on July 29, 2021
On the third anniversary of the General Data Protection Regulation, Cooley started a series of webinars focused on the GDPR.
Our first webinar covers what we consider “the Top 10 key developments you should know” concerning the implementation of this ground-breaking personal data privacy regime.https://videopress.com/embed/jeN8KgiT?preloadContent=metadata&hd=1
#1: GDPR: It’s here to stay, and it’s never going to go away!
There’s been some debate around the need to reform the GDPR. However, it is unlikely that this reform is going to happen in the short term if we take into consideration that the European Commission noted in its 2020 evaluation report of the GDPR that it considers the GDPR has met its objectives. For the European Commission, the GDPR has given stronger rights to individuals while businesses are developing a compliance culture and using data protection as a competitive advantage, among others.
#2: Playtime seems to be over (both for companies and DPAs)
Looking at the past three years of enforcement by the national data protection authorities, we have seen some kind of evolution in the enforcement area:
- From June to the end of 2018: National authorities were setting up and reorganizing their teams to align their internal structure and resources with their new roles under the GDPR. This resulted in very few enforcements
- Year 2019: The enforcement increased in 2019, but it consisted mainly of small fines and small companies being targeted
- Year 2020: National data protection authorities started imposing very high monetary penalties, but many of these were appealed
- Year 2021: This year, we have started to see more mature and sophisticated enforcement decisions
#3: GDPR: the global ripple effect
GDPR has been a great inspiration around the globe. Some countries have started to implement new data protection frameworks that are aligned with the GDPR, such as the United States with the California Consumer Privacy Act and Brazil with the General Law for the Protection of Personal Data (LGPD). India is following closely, and a law is expected to be finalized at the end of this year.
#4: Data transfers have become a key challenge
Data transfers have become a key challenge for global organizations. Following the European Court of Justice Schrems II case, companies need to complete a Data Transfer Impact Assessment before transferring any data outside of the EEA, assessing the law and practice of the country of the data importer.
Although the European Court of Justice didn’t invalidate the SCCs, companies now also have to supplement them with additional contractual and technical measures following the European Data Protection Board guidance.
#5: Brexit has added an additional level of complexity
Following Brexit, we now have two GDPRs – a UK one and an EU one. Although currently both frameworks are basically identical, we may expect that there will be some deviations in the future. Brexit has also brought some duplications in relation to appointments of DPOs, representatives and BCRs.
#6: EU countries make use of the possibility to finetune by national laws
The GDPR has brought a fair amount of harmonization into the EU data protection framework, however, it’s important to note that EU Member States still have the possibility to finetune the GDPR locally by imposing additional requirements in areas such as the appointment of DPOs, processing activities that require a Data Protection Impact Assessment, or the age under which parental consent is needed to provide online services to children.
#7: To consent or not to consent, that’s the question
GDPR raises the bar for consent: pre-ticked boxes are not valid, and companies shall be able to demonstrate that individuals were totally free when they gave consent. Also, consent can be withdrawn at any time. All of this makes consent a difficult legal basis to rely on.
#8: Regulator guidance: creating clarity or more confusion? (Thankfully it’s black and white…. No grey areas to cause confusion)
The EDPB and the national data protection authorities have issued a lot of guidance since 2018 on multiple matters such as virtual voice assistants, data breach notifications, international data transfers and the concepts of controller and processor. In most cases the guidance is more restrictive than the GDPR.
The European Court of Justice has also had an active role in defining the GDPR through cases such as Fashion ID, Orange and Schrems II.
#9: Much more sophisticated and balanced data processing/sharing agreements
The relationship between data processors and controllers has become more mature and sophisticated. All steps of the relationship – from the onboarding phase, following with the contract execution and during the whole contractual relationship – have been impacted by the GDPR.
#10: And more is yet to come: what about 2022?
The EU Commission is quite active on data protection. There’s new legislation on the horizon mirroring GDPR, such as the Artificial Intelligence Regulation. Another area where we expect changes is e-privacy.
From the United States’ perspective, there is a lot of activity and, as mentioned earlier, the GDPR has inspired it. Apart from the CCPA, in 2018, Alabama enacted a data breach notification law, and other states such as Washington, Virginia and New York have begun to introduce legislation of baseline privacy laws.
Cooley’s cyber/data/privacy group
- 50+ lawyers globally counseling on privacy, cybersecurity and data protection matters
- Holistic approach to compliance and security, built to preserve and protect enterprise value
- Market leading privacy and data breach litigation