GDPR comes into effect

The General Data Protection Regulation (GDPR), the new regulatory framework of the European Union which regulates one of the neglected fields of digital economy, has come into effect today.

The majority of the main principles of the Regulation are not new, as they lean on instruments of personal data protection from the pre-web period. The new feature is that the principles are now clearly applicable to the online flow of goods and services, and the Pandora’s Box of automated data processing and so-called algorithm decision making has been opened. Also, the responsibility of people and organizations which collect and process data has been extended, the instruments and procedures of enforcing the regulations have been developed in detail, and the severe penalties may amount to up to EUR 20 million, or 4% of the annual turnover, whereby larger amounts are favored, the SHARE Foundation says in its press release.

The main goal of the Regulation is for citizens to be given back control over their data. New terms of compliance with data processing have been proscribed, and it will therefore no longer be possible to give unconditional consent, nor will agreeing to complicated policies incomprehensible to an average user be considered a valid form of consent. Citizens have also been given more power through new rights, such as the right to data transferability or the right to erasure.

Although they pertain to every kind of personal data processing, in an analogue or a digital environment, the strict provisions of the Regulation aim to primarily rein in the data economy, which is why they are projected to make the most radical impact on the internet in its history. The panic in the business sector overshadows the fact that the GDPR is one of the first regulations looking to regulate complex online relations, which have been avoiding being regulated so far, it is added.

The SHARE Foundation reminds that there will be plenty of time to adapt to the new regulation: the GDPR was adopted in 2016, whereas the two-year deadline was given so that the flow of goods and services could be harmonized with the changes. It is now time to see how justified the criticism coming from business and civil organizations is, whereas the real impact of the new Regulation will only be seen in practice.

eKapija recently wrote in detail about the new regulation.

SHARE Foundation

General Data Protection Regulation

GDPR

digital economy

personal data

personal data protection

data processing

right to data transferability

right to erasure