EU GDPR

EU GDPR
Name	General Data Protection Regulation
Long name	Regulation (EU) 2016/679 of the European Parliament and of the Council
Enacted by	European Parliament and Council of the European Union
Adopted	27 April 2016
Commenced	25 May 2018
Status	in force

EU GDPR The General Data Protection Regulation is a comprehensive data protection law adopted by the European Parliament and the Council of the European Union to harmonize personal data protection across the European Union and reshape privacy practices for organizations worldwide. It replaced the Data Protection Directive 95/46/EC to provide enforceable rights for individuals and binding obligations for public authorities and private entities operating in or serving residents of the European Union.

Overview

The regulation sets rules on processing personal data by controllers and processors, establishing principles, rights, and mechanisms for accountability enforced by national data protection authorities such as the Information Commissioner's Office and the Commission nationale de l'informatique et des libertés. It arose from legislative initiatives in the European Commission and was negotiated by the European Council and the European Parliament, reflecting influences from earlier instruments like the Convention 108 of the Council of Europe and decisions of the European Court of Justice. Implementation has driven technical and organizational changes in multinational corporations including Google, Facebook, Amazon (company), Microsoft, and in sectors overseen by regulators such as the European Banking Authority and the European Medicines Agency.

Key Principles and Rights

The regulation codifies principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality recognized in instruments like Convention 108. It grants data subject rights including access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection—rights that have been invoked against entities such as Cambridge Analytica-linked firms, multinational platforms like Twitter and YouTube, and service providers including Oracle Corporation and Salesforce. The rule on automated decision-making and profiling affects sectors regulated by bodies such as the European Securities and Markets Authority and institutions like the World Health Organization when processing health data.

Scope and Territorial Application

The regulation applies to processing of personal data in the context of activities of establishments of controllers or processors in the European Union, and to controllers or processors outside the European Union offering goods or services to, or monitoring the behaviour of, data subjects in the European Union. This extraterritorial reach has engaged companies based in jurisdictions like the United States, United Kingdom, India, China, and Brazil, prompting adequacy decisions by the European Commission for countries including Japan and mechanisms such as Standard Contractual Clauses and binding corporate rules used by conglomerates like Apple Inc. and IBM.

Obligations for Controllers and Processors

Controllers and processors must implement appropriate technical and organisational measures, maintain records of processing activities, conduct data protection impact assessments for high-risk processing (e.g., by Hugging Face-type AI projects or biometric systems used by Clearview AI), and, where required, appoint a data protection officer with ties to frameworks in institutions like the European Investment Bank. They must ensure lawful bases for processing—consent, contract, legal obligation, vital interests, public task, or legitimate interests—that interact with sectoral regulation from authorities such as the European Commission and European Parliament committees. Cross-border processing invokes coordination among lead supervisory authorities like the Data Protection Commission (Ireland) for major tech firms.

Enforcement and Penalties

Enforcement is carried out by supervisory authorities established under the regulation, which can issue corrective powers including warnings, reprimands, orders to comply, and administrative fines up to €20 million or 4% of global annual turnover—measures exercised in high-profile actions involving companies such as Google LLC, WhatsApp, and British Airways. The consistency mechanism and the European Data Protection Board coordinate cross-border cases and guidance, while decisions can be appealed to courts including national supreme courts and ultimately the Court of Justice of the European Union. International controversies have involved transfer mechanisms scrutinised after rulings like Schrems II.

Impact and Criticism

The regulation has influenced privacy laws globally, inspiring reforms in jurisdictions including the California legislature with the California Consumer Privacy Act, legislators in Brazil with the Lei Geral de Proteção de Dados, and policymakers in Australia and South Africa. It has driven investment in privacy engineering by vendors such as Cisco Systems and Symantec and adoption of practices recommended by standards bodies like the International Organization for Standardization and European Telecommunications Standards Institute. Criticism includes concerns from trade associations like the Computer & Communications Industry Association and industry groups representing Small and Medium-sized Enterprises about compliance costs, tension with law enforcement requests from agencies such as Europol and national police forces, and debates over impacts on research institutions like CERN and media organisations including BBC. Legal scholars and NGOs including Electronic Frontier Foundation and Privacy International debate balances between individual rights and innovation, coordination challenges among national authorities, and clarity on concepts such as legitimate interests and automated decision-making.

Category:European Union law