Blog » THE COUNTDOWN TO EU DATA PROTECTION REGULATION HAS BEGUN
THE COUNTDOWN TO EU DATA PROTECTION REGULATION HAS BEGUN
27 March 2017
I can imagine that when you hear the words data protection, you may not really be excited. What is worse you may skip to read this article. You probably think that when running your business, you have much bigger problems than data protection compliance. Still, I encourage you to give it 5 minutes and read through this short summary about the 5 most important impacts of the Data Protection Regulation (GDPR) on your business. The GDPR will only enter into force in May 2018 so this is the perfect time to familiarize yourself with the new rules.
Don’t let the term “EU Regulation” fool you, the GDPR catches global organisations outside the European Union, too, if they offer goods or services to EU citizens or residents. This means that if you have a company in China and you are targeting consumers in Hungary, your company will be subject to the GDPR.
To raise the stakes, not only the territorial reach has been expanded, but also the personal scope of the GDPR. Currently, the data protection is the sole responsibility of the data controller (the one who owns the data). The GDPR changes this and provides that the processor who carries out the data processing on behalf of the controller, will also be held responsible for data protection.
At the end of the day, however, the main responsibility remains by the controller as he is expected to choose a processor who provides sufficient guarantees that the processing will be in line with the GDPR.
The scariest innovation of the GDPR which will be probably attracting the attention of executives and shareholders are the fines which can be imposed for data protection infringements.
The current data protection law in Hungary allows the Data Protection Authority to impose a fine of maximum 20 Million Hungarian Forints. Additionally, the authority cannot impose fines against small and medium enterprises for the first data protection infringement.
Luckily, the GDPR does not change everything: the maximum amount of 20 Million remains. The only difference is that the currency will be Euro, not Forint. Or, in case it is higher, the maximum amount of the fine is 4 % of your annual worldwide turnover. So be careful of being a profitable business with crappy data protection. At this point of time, it is not certain whether the SMEs’ exemption from fine in case of the first infringement will remain in force or not.
When imposing fines, the authority shall consider among others the nature, gravity and duration of the infringement. In addition, the GDPR leaves to the Member States to lay down further sanctions.
K.I.S.S. – Keep it simple, stupid
You as a controller must inform and remind the consumers of their data protection related rights.
Good news for companies who like to keep it simple and bad news for lawyers who are obsessed with legal jargon: the GDPR explicitly requires that the information provided should be in clear and plain language. The information must also be transparent and easily accessible.
Furthermore, data controllers are expected to help the consumers to exercise their data protection related rights. This includes that the request of the consumer to exercise his data protection related rights can only be refused if the controller proves that he cannot identify the consumer.
Data protection officer
The role of data protection officers is not entirely unfamiliar for Hungarian companies. Currently, employing a data protection officer is obligatory only in certain sectors, for example in case of financial institutions or electronic communication service providers. Small and medium enterprises are exempt from employing a data protection officer regardless of their activity.
The GDPR again brings changes concerning data protection officers. Both data controllers and data processors shall designate a data protection officer if their activity requires regular and systematic monitoring of data subjects or if they process special categories of data (eg. data concerning health). SMEs remain exempt from this obligation except they are processing sensitive data.
The data protection officer will need sufficient expert knowledge and he shall either be employed at the company or work under a service contract.
Recording & impact assessment
As a new obligation, data controllers need to maintain a record of data processing activities. The record shall include the categories of recipients to whom personal data will be disclosed. For example, in case you send the personal data of your employees to your lawyer for contract drafting or to your accountant who does the payroll, this needs to be included in your record.
Again, SMEs are not obliged to keep records, except the processing is not occasional or sensitive data is concerned.
Another important innovation is the so called data protection impact assessment. In case the data processing is likely to result in a high risk to the rights of natural persons, the data controller shall prior to the processing carry out an assessment of the impact of processing operations on the protection of personal data.
As you can see a lot of big changes are coming, thus it is worth to start re-examining your procedures and processes to ensure compliance with the GDPR. In our following article we will give you useful tips how you can be prepared when the GDPR will enter into force next year.
ILF CONFERENCE IN MILAN – PRESENTATION - TAKEAWAYS FROM FIRST GDPR PENALTIES
This May we participated in the European Conference of International Law Firms in Milan, where our managing partner Richard Schmidt held a presentation to members of ILF on recent developments of European Data Protection Law. The presentation focused on the lessons learnt from the first GDPR fines imposed by the national data protection authorities of various European jurisdictions in the 1st year of GDPR.Read more »
CAN YOU PAY MORE FOR THE SAME WORK IN HUNGARY? - FRESH DECISION OF THE CURIA
Are you negotiating on salary with a new colleague in Hungary? Even if salary is subject to free negotiation, a higher salary for the same work can cause a tension in wage levels. In our short article we summarize the fresh decision of the Curia which can serve as a compass in relation with the applicability of the equal pay principle.Read more »
CONSTRUCTION TRUSTEESHIP IN HUNGARY – SCOPE AND GENERAL PROVISIONS
Collateral management is a key issue in every construction project. In Hungary a special regime, the so-called construction trusteeship protects the interest of the participants of major private construction projects, and secures that contractors and subcontractors receive their remuneration for the work performed.Read more »