EU approves new data protection rules.

• Position: PRIVACY

The Securities and Exchange Coin December, the European Commission (EC) approved the final version of the General Data Protection Regulation (GDPR). The European Union (EU) Parliament was to authorize it early this year, and it will become law for all 28 member states in 2018.

The new rules usurp the EU's 1995 data protection rules (Directive 95/46/EC). The EC has been working on the GDPR since 2012 to strengthen online privacy rights and boost Europe's digital economy.

Experts say GDPR is the most stringent data privacy regulation yet. The new rules apply extraterritorially and so will impact every entity (data processor or data controller) that holds or uses Europeans' personal data both inside and outside of Europe, according to legal experts.

"GDPR is a paradigm change in the way that data collection and use is regulated. We have moved from an era of relatively laissez-faire regulation of data in Europe to having the most stringent data laws in the world," Ross McKean, partner at law firm Olswang, told ComputerWeekly.com.

Key provisions of the GDPR include:

* Instituting more rigorous requirements for obtaining consent for collecting personal data

* Raising the age of consent for collecting an individual's data from 13 to 16 years old

* Memorializing the "right to be forgotten," meaning entities must delete data if it meets the specified criteria

* Requiring entities to notify EU regulators of data breaches within 72 hours of the breach

* Requiring entities that handle large amounts of sensitive data to appoint a data protection officer

* Allowing fines of up to 20 million [euro] or 4% of a company's global revenue for non-compliance According to the National

Law Review, the most significant change brought about by the GDPR is that jurisdiction is not a physical or geographical barrier because it is now digital, meaning that companies outside the EU will be affected by these new regulations if they collect data that belongs to an EU citizen.

[ILLUSTRATION OMITTED]

"The GDPR looks to adopt prescriptive rules around how organizations will need to demonstrate that they comply with the GDPR," Vinod Bange, partner and head of the UK data protection/privacy...