Short Reads

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

General Data Protection Regulation comes into effect

07.08.2018 NL law

On 25 May 2018, the European Union's General Data Protection Regulation (GDPR) came into effect. The GDPR replaces the EU's prior directive governing the processing and transfer of personal data, which was in place since 1995. As a regulation, the GDPR is directly applicable in all 28 EU member states and thus removes the need for national implementing legislation. However, the GDPR allows member states discretion in certain areas, as a result of which national legislation may still be implemented. In the Netherlands, the GDPR Implementation Act came into effect on 25 May 2018.

The GDPR intends to harmonise rules regarding the protection of personal data and the promotion of free movement of such personal data within the EU. It provides a set of standardised data protection laws across all EU member states. The GDPR affects both natural persons and companies. As regards natural persons, their existing privacy rights have been strengthened and new and improved rights have been introduced. In addition, natural persons have been given greater control over their own personal data.

As regards companies, the GDPR applies to both EU companies and non-EU companies that (i) process personal data in relation to the offering of goods or services to EU data subjects or (ii) monitor the behaviour of data subjects occurring within the EU. Even if a company only processes data on behalf of somebody else, it is still subject to the GDPR. The GDPR expressly addresses the role and responsibility of data processors, in other words those entities that process personal data on behalf of another entity that controls the data and the purpose for which the data are being processed (i.e. data controllers). For example, a hosting provider is a data processor for the company owning the website and a payroll service provider is a data processor for the employer outsourcing payroll services.

For companies, new and stricter requirements have been introduced. The GDPR places a number of onerous obligations on companies to have them demonstrate compliance with the GDPR. Companies need to, among other things, put procedures and systems in place so there is a structure for certain topics like risk assessment and decision-making. They are also required to keep a register of all processing activities and, in some cases, designate a data protection officer.

Failing to comply with the GDPR could have a huge impact on companies as the maximum fines for non-compliance are significantly higher than before. For example, companies could now face fines of (i) 4% of total annual worldwide turnover or (ii) EUR 20 million, whichever is higher, depending on the type and severity of the non-compliance in the individual case. In addition, the supervising authorities can issue a warning or impose a temporary or definitive ban on processing personal data.

For more information, please visit the GDPR page on our MyStibbe portal.

Team

Related news

02.07.2019 NL law
Debate night: HR Analytics: opportunity or threat?

Seminar - On 2 July 2019, Stibbe's Digital Economy Group will host a debate night in Amsterdam on the hot topic of HR analytics. During Stibbe's debate night, speakers from the world of business, politics, science and law will exchange views on HR analytics, how they can be used in practice, and their development in the context of employment and privacy law.

Read more

06.06.2019 NL law
Masterclass: Alcohol and drug testing in the workplace

Masterclass - Stibbe will host a masterclass entitled 'Alcohol and drug testing in the workplace' on 6 June in Amsterdam. During this masterclass, employment law expert Johan Zwemmer and privacy experts Frederiek Fernhout and Judica Krikke will discuss the Dutch Data Protection Authority's general prohibition of these tests and discuss whether and how employers should implement.

Read more

25.06.2019 LU law
The dawn of a new era of cross-border mobility within the EU?

Seminar - François Bernard, Senior Associate at Stibbe Luxembourg, will conduct a seminar in Luxembourg on 25 June in collaboration with Legitech on Directive proposal COM2018 (241 final) amending the cross-border merger regime currently enshrined in Directive (EU) 2017/1132 and introducing a new regime applicable to cross-border conversions and divisions.

Read more

06.06.2019 NL law
Masterclass: Alcohol- en drugstesten op de werkvloer

Masterclass - Stibbe in Amsterdam organiseert op 6 juni de masterclass 'Alcohol- & drugstesten op de werkvloer'. Tijdens deze masterclass bespreken arbeidsrechtexpert Johan Zwemmer en privacydeskundigen Frederiek Fernhout en Judica Krikke het algemene verbod van de Autoriteit Persoonsgegevens op deze testen voor werkgevers en leggen zij onder meer uit hoe hiermee moet worden omgegaan.

Read more

07.06.2019 BE law
Part three - GDPR and public law: To retroact or not?

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss the retroactive application of GDPR.

Read more

05.06.2019 BE law
Part two - GDPR and Public Law: Data protection in public procurement

Articles - Since the General Data Protection Regulation (“GDPR”) became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and public law”, we discuss three capita selecta of the interaction of GDPR with public law and government. In this blog we discuss some GDPR-related aspects of public procurement.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring