Compliance with Data Protection Regulations

Who is a Data Processor?
A natural or legal person could be a data processor if it does any of the following:
Collect, hold or process personal data, but does not exercise responsibility for or
control how the personal data is used.
Have little or no freedom in the determination of what the data processing should entail.
If you or your organisation process the personal information, but some other individual or
organisation decides and is responsible for how you process that personal information, then
the said individual or other organisation that determines how you process the personal
information is the data controller, and your organisation is the data processor.
It is possible for a person or entity to be both a data controller and a data processor, in respect
of distinct sets of personal information.
General Data Protection Regulations (GDPR)
The General Data Protection Regulation (GDPR) standardizes data protection law across all
28 EU countries and imposes strict new rules on controlling and processing personally
identifiable information (PII). It also extends the protection of personal data and data protection
rights by giving control back to EU residents. GDPR replaces the 1995 EU Data Protection
Directive, and goes into force on May 25, 2018.
There are many essential items in the regulation, including increased fines, breach
notifications, opt-in consent and responsibility for data transfer outside the EU. As a result, the
impact to businesses is huge and will permanently change the way customer data is collected,
stored, and used.
GDPR applies to all organizations holding and processing EU resident’s personal data,
regardless of geographic location. Many organisations outside the EU are unaware that the
EU GDPR regulation applies to them as well. If an organization offers goods or services to, or
monitors the behaviour of EU residents, it must meet GDPR compliance requirements.
Fines for noncompliance are large. They can be as high as €20 million or 4% of a company’s
total global revenue, whichever is larger. This is the maximum fine that can be imposed for
the most serious violations, e.g. not having sufficient customer consent to process data or
violating core Privacy by Design concepts. However, there is a tiered approach to fines, e.g.
a company can be fined 2% for not having their records in order, not notifying the supervising
authority and data subject about a breach, or not conducting an impact assessment. It is
important to note that these rules apply to both controllers and processors.
Next Steps
Your company must as a matter of urgency determine if it is a data controller or processor and
take steps to comply with the Data Protection Act, 2012 (Act 843).
We have included information on the GDPR because we are aware that you offer services to
European airlines and may process personal information of EU citizens from time to time.
Steps must be taken to comply with the GDPR to avoid possible liability arising from any
breach of the regulations when it comes into force on May 25, 2018.
Should you have any data protection queries, please contact Griffin Legal here.
Likewise, if you require assistance drafting GDPR compliant contracts, please contact
a member of Griffin Corporate’s Commercial Transaction team here.