Protection Officer, Personal Data, Data Controller, Data Processor, European Union.

---

---

---

References

2024

• (ChatGPT-OpenAI, 2024) ⇒ Prompt: Summarize the concept General Data Protection Regulation (GDPR) in 1- 2 paragraphs. ChatGPT (model:gpt-4-turbo-preview). Retrieved: 2024-03-24.
  • QUOTE: The General Data Protection Regulation (GDPR) is a landmark piece of legislation enacted by the European Union (EU) on May 25, 2018, with the goal of[bolstering the protection of personal data for individuals within the EU and the European Economic Area (EEA). It seeks to give individuals greater control over their personal data while simplifying the regulatory environment for international business by unifying the regulation within the EU. Among its key provisions, the GDPR mandates that organizations must seek explicit consent from individuals before collecting, using, or sharing their data. It also enshrines the right to be forgotten, allowing individuals to have their personal data erased from a company's servers.

    GDPR compliance is mandatory for all entities, including those outside the EU, that handle the personal data of EU and EEA citizens, making its impact truly global. Non-compliance can result in severe penalties, including fines of up to 4% of a company's annual global turnover or €20 million (whichever is greater). Additionally, the regulation emphasizes the principles of data minimization, privacy by design, and privacy by default, requiring organizations to implement measures that ensure data protection throughout the lifecycle of the data. GDPR has not only reshaped the landscape of data protection regulations worldwide, inspiring similar laws in other jurisdictions, but it has also led to a more cautious and transparent approach to data management, benefitting consumers and altering how businesses approach data privacy.

2024b

• (GDPR, 2024) ⇒ https://gdpr.eu/what-is-gdpr Retrieved: 2024-03-24.
  • QUOTE: The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. The regulation was put into effect on May 25, 2018. The GDPR will levy harsh fines against those who violate its privacy and security standards, with penalties reaching into the tens of millions of euros.

2018

• (Wikipedia, 2018) ⇒ https://en.wikipedia.org/wiki/General_Data_Protection_Regulation Retrieved:2018-4-12.
  • The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union. It addresses the export of personal data outside the EU. The GDPR aims primarily to give control back to citizens and residents over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. When the GDPR takes effect, it will replace the 1995 Data Protection Directive (Directive 95/46/EC). It was adopted on 27 April 2016. It becomes enforceable from 25 May 2018, after a two-year transition period. Unlike a directive, it does not require national governments to pass any enabling legislation and so it is directly binding and applicable.

---