The Need For A Better Data Visibility- GDPR

On the 26th April 2016 with the announcement of the General Data Protection Regulation or GDPR, the European Union shook the entire globe with such stringent privacy policies in an internet revolution world. The main aim with which GDPR was thought of was to empower the users to control their Personal Identifiable Information in terms of regulating to whom it shall be made available to, deleting it, editing it. Most importantly GDPR’s motive was to allow the customers to have an informed choice as to when their data is taken and for what purpose is it being used subsequently.

Though the legal jurisdiction of GDPR spreads only across the entire EU due to the indispensable and worldwide reach of the internet it has impacted all the states and almost every sector which is somehow associated with the internet. GDPR being new legislation, firms/ individuals tend to incur a lot of difficulties in terms of the compliances to be fulfilled. A detailed analysis of GDPR and what regulations have been introduced by way of this regulation can be found here.

GDPR though might seem quite complex but by following the below-mentioned checklist one can prepare their organization for the GDPR compliances.

CHECKLIST

STEP I: Segregation

  • The first step is to determine the nature of the organization that is whether the organization is a Data controller or a Data processor. Data controllers are the ones who decide upon the purpose of the data and Data processors are the ones who directly are in the act of processing the data.

STEP-II: Data Information

  • Every company should have a complete list of all the personal information that is held by them, the source of information, and what is done with the data, meaning thereby, a complete record of the processing activities have to be maintained [Article 30].
  • This information related to the whereabouts of the personal data should be clearly mentioned in the privacy policy such that the reader gets to know what is being done with his data.
  • The privacy policy should contain a valid reason for data processing and the same should be lawful [Article 6].

STEP III: Accountability and Management

  • A data protection officer is appointed. The appointment of a DPO is required only in three circumstances, first where the processing is being carried out by a public authority except a judicial body; secondly, when nature itself of the business involves processing activities and; thirdly when such data is being processed in an extremely large quantity [Article 37]
  • It is the duty of the organization to make sure that the members of the organization are aware of the various practices and laws related to GDPR, this can be done by providing training to the staff [Article 25].
  • When processing is to be carried out on behalf of the processor then only the processor providing sufficient guarantees to match the technical requirements of the organization could be chosen. Furthermore, the customer has to give informed consent as to the use of that subprocessor [Article 28].
  • For organizations not established within the territory of EU, but dealing in data of EU citizens a representative has to be appointed in any of the EU states and that person should handle all the data processing difficulties [Article 27].
  • Breach of personal data has to be communicated within 72 hours to the local authority as well as the data subjects, that is, the person whose data has been breached [Article 33 and 34].

Consent- was it ever ‘INFORMED’

Consent, which is the most debated topic, has always been questioned as to whether the consent is informed or not. Earlier the organization used to have complex consent terms which were difficult for the customers to understand and comprehend, or used to have simple cookie pop-up displaying “by entering this website you agree to all the conditions” was this really consent?

The organizations used to trick the customers into giving consent. The new legislation that came into effect in May 2018 however has made it essential for the organizations to have simplified privacy terms, also simple pop up would not be enough the website has to display all the details which are being processed or controlled by it so that the viewer can have an informed choice.

In this era where privacy is supreme GDPR has tried to keep up with it by amending the existing consent terms which existed as a dotted line contract.

  • Websites that intend to collect any sort of personal information should have a visible privacy policy link and only when the user checks into the box shall that be considered accepted. This means that the practice of pre-ticked boxes is a crime now. [Article 7]
  • Simple, clear, and understandable language should be used to draft the privacy policy any sort of ambiguity shall render the agreement void. [Article 7.2]
  • The new legislation realized the privacy loss when the data which was once consented to was stuck and could not be withdrawn. Now along with the consent process, the data controller has to mention the process by which consent can be withdrawn. [Article 7.3]
  • Consent for children below 16 years will be taken by their legal guardians only. [Article 8]
  • Any change in the privacy policy now requires the data controller to inform all the consented data subjects in simple language as to what changes have taken place. [Article 7]

How Has India Been Impacted By GDPR

Companies all across the world are assessing the impact on their economy. Undoubtedly high fines are one of the driving forces which are compelling industries to look into it. India is having a major structural transition with a peculiar change in the information technology sector which is again expected to grow. Major markets for the Indian ITs are the US, UK, and Europe. To a large extent, the growth of this sector will depend upon how well India has decided to respond to these regulatory changes in order to retain the status of a dependable processing destination.

The changing guidelines mean Indian companies will now have to assess and redesign their data-intensive business processes such as data acquisition, processing, and data management, in compliance with the guidelines. This transition however is not easy as:

  • Huge Fresh Capital Investment: The quantum of investment needed to gear up for the changes is huge. This investment is not only in terms of money but also the time investment required to comprehend, change, the train is huge.
  • India’s weak data protection laws: The already existing weak data protection laws, which led the Supreme Court to deliver S.Puttaswamy v. Union of India judgment make India less competitive than other outsourcing units in this sector. The recommendation of the Srikrishna Committee has also come up, the question next is whether these recommendations meet the requirement of EU’s regulation or they need to be further amended.
  • Cross Border restrictions: With the introduction of GDPR the extent of business has been reduced in terms of data of the EU citizens, Indian companies have to now adopt the necessary safeguard in order to continue as a master player in this sector.

These challenges however should not hinder if India views GDPR as a business opportunity and not as a compliance burden as this would have a twofold effect, not only will it allow India to stand out in the technology sector but will also strengthen India’s own privacy landscape.

Author: Shrivali Kajaria, Intern at Khurana & Khurana, Advocates, and IP Attorneys. In case of any queries please contact/write back to us at pratistha@iiprd.com.

Leave a Reply

Your email address will not be published. Required fields are marked *

8 − 7 =

Archives

  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • April 2017
  • March 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • January 2012
  • December 2011
  • November 2011
  • October 2011
  • September 2011
  • August 2011
  • July 2011
  • June 2011
  • May 2011
  • April 2011
  • March 2011
  • February 2011
  • January 2011
  • December 2010
  • September 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010