The General Data Protection Regulation (GDPR) is a new data privacy and security law in Europe that comes into force next year, but does GDPR apply to American companies? As many U.S. companies have recently discovered, not only does GDPR apply to American companies, doing business within the EU is likely to be extremely costly for companies that do not comply with GDPR.
Any organization or individual that does business within any of the 28 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Romania, Slovakia, Spain, Sweden and the United Kingdom) must comply with GDPR or face heavy penalties.
The penalty for non-compliance with GDPR for enterprises is up to 20,000,000 Euros ($23,138,200) or 4% of the annual global turnover of the company for the previous fiscal year, whichever is the greatest. An enterprise found not to have complied with GDPR will also be subjected to regular, periodic data protection audits to ensure its policies and procedures are updated and the firm continues to comply with GDPR.
So, what is the regulation and how does GDPR apply to American companies? What do U.S firms need to do to comply with GDPR?
How Does GDPR Apply to American Companies?
The main purpose of GDPR is to give EU citizens greater control over how their personal data is collected, protected and used. While the legislation applies to EU companies, it also applies to any company that chooses to do business in the EU. That includes any online business that owns a website that is accessible by EU citizens if that website collects user data.
Since the definition of personal information includes online identifiers such as cookies, GDPR has implications for huge numbers of U.S businesses. GDPR applies to all companies that do business with persons based in EU member states, with the exception of law enforcement agencies or when data are collected for national security activities.
To continue to do business in the EU, most companies will have to implement additional privacy protections and adopt end-to-end data protection strategies.
The EU classes personal data as “Any information relating to an identified or identifiable natural person,” which includes a wide range of information from names, addresses, telephone numbers and email addresses to bank information and credit card details, photos, posts on social media websites, medical information, and even an individuals IP address.
Even when controls have been implemented to keep data secure, it may still be necessary to overhaul systems to ensure sufficient protections are in place. Companies must be aware where data are stored and employees must be trained to ensure they are aware of their responsibilities with regards to the use of data.
Organizations will need to provide customers – and website visitors – with detailed information on data that are collected and how data will be used. Consent must be obtained before any data are collected and consent must be obtained from a parent or custodian of a minor.
There must be a legitimate and lawful reason for collecting data and limited to the minimum necessary information for the purpose for which data are collected. Data must be deleted when that purpose has been achieved.
Organizations must appoint a Data Protection Officer who is knowledgeable about GDPR and will oversee compliance if their core activities are data collection, storage or data processing. That individual must also have a thorough understanding of the company’s organizational and technical infrastructure.
Organizations also need to implement appropriate policies, procedures and technologies to ensure that the data of EU citizens can be permanently erased. GDPR includes the right to be forgotten – termed ‘Right to Erasure’.
The legislation that GDPR replaces only required data to be deleted when it caused substantial damage or distress. However, from next year, an EU citizen can request that all data collected on them be permanently deleted if the information is no longer needed for the purpose that it was originally collected. Data must also be deleted if consent to use the data is withdrawn or if the processing of data is unlawful and breaches GDPR.
Many U.S. companies already have technologies in place that will comply with the data protection requirements of GDPR, but the right to erasure requirement could pose problems.
Symantec recently conducted a survey that revealed 9 out of 10 businesses were concerned that they would not be able to comply with the right to erasure requirement of GDPR, with only 4 out of 10 businesses already having a system in place that could potentially allow all data to be deleted.
Compliance with GDPR in the United States
A recent survey conducted by PricewaterhouseCoopers on large multinational companies in the United States shows efforts are already underway to ensure compliance with the EU regulation. More than half of surveyed firms said GDPR is now their main data protection priority, with 92% saying compliance with GDPR is a top priority this year. The cost of compliance is considerable. 77% of surveyed firms said they are planning to spend more than $1 million on GDPR compliance, with one of the main spending priorities being improving their information security defenses.
Many companies are starting to ask how how does GDPR apply to American companies, but a study conducted by NTT Security suggests that three quarters of U.S. businesses are ignoring GDPR because they do not believe the regulation applies to them. Ignorance could prove very costly indeed. Further, time is running out. For many companies, compliance with GDPR will not be a quick process and the deadline is fast approaching. GDPR comes into effect on May 25, 2018. Miss the deadline and fines await.
Further Reading: Read a more detailed explanation of the GDPR regulations for US companies here.