All posts in Global Privacy

Why I Love the GDPR: 10 Reasons

Daniel Solove
Founder of TeachPrivacy

GDPR Love 01

I have a confession to make, one that is difficult to fess up to on the US side of the pond: I love the GDPR.

There, I said it. . .

In the United States, a common refrain about GDPR is that it is unreasonable, unworkable, an insane piece of legislation that doesn’t understand how the Internet works, and a dinosaur romping around in the Digital Age.

But the GDPR isn’t designed to be followed as precisely as one would build a rocket ship. It’s an aspirational law.  Although perfect compliance isn’t likely, the practical goal of the GDPR is for organizations to try hard, to get as much of the way there as possible.

The GDPR is the most profound privacy law of our generation.  Of course, it’s not perfect, but it has more packed into it than any other privacy law I’ve seen. The GDPR is quite majestic in its scope and ambition.  Rather than shy away from tough issues, rather than tiptoe cautiously, the GDPR tackles nearly everything.

Here are 10 reasons why I love the GDPR:

(1) Omnibus and Comprehensive

EU GDPRUnlike the law in the US, which is sectoral (each law focuses on specific economic sectors), the GDPR is omnibus – it sets a baseline of privacy protections for all personal data.

This baseline is important.  In the US, protection depends upon not just the type of data but the entities that hold it.  For example, HIPAA doesn’t protect all health data, only health data created or maintained by specific types of entities.  Health data people share with a health app, for example, might not be protected at all by HIPAA.  This is quite confusing to individuals.  In the EU, the baseline protections ensure that nothing falls through the cracks.

Continue Reading

GDPR Cartoon: Lawful Processing

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Lawful Processing

This cartoon focuses on the lawful processing requirement.  Under the EU’s General Data Protection Regulation G(DPR), the collection and processing of personal data must be for “specified, explicit and legitimate purposes.”   This is in contrast to the United States where the processing of personal information is permitted unless a law forbids it.

Under the GDPR, data processing must be “lawful” – it must be justified by a legitimate purpose in order to be permissible.  Article 6 of the GDPR sets forth the grounds for the lawfulness of processing personal data.  These grounds include the consent of the data subject, when processing is necessary to perform a contract where the data subject is a party, when processing is necessary to comply with a legal obligation, when processing is necessary to protect a person’s vital interests, or when processing is necessary to perform a task carried out in the public interest.  The final ground for lawful processing is when processing is necessary for the “legitimate interests” of a data controller or third party.

It is far from clear that there are legitimate interests in the cartoon above.  Organizations often think that “legitimate interests” mean any interests that are important to their business, but that’s not the case.  This ground for lawful processing is much narrower.  And, legitimate interests must not be overridden by the data subject’s interests or rights.

Continue Reading

Key EDPB (European Data Protection Board) Documents for GDPR

Daniel Solove
Founder of TeachPrivacy

EU Article 29 Working Party GDPR Guidance

The EDPB (European Data Protection Board) was created by the EU Data Protection Directive in 1996.  Its purpose is to provide advice, opinions, and guidance about data protection.  The EDPB (European Data Protection Board) is composed of a representative from each EU member state.

Below are some of the most important guidelines to be issued by the EDPB (European Data Protection Board) about the General Data Protection Regulation (GDPR).

Right to Data Portability (WP 242)

Guidelines on the right to “data portability” (wp242rev.01)

Data Protection Officers (WP 243)

Guidelines on Data Protection Officers (‘DPOs’) (wp243rev.01)

Continue Reading

Key WP29 Documents for GDPR

Daniel Solove
Founder of TeachPrivacy

EU Article 29 Working Party GDPR Guidance

The Article 29 Working Party was created by the EU Data Protection Directive in 1996.  Its purpose is to provide advice, opinions, and guidance about data protection.  The Article 29 Working Party is composed of a representative from each EU member state.  The General Data Protection Regulation (GDPR) will replace the Working Party with the European Data Protection Board (EDPB).

Below are some of the most important guidelines to be issued by the Article 29 Working Party (WP29) about the General Data Protection Regulation (GDPR).

Right to Data Portability (WP 242)

Guidelines on the right to “data portability” (wp242rev.01)

Data Protection Officers (WP 243)

Guidelines on Data Protection Officers (‘DPOs’) (wp243rev.01)

Continue Reading

Cartoon on GDPR Vendor Management

Daniel Solove
Founder of TeachPrivacy

 

Cartoon GDPR Vendor Management TeachPrivacy GDPR Training

This cartoon depicts the challenges of complying with GDPR’s requirements for vendor management.   Under the GDPR, there are serious responsibilities when using a vendor to process personal data.  Broadly, there are three things that data controllers must do:

1. Data controllers must perform due diligence in selecting vendors and that are complaint with GDPR.

2. Data controllers must have a contract with their vendors that includes certain provisions to ensure that GDPR is being followed.

3. Data controllers must monitor vendors for compliance.

Vendors must also comply with the GDPR.

Continue Reading

The Hidden Force That Will Drive GDPR Privacy Compliance

Daniel Solove
Founder of TeachPrivacy

GDPR Compliance

 

The clock is ticking on getting ready to comply with the EU General Data Protection Regulation (GDPR). EU regulators will start enforcing it on May 25, 2018.

GDPR is less than a year away, and it’s quite a challenge to get ready for. Becoming compliant is not something that can be achieved overnight, or in a week, or in a month, or even in quarter.  A lot of privacy and security controls must be put into place or adapted to satisfy new EU standards and rights.

.

Continue Reading

Preparing for GDPR: A Year to Batten Down the Hatches

Daniel Solove
Founder of TeachPrivacy

The General Data Protection Regulation (GDPR) will go into effect on May 25, 2018.  The GDPR strengthens privacy protections in the EU and includes a number of additional rights and responsibilities.

Continue Reading

The U.S. Congress Is Not the Leader in Privacy or Data Security Law

Daniel Solove
Founder of TeachPrivacy

Capitol Sinking 01

A common myth is that the U.S. Congress is a leader in creating privacy and data security law.  But this has not been true for quite some time.  Congress isn’t leading, and even the policies and practices of US companies are increasingly built around the law of the European Union (EU) or the states.

In the 1970s through the end of the 1990s, the US Congress passed a large number of important privacy laws.  Here are some of the most prominent of these statutes:

Continue Reading

Congress’s Attempt to Repeal the FCC Internet Privacy Rules: The Void Will Be Filled

Daniel Solove
Founder of TeachPrivacy

FCC Privacy Rules Repealed

Recently, Congress voted to overturn new FCC rules that regulated the privacy of broadband Internet Service Providers (ISPs).  The rules implemented the Communications Act, 47 U.S.C. § 222 to ISPs, requiring opt in for sharing sensitive customer data, opt out for sharing non-sensitive customer data, as well as transparency requirements.  Sensitive data includes precise geo-location, children’s information, health information, financial information, Social Security Numbers, Web browsing history, app usage history, and the contents of communications.  The rules required reasonable data security protections as well as data breach notification.

FCC LogoThis development is a setback in Internet privacy protection, but it doesn’t mean that Internet privacy is doomed.  There are many other regulators and sources of privacy law to fill the void.

Pro-industry advocates often decry much privacy regulation and cheer the death of rules such as the FCC rules.  They advocate for rolling back the jurisdiction and power of regulatory agencies like the FCC and FTC.

Ironically, efforts to weaken the FTC and FCC probably won’t lead to more freedom for industry.  In the short term after regulation is weakened or killed, there is a void, so this seems like a nice freer zone for companies..  But nature abhors a vacuum.  Other regulators will fill the void, and typically it is regulators who are most passionate about protecting privacy such as California and the EU.  They are far more likely to regulate privacy even more stringently than the FCC or FTC.

In the absence of federal regulation, many states pass laws that create a complicated patchwork of inconsistent regulation.  This is what happened with data security regulation and data breach notification.  Way back in 2005, after the ChoicePoint breach captured national headlines, Congress was considering enacting a law.  But it failed to act.  Instead, the vast majority of states passed data breach notification statutes, and many states passed data security laws.  Instead of having to comply with one law, companies must navigate laws in many states.  The most common strategy for companies operating in all states  is to try to follow the strictest state law,  Thus, the de facto rule is the law of the state with the most strict protections.

Continue Reading

Microsoft Just Won a Big Victory Against Government Surveillance — Why It Matters

Daniel Solove
Founder of TeachPrivacy

eye

Yesterday, Microsoft won a huge case against government surveillance, a case with very important implications: In the Matter of a Warrant to Search a Certain E‐Mail Account Controlled and Maintained by Microsoft Corporation.

Continue Reading