The General Data Protection Regulation (“GDPR”) was approved by the European Union (“EU”) and went into effect on May 25, 2018. The GDPR is the result of the EU Parliament’s goal to equip the EU citizens with stronger protections against privacy and data breaches. One of the most significant and controversial changes to the GDPR is the expanded scope of its jurisdiction, such that the rules and penalties imposed by the GDPR now apply to all companies processing personal data of EU residents – regardless of the company’s location. This means that any of our clients who process the personal data of EU citizens – including by using websites that collect IP addresses and cookie data – may be subject to these new regulations.
The nature of these reforms would require any companies subject to GDPR to ensure that all systems and procedures are consistent with GDPR’s heightened conditions for prior consent, internal record keeping requirements, erasures of data upon request (including by third-parties associated with your company), data protection monitoring, and breach notifications, among other new or stricter requirements.
Starr Associates LLP highly recommends that any of our clients who may be subject to GDPR seek more information by consulting with privacy law counsel. To access the page of the official EU Commission website relating to the GDPR, please click here. Another resource for education about the GDPR is a website that was created to provide information about its main elements, available here.