Compliance &Ethics - Society of Corporate Compliance and Ethics

FeatureBased on the wording of the proposedRegulation, businesses with entities in Europethat process personal data, use equipment inthe EU for processing personal data, or are notin the EU but process personal data of EU datasubjects or monitor their behavior, will incursignificant compliance obligations.As the Regulation applies to both data controllersand data processors, and dramaticallyextends the enforcement powers of the regulatorsand the fines for non-compliance (i.e., 2%of worldwide revenue for negligent or recklessbreach), businesses will need to prepare forinvestment in EU data protection compliance.The current Regulation runs to 116 pages,but our summary of the key provisions is asfollows:··The Regulation will be binding on all EUmember states from the date that it comesinto force. That date will be the 20 th dayfollowing the date of publication of theRegulation in the official journal of theEuropean Union, and the application ofthe Regulation may be two years from theaforementioned date. Our understandingis that it will take at least a year to debatethe Regulation and for it to be approved bythe EU, which means that we can expectthe Regulation to be published in its finalform and enter into force in the secondhalf of 2013, giving a two-year period forbusinesses to come into compliance by2015, although it is possible that it may beexpedited so as to come in to force by 2014.··The Regulation applies both to data controllersand data processors that have eitherlegal entities in the EU, or process personaldata of EU data subjects, irrespective of thelocation of the controller or processor; butthe Regulation does not apply where theprocessing is by an individual purely forpersonal or household activities.··Most of the current definitions of datasubject, personal data, and the like, remainthe same, except that sensitive personaldata now includes genetic and biometricinformation, and consent is defined as“any freely given specific, informed andspecific indication of” the data subject’ssignification for the purposes of processing.Also, “personal data breach” is nowdefined with respect to breach of securityfor which new obligations arise.··The data protection principles broadlyremain the same, although it should benoted that consent and the mechanismsfor gaining consent are provided in detailin the Regulation. Among other things,the Regulation states that consent cannotbe automatically implied with respect tothe processing of employee data, nor withrespect to the processing of the data of achild, where the child is under the age of 13and parental consent has not been given.··Fair processing statements or privacynotices will have to be in plain and intelligiblelanguage, and drafted with certaindata subjects in mind, “in particular forany information addressed specifically toa child” (where a child here is defined asunder the age of 18).··In a privacy statement or privacy notice,Article 12 indicates that there needs to bespecific information given to a data subjectwith respect to the nature and purposesof the processing of their data and of theirrights. There are also detailed requirementsin relation to profiling and the collection ofdata via social network services.· · Although subject access requests are stillpermitted, Article 17 additionally providesthe “right to be forgotten” and to haveCompliance & Ethics Professional May/June 2012+1 952 933 4977 or 888 277 4977 | www.corporatecompliance.org 25