Yearly Archives: 2021

Over the years, the internet has changed the way we communicate and how we handle day-to-day tasks. There are so many things that we can do via the internet, from sharing documents to paying our bills. All of these are convenient, but these tasks require us to enter personal details.

With so much information that we share online, how can you guarantee that your information will be kept safe? Have you ever wondered what happened to the information you share online, like your bank details, addresses, contacts, etc.

Companies say that they collect this information to serve you better to provide you with more targeted and relevant communication. In turn, you get better customer experience in the end.

The question is, what do they do with that data?

That’s where the GDPR comes in.

The General Data Protection Regulation (GDPR) took effect on May 25, 2018 and many companies have taken steps to comply with it; otherwise, they could face fines and other consequences. But what is GDPR and what are the companies that are strongly affected by this change? 

GDPR Compliance: What is it? 

GDPR is the set of rules designed for EU individuals that allow them to have more control over their data. The main goal of this regulation is to make the digital environment simple so that businesses and their customers in the EU can benefit from a digital economy, yet still protect individual privacy. 

The GDPR applies to all companies that sell to the EU, store personal information about EU residents, including EU B2B personal information collected from companies on other continents. 

Which Companies are Affected by GPDR?

As mentioned, companies that sell to the EU, store personal information about EU residents, and have customers in the EU are affected by this.

In addition, GDPR applies to all companies established in the EU, regardless of where their data processing takes place. In fact, even non-EU established companies will be subject to GDPR, as long as the business offers goods and/or services to EU citizens. Therefore, this puts consumers from the EU in the driver’s seat, and businesses must comply with the regulation.

Here are some of the industries that are most hit by GDPR: 

Social Media

Ever since GDPR took effect, social media users have noticed changes in the privacy policies of social platforms they frequent, and they were notified of these changes via email. The reason behind these changes is the GDPR and other privacy laws. 

Companies in the social media marketing industry are one of the most affected by this new regulation. Therefore, social media marketers must disclose and ensure that users know how their data are being used. 

In addition to that, they need to request full consent from users to use their data outside of what is strictly necessary to provide the social media information society services. 

There are also other strict rules that GDPR expects social media companies to do, such as: 

• Users have the right to be forgotten, which means that users now have the right to delete all their data. 
• Companies that collect information directly from users must inform users within 72 hours after a data or security breach is detected. 
• Plain language must be used in all privacy policies and explanations regarding users’ data. 

Despite this drastic change in the social media industry, users can highly benefit from this shift in data privacy rights. 

Online Retail

GDPR has become a challenge for online retail companies as it urges them to make changes that make many brands rethink their strategies. Due to GDPR restrictions, like limitations with the use of third-party information, or limitations on sharing of user information to third parties, it has become a challenge for online retailers to thrive. 

However, these changes have its advantages as well because it puts online retailers on better standing with consumers. This will help them build a more trustworthy relationship with consumers today, which is crucial in today’s digital environment. 

Digital Banking

Undeniably, the effects of GDPR to financial services are significant. GDPR has made the privacy of users their primary concern. The main principle of GPDR is “incorporating privacy and data protection” considerations into all sectors that use personal information, which is critical for the digital banking industry. 

Although GPDR encourages best practice and data compliance, it comes with a side effect. Digital bank owners see the new regulation as costly and can affect their projects further. Therefore, many have their reservations that lead to them to be hesitant to invest because they fear they would get it all wrong. 

However, there are many benefits when digital banks comply with data privacy law. For one, it will provide them with more opportunities for innovation and investment because it’s more than regulatory compliances. In fact, it’s a profitable strategy in which bank owners can make bolder decisions and enter new territories due to the integration of data protection into core development strategies. 

Secondly, GPDR compliance allows digital bank owners to more ethically handle data—a huge advantage in the industry. 

Finally, GPDR provides digital defense by considering internal and vendor security, and reinforcing good data handling processes that banks can follow should there be a security breach. 

Cloud Computing

Cloud computing companies are also affected by GPDR, due to the sensitivity of customers’ information in the cloud. Since cloud service providers host various types of data, they often deal with sensitive and classified information, which could fall under the wrong hands.

Another challenge is the externalization of privacy because businesses that get a cloud service expect privacy agreements and commitments that they shared with their customers and staff will still work. However, if the cloud service provider operates in various locations, the rights of data owners may be subject to different regulations and requirements. Therefore, it’s advisable to have a customized agreement with a cloud computing company when it comes to privacy commitments. 

In a Nutshell

It’s been years since GPDR came into effect. Today, it still remains as a rigorous compliance process. However, GPDR has brought many opportunities that can improve strategies and deliver more innovation in the market. 

Even if you’re not in any of the industries listed above, as long as you operate a business that sells products online to EU individuals, you need to consider GPDR -compliance; otherwise, you could risk facing hefty fines or lose customers.

So, if you’re unsure whether your company is GPDR compliant, contact someone with GDPR experience to assess your GDPR compliance.

The General Data Protection Regulation (GDPR) is the most detailed data privacy legislation that Europe has ever passed. It took effect on May 25, 2018, and flipped the digital landscape.

In this legislation, all individuals and institutions in Europe are bound to GDPR compliance in protecting the personal information of its clients. The European Union created this regulation to ensure that the personal privacy rights of European citizens are protected at the EU level GDPR requirements create a uniform system of rules for data processing activities.

This article will further discuss the scopes and limitations of GDPR as it is applied to the US and its citizens.

United States (US) Inclusion to GDPR

While it is based on European Union (EU) legislation, this ground-breaking data security and privacy regulation extends significantly beyond the EU’s and the European Economic Area’s geographical borders (EEA). In some areas, it encompasses the United States of America, the EU’s second largest trade partner.

The GDPR’s entire purpose is to safeguard the personal data of EU citizens and residents. As a result, the legislation extends to entities that manage certain data regardless of whether they are in the EU, a concept recognized as an “extra-territorial effect.”

As specified in Article 3 of the GDPR, the law’s geographical reach is not limited to businesses in the EU/EEA. The legislation extends the GDPR’s processing rules to businesses based outside of the

EU/EEA if the following two requirements are met:

• Provides goods or services to EU/EEA citizens (even in the absence of commercial transactions); or
• Controls or tracks the activities of consumers inside the EU/EEA.

Therefore, organizations in the USA and other countries worldwide are covered under this regulation as long as they meet one of the above-mentioned conditions.

If a US business is required to comply with the GDPR requirements, it has the same stringent conditions as businesses based in the EU.

The GDPR regulates personal data processing activities in a variety of ways. Personal data can include identities, contact numbers, computer details (e.g., IP addresses, position data), biometric data, images, and videos.

US Citizens Inclusion to GDPR

Does GDPR apply to US residents? It’s perplexing to think about what occurs when Americans enter a country in the European Union considering the EU’s General Data Protection Regulation (GDPR). Does this legislation cover them?

Since the GDPR is a European Union law, it is easy to think that it just refers to all citizens of the Union. That is not entirely the case. Citizenship has little bearing on the GDPR’s geographical scope, and the GDPR never uses the terms “citizens” or “residents.” Instead, the GDPR simply refers to data subjects “in the Union,” with data subjects defined as “an identified or identifiable natural person.”

GDPR is not expressly concerned with an individual’s status as an EU resident. GDPR protects someone who lives in or visits an EU region. If an American travels to France, make a transaction in a shop, and are asked to include their name and address on an invoice, the shop must protect their information per GDPR requirements. They must be granted the same GDPR privileges and freedoms as all EU residents.

Individuals are granted certain privileges and liberties under the GDPR. The legislation imposes some restrictions on how businesses can use the personal details. It makes no difference where the business is located or has an office in any EU country. The regulations of GDPR exist whether a company collects or handles the personal data in the Union.

There is currently no law in the United States that protects the privacy of all citizens, only select categories of people, or industries. The Health Insurance Portability and Accountability Act (HIPAA), for example, establishes security measures to safeguard the privacy of patients and health plan members. It is applicable only with confidential health information gathered, processed, used, or transmitted by a HIPAA-covered body.

GDPR compliance will be easier for HIPAA-covered organizations if they apply the same standards in protecting all concerned individuals and their records. Adopting a more holistic approach to data security is more important to meet the GDPR requirements.

Relationship Between Location and Citizenship

The GDPR is location-based, not citizenship-based. The distinction between citizenship and place exists when we discuss non-EU people residing in the EU versus EU citizens residing beyond the EU, or when the good or service is provided inside or outside the boundaries of the EU.

Recital 14 of the GDPR notes that “This Regulation shall extend to all natural persons, regardless of their ethnicity or place of residence, concerning the collection of their personal details.” Below are example scenarios where GDPR can be applied:

Scenario 1:

A US citizen is on holiday in Germany. He places an online order for dinner from a Berlin restaurant and delivers it to the hotel where he is staying.

The GDPR legislation applies to this scenario since the ‘data subject’ (US citizen) is in an EU country and is supplying personal data for a good or service in the EU. The citizenry of the data subject is not significant.

Scenario 2:

A US citizen residing in Spain visits the website of a US clothing retailer and places an order for a dress, specifying her EU delivery address. The US clothing retailer advertises that it sells to Spain and offers the dress for sale in Euros.

The GDPR applies since the (i) data subject is currently residing in the EU, (ii) orders using an EU address  and (iii) the US clothing retailer offers its goods to individuals in the EU. In this scenario, both the citizenship of the data subject and the store’s location are not significant.

Conclusion

GDPR plays an important role because it strengthens the security of European data subjects’ rights and clarifies the obligations of businesses who handle personal data to respect these rights.

The GDPR requirements center on the data processing activities, not citizenship, it includes personal data and information gathered from any EU country and includes either an EU or non-EU resident who is living or visiting an EU.

Any US business or company serving customers in the EU/EEA — or tracks their behaviour within this region — should consider GDPR compliance. The legislation protects US citizens who use their information abroad in the EU.

GDPR compliance comes with strict measures to penalize non-compliant businesses and organization if they fail to meet the GDPR requirements. giving this legislation a fang to regulate and protect EU data privacy values against violators.