EU approves GDPR.

• Position: PRIVACY - General Data Protection Regulation

The EU Parliament passed the General Data Protection Regulation (GDPR), overhauling the Data Protection Directive rules established in 1995. The rules apply to all organizations and businesses targeting EU consumers, regardless of their geographic location.

According to Legaltech News, the legislation defines new data and privacy rights for EU consumers, regulates the transfers and processing of EU data, and establishes more stringent enforcement of data handling, allowing organizations to be fined up to 4% of its total worldwide revenue for violating GDPR regulations.

GDPR is meant to replace the patchwork of EU member states' national laws so that businesses accessing EU data will have only one centralized supervisory authority to follow. The EU estimates that savings from this standardization will hit 2.3 billion [pounds sterling] ($2.6 billion U.S.) per year, Legaltech News reported.

The GDPR is effective now, but member states have two years to translate the regulations into their national laws. The UK and Ireland will follow the regulation on a limited basis because of their special "home affairs and justice legislation" status. Denmark will vote on the adoption of the GDPR within six months.

The GDPR:

* Allows an EU citizen's right to be forgotten, which means data controllers, processers, and Internet third parties must remove the personal data of an EU citizen upon request if there are no legitimate reasons to retain such information, such as historical, statistical, public health, scientific need, a right to free expression, or legal or contractual obligations

* Requires clear and affirmative consent, such as an EU citizen "ticking a box" on a website allowing it to retain...