All posts in GDPR

Cartoon: The Post-GDPR World

Daniel Solove
Founder of TeachPrivacy

Cartoon Post-GDPR World - TeachPrivacy GDPR Training 02 meidum

This is a momentous week.  On Friday, May 25, 2018, the General Data Protection Regulation (GDPR) will begin being enforced. Organizations are racing against the clock to be prepared.  What will the day look like when the sun rises on May 25?

Continue Reading

GDPR Humor: A Collection of GDPR Cartoons and More

Daniel Solove
Founder of TeachPrivacy

GDPR Humor - TeachPrivacy GDPR Training 02

Feeling stressed out about GDPR?  I can help!  Here are all of my GDPR cartoons and attempts at GDPR humor in one post.  It’s much better to laugh than to cry . . .

 

Cartoon: The Four Phases of Developing a GDPR Program

Cartoon Four Phases of GDPR Program - TeachPrivacy GDPR Training 02 medium

 

Cartoon: GDPR Experts

Cartoon GDPR Experts - TeachPrivacy GDPR Training 02 medium
Continue Reading

Cartoon: The Four Phases of Developing a GDPR Program

Daniel Solove
Founder of TeachPrivacy

Cartoon Four Phases of GDPR Program - TeachPrivacy GDPR Training

The General Data Protection Regulation (GDPR) has actually been with us for quite a long time (in various forms), but this month is the moment of truth.  On May 25, the GDPR will start being enforced.

Here’s a quick timeline of the evolution of the GDPR:

October 1995:  Data Protection Directive (95/46/EC) is adopted.  The majority of the rules of the GDPR are the same or similar to those of the Data Protection Directive. Thus, much of the GDPR has been with us for more than 20 years.

January 2012: First Draft of GDPR is released.

March 2014: European Parliament votes to support the GDPR.

December 2015: The Trilogue (EU Commission, European Parliament, and EU Council of Ministers) reaches an agreement about the GDPR.

April 2016: European Parliament and Council of the EU formally adopt the GDPR.  There will be a 2-year grace period until the GDPR is enforced.

May 2018: GDPR enforcement begins on May 25.

Continue Reading

Prime Time for Privacy

Daniel Solove
Founder of TeachPrivacy

Prime Time for Privacy 01

Over at Bloomberg Law, I have a short essay entitled Prime Time for Privacy.  From the essay:

The GDPR is a tremendous step forward for the privacy profession, but the maturity of the profession is what makes GDPR compliance possible.

The privacy profession serves a profound societal role. This is the profession that will help shape the future of privacy and guide the development of technology in ethical ways. With the rapid growth of technology, the privacy profession is more essential than ever. This is the profession that thinks about the human consequences of technology and how to bring the dizzying uses of data under control. Privacy professionals are on the front lines of shaping the data-drenched world we’re racing to construct. This profession will affect our lives and our society in profound ways in the years to come.

Read the full essay over at Bloomberg Law.

Continue Reading

Why I Love the GDPR: 10 Reasons

Daniel Solove
Founder of TeachPrivacy

GDPR Love 01

I have a confession to make, one that is difficult to fess up to on the US side of the pond: I love the GDPR.

There, I said it. . .

In the United States, a common refrain about GDPR is that it is unreasonable, unworkable, an insane piece of legislation that doesn’t understand how the Internet works, and a dinosaur romping around in the Digital Age.

But the GDPR isn’t designed to be followed as precisely as one would build a rocket ship. It’s an aspirational law.  Although perfect compliance isn’t likely, the practical goal of the GDPR is for organizations to try hard, to get as much of the way there as possible.

The GDPR is the most profound privacy law of our generation.  Of course, it’s not perfect, but it has more packed into it than any other privacy law I’ve seen. The GDPR is quite majestic in its scope and ambition.  Rather than shy away from tough issues, rather than tiptoe cautiously, the GDPR tackles nearly everything.

Here are 10 reasons why I love the GDPR:

(1) Omnibus and Comprehensive

EU GDPRUnlike the law in the US, which is sectoral (each law focuses on specific economic sectors), the GDPR is omnibus – it sets a baseline of privacy protections for all personal data.

This baseline is important.  In the US, protection depends upon not just the type of data but the entities that hold it.  For example, HIPAA doesn’t protect all health data, only health data created or maintained by specific types of entities.  Health data people share with a health app, for example, might not be protected at all by HIPAA.  This is quite confusing to individuals.  In the EU, the baseline protections ensure that nothing falls through the cracks.

Continue Reading

Cartoon: GDPR Experts

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Experts - TeachPrivacy GDPR Training 02 medium

This cartoon makes fun of the fact that these days, there seem to be so many GDPR experts.  There are, indeed, many experts who know a lot about GDPR.  The problem is that there are a lot more “experts” out there who know only a little about GDPR.

Continue Reading

GDPR: Days Away Yet Miles to Go

Daniel Solove
Founder of TeachPrivacy

GDPR Compliance - TeachPrivacy GDPR Training 01

May 25, 2018 is just around the corner.  That’s the date when GDPR enforcement starts.  Many organizations are scrambling to address GDPR compliance. But many still don’t even know what GDPR is.  A recent survey conducted of EU citizens and EU companies reveals some interesting details about GDPR preparation and compliance on the other side of the pond.  For EU consumers, 90% believe that the GDPR is “good for consumers.”

GDPR compliance efforts by companies in the EU remain rather limited.  And I’m putting it nicely.  The survey reveals a rather low amount of knowledge about the GDPR and not enough preparation:

GDPR Survey 01

 

Continue Reading

Cartoon: GDPR Compliance

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Compliance - TeachPrivacy GDPR Training 02 medium

Organizations are racing to get ready for the GDPR implementation date of May 25, 2018.  Complete GDPR compliance in a few months is likely not feasible for many organizations, but this shouldn’t mean that these organizations should give up.  Making a good-faith effort and continuing to strive to improve are quite worthwhile.

Continue Reading

GDPR Whiteboard and GDPR Interactive Whiteboard

Daniel Solove
Founder of TeachPrivacy

GDPR Whiteboard - TeachPrivacy GDPR Training

Recently, I created two new GDPR training resources.

GDPR Whiteboard

I created a 1-page visual summary of the GDPR, which I call the GDPR WhiteboardThe idea was to capture the key points of the General Data Protection Regulation (GDPR) in a succinct and visually-engaging way.  It has become quite popular, receiving thousands of downloads.  You can download a PDF handout version here.  We’ve been licensing it to many organizations for training and awareness purposes.

GDPR Whiteboard - TeachPrivacy Privacy Awareness Training 02 small

GDPR Interactive Whiteboard

I subsequently created a new training module — an interactive version of the GDPR Whiteboard – the GDPR Interactive Whiteboard.  When people click on each topic, the program provides brief narrated background information, presented in a very understandable and memorable way.  Trainees can learn at their own pace.  This program is designed to be very short — it is about 5 minutes long.

It can readily be used on internal websites to raise awareness and teach basic information about GDPR. It can also be used in learning management systems.

GDPR Whiteboard Interactive - TeachPrivacy GDPR Training

GDPR Whiteboard Interactive - TeachPrivacy GDPR Training

Continue Reading

Cartoon: GDPR Right to Be Forgotten

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Right to Be Forgotten - TeachPrivacy GDPR Training

The GDPR Article 17 provides for a right to erasure — commonly known as the “right to be forgotten.”  Data subjects may request that an organization erase their personal data “without undue delay” under a number of circumstances.  These circumstances include when the data is no longer relevant to the purposes of collection, when consent is withdrawn and there is no other legal ground for processing, or when the data has been unlawfully processed, among other things.

Continue Reading