CMCP Diversity Matters - May/June 2018

In addition to the above, if an
organization directly obtains the
data subject’s personal data with
their consent through electronic
processing, it must also afford
the data subject the ability to
port it to another platform in
a machine-readable format.
This requirement fundamentally
changes how companies need
to think about their customers’
personal data moving forward.
Personal data belongs to
the data subject, not to the
aggregator, and organizations will
be forced to facilitate transfers to
their competitor’s products and
services at the direction of the
data subject.
Additional aspects of GDPR
include specific requirements for
limiting the purposes for personal
data processing, maintaining
data quality and accuracy, limiting
retention periods, ensuring the
integrity and confidentiality of
personal data through technical
and organization measures,
accountability for compliance with
applicable EU laws and breach
notification responses.
In many cases, however, US
organizations receiving data from
EU data controllers may be able
to comply with the GDPR through
self-certification under the EU-US
Privacy Shield.
The EU-US Privacy Shield requires
participants to provide adequate
protections for EU data subjects’
personal data under the following
guiding principles:
• Notice Requirement
• Choice Requirement
• Accountability For Onward
Transfers and Vendor
Agreements
• Security
• Data Integrity and Purpose
Limitation
• Access
• Recourse, Enforcement and
Liability
• Appropriate Safeguards
The EU-US Privacy Shield notably
provides EU data subjects with
the opportunity to object to the
processing of their personal
data and seek redress with
their own local data protection
authority, the Federal Trade
Commission, or the Department
of Commerce. They can also
force US companies into binding
arbitration within the data
subject’s own local jurisdiction.
The costs of such enforcement
mechanisms will be borne by the
organization processing the data.
While this article is merely
intended to highlight some of
the aspects of the GDPR, it
simply could never adequately
address the complexities
of the Regulation’s detailed
requirements, nuances and
exceptions. Practitioners
should be aware that GDPR
not only poses implications for
human resources, operational
compliance and the IT functions
of an organization, but also
requires risk assessment for
M&A transactions, insurance
underwriting, cross-border
commercial transactions and
new business initiative designs.
As such, GDPR should not be
regarded as just an EU issue,
but rather, a global concern that
reaches within our own borders.
David Michail is CIPP-E Certified Data
Privacy Expert by the International
Association of Privacy Professionals and
offers regulatory compliance and data
privacy officer services for US-based and
multi-jurisdictional entities. For more
information visit www.metlawgroup.com.
May/June 2018 | 17