General Data Protecon Regula-on (GDPR)€¦ · EU: 28 countries EEA: Norway, Iceland, Liechtenstein Countries covered by the adequacy decision of the EU Commission

Copyright©2016BCDTravelN.V.Allrightsreserved.

General Data Protec-on Regula-on (GDPR) NBTS-Stockholm 10.02.2017

PatrikPsota

BCDTravel

InhouseCorporateCounsel&DataProtec8onEMEA

BasedinBremen/Germany

T+49(0)4213500262

E-Mail:[email protected]

AgendaRoadmaptotheGDPR

5thingstoknow

Summary

RoadmaptotheGDPR…

1 2 3 4 5

Adop8onoftheGDPR

Regula8on2016/679

Analysisoftheobliga8ons

undertheGDPR

LocalDPLaws? Enteringintoforce

27.April2016

25May2018

Implementa8onofchanges

ThepathtotheGDPR5thingstoknowabouttheGDPR

TerritorialReach

EU:28countries EEA:Norway,Iceland,Liechtenstein

CountriescoveredbytheadequacydecisionoftheEUCommission

Datagovernance

•  Privacy by design –  Appropriate technical and organisa-onal measures –  Within each project (both structural and conceptual) from the design stage –  Pseudonymisa-on/Data minimisa-on

•  Privacy Impact Assessments (PIAs)

• Using service providers (processors) –  High duty of care in selec-ng a provider –  Contractual requirements (processed data, dura-on, obliga-ons…)

• Record of processing ac-vi-es

WhenPNRdatatravel…

Databreachno8fica8on

• Data controllers must report personal data breaches to their supervisory authority / affected data subjects –  Timing:

Without undue delay and, where feasible, not later than 72 hours aXer becoming aware of it

–  Exemp-on: No repor-ng if the breach is unlikely to result in a risk for the rights and freedoms of a data subject.

Interna8onalTransfers

•  Exis-ng transfer mechanisms remain valid –  Standard Contractual Clauses (Model Clauses) –  BCRs –  Commission Adequacy Decisions

• New transfer mechanisms: –  DPA Clauses (na-onal alterna-ve to the Model Clauses) –  Code of Conduct –  Cer-fica-ons

Fines

• Administra-ve fines up to € 20.000.000 or

•  up to 4% of the total worldwide annual turnover of the preceding financial year (whichever is higher)

•  Points to be considered by the Supervisory Authori-es: –  Nature –  Gravity –  Dura-on –  Character of the infringement

The GDPR is not the much feared revolu-on…

but it is a game changer!

Ques8ons?

Thankyou!

Copyright©2016BCDTravelN.V.Allrightsreserved.