The Need For A Better Data Visibility- GDPR

On the 26th April 2016 with the announcement of the General Data Protection Regulation or GDPR, the European Union shook the entire globe with such stringent privacy policies in an internet revolution world. The main aim with which GDPR was thought of was to empower the users to control their Personal Identifiable Information in terms of regulating to whom it shall be made available to, deleting it, editing it. Most importantly GDPR’s motive was to allow the customers to have an informed choice as to when their data is taken and for what purpose is it being used subsequently.

Though the legal jurisdiction of GDPR spreads only across the entire EU due to the indispensable and worldwide reach of the internet it has impacted all the states and almost every sector which is somehow associated with the internet. GDPR being new legislation, firms/ individuals tend to incur a lot of difficulties in terms of the compliances to be fulfilled. A detailed analysis of GDPR and what regulations have been introduced by way of this regulation can be found here.

GDPR though might seem quite complex but by following the below-mentioned checklist one can prepare their organization for the GDPR compliances.

CHECKLIST

STEP I: Segregation

• The first step is to determine the nature of the organization that is whether the organization is a Data controller or a Data processor. Data controllers are the ones who decide upon the purpose of the data and Data processors are the ones who directly are in the act of processing the data.

STEP-II: Data Information

• Every company should have a complete list of all the personal information that is held by them, the source of information, and what is done with the data, meaning thereby, a complete record of the processing activities have to be maintained [Article 30].
• This information related to the whereabouts of the personal data should be clearly mentioned in the privacy policy such that the reader gets to know what is being done with his data.
• The privacy policy should contain a valid reason for data processing and the same should be lawful [Article 6].

STEP III: Accountability and Management

• A data protection officer is appointed. The appointment of a DPO is required only in three circumstances, first where the processing is being carried out by a public authority except a judicial body; secondly, when nature itself of the business involves processing activities and; thirdly when such data is being processed in an extremely large quantity [Article 37]
• It is the duty of the organization to make sure that the members of the organization are aware of the various practices and laws related to GDPR, this can be done by providing training to the staff [Article 25].
• When processing is to be carried out on behalf of the processor then only the processor providing sufficient guarantees to match the technical requirements of the organization could be chosen. Furthermore, the customer has to give informed consent as to the use of that subprocessor [Article 28].
• For organizations not established within the territory of EU, but dealing in data of EU citizens a representative has to be appointed in any of the EU states and that person should handle all the data processing difficulties [Article 27].
• Breach of personal data has to be communicated within 72 hours to the local authority as well as the data subjects, that is, the person whose data has been breached [Article 33 and 34].

Consent- was it ever ‘INFORMED’

Consent, which is the most debated topic, has always been questioned as to whether the consent is informed or not. Earlier the organization used to have complex consent terms which were difficult for the customers to understand and comprehend, or used to have simple cookie pop-up displaying “by entering this website you agree to all the conditions” was this really consent?

The organizations used to trick the customers into giving consent. The new legislation that came into effect in May 2018 however has made it essential for the organizations to have simplified privacy terms, also simple pop up would not be enough the website has to display all the details which are being processed or controlled by it so that the viewer can have an informed choice.

In this era where privacy is supreme GDPR has tried to keep up with it by amending the existing consent terms which existed as a dotted line contract.

• Websites that intend to collect any sort of personal information should have a visible privacy policy link and only when the user checks into the box shall that be considered accepted. This means that the practice of pre-ticked boxes is a crime now. [Article 7]
• Simple, clear, and understandable language should be used to draft the privacy policy any sort of ambiguity shall render the agreement void. [Article 7.2]
• The new legislation realized the privacy loss when the data which was once consented to was stuck and could not be withdrawn. Now along with the consent process, the data controller has to mention the process by which consent can be withdrawn. [Article 7.3]
• Consent for children below 16 years will be taken by their legal guardians only. [Article 8]
• Any change in the privacy policy now requires the data controller to inform all the consented data subjects in simple language as to what changes have taken place. [Article 7]

How Has India Been Impacted By GDPR

Companies all across the world are assessing the impact on their economy. Undoubtedly high fines are one of the driving forces which are compelling industries to look into it. India is having a major structural transition with a peculiar change in the information technology sector which is again expected to grow. Major markets for the Indian ITs are the US, UK, and Europe. To a large extent, the growth of this sector will depend upon how well India has decided to respond to these regulatory changes in order to retain the status of a dependable processing destination.

The changing guidelines mean Indian companies will now have to assess and redesign their data-intensive business processes such as data acquisition, processing, and data management, in compliance with the guidelines. This transition however is not easy as:

• Huge Fresh Capital Investment: The quantum of investment needed to gear up for the changes is huge. This investment is not only in terms of money but also the time investment required to comprehend, change, the train is huge.
• India’s weak data protection laws: The already existing weak data protection laws, which led the Supreme Court to deliver S.Puttaswamy v. Union of India judgment make India less competitive than other outsourcing units in this sector. The recommendation of the Srikrishna Committee has also come up, the question next is whether these recommendations meet the requirement of EU’s regulation or they need to be further amended.
• Cross Border restrictions: With the introduction of GDPR the extent of business has been reduced in terms of data of the EU citizens, Indian companies have to now adopt the necessary safeguard in order to continue as a master player in this sector.

These challenges however should not hinder if India views GDPR as a business opportunity and not as a compliance burden as this would have a twofold effect, not only will it allow India to stand out in the technology sector but will also strengthen India’s own privacy landscape.

Author: Shrivali Kajaria, Intern at Khurana & Khurana, Advocates, and IP Attorneys. In case of any queries please contact/write back to us at [email protected].