5 Things on GDPR Compliance in North America

The General Data Protection Regulation (GDPR) came into effect throughout the European Union (EU) on May 25, 2018. GDPR replaces all data protection laws across Europe. The regulation applies to all profit and non-profit businesses that capture and process data of employees or customers in the EU or EU citizens that fall within the scope of its business.

Put in another way, GDPR applies to all companies that do business with data collected from the citizens of the EU. This is true even if the data obtained undergoes processing outside the EU.

GDPR compliance affects Latin America companies too. Learn specific regulations in each country and make sure your organization complies with the new regulation. Check out our blog post.

The regulation sets out the ground rules for data gathering, data management and the individual rights that apply to the collection of personal information. Data collected cannot be transferred to companies outside the EU without assuring the same protections.

The regulation contains penalties for violations of GDPR, some of which are revenue-based. That underscores how important compliance with GDPR is for banks, financial institutions, and insurers in North America who gather personal data during the regular course of their business with EU citizens. GDPR also applies to human resource records and IP addresses.

The Right to be Forgotten and Portability

For some time now, the EU has been building on the rights of individuals with respect to the data collected on them, including the right to be forgotten as well as the right to portability. The aim is to push companies to minimize the amount of data they manage during the regular course of business, to limit the captured data to only the information they actually need for the business transaction.

Experts anticipate that GDPR will have a significant impact on consumer profiling, the practice where companies accumulate as much big data as possible on customers to develop insights into their financial decisions. GDPR prevents companies from using personal data in a discriminatory manner or to cause individual financial harm.

Expected Challenges

As with any new regulatory compliance issue, there may be additional costs entailed, such as investment in new technology and employee training on data collection/protection issues. North American countries doing business with EU citizens will have to add a new position, too: the Data Protection Officer who will need to know and comply with the EU standard of data protection wherever and whenever EU data transfers to the company.

Penalties for Violation of GDPR

GDPR contains a two-tiered penalty system. Failure to comply with the regulation may result in fines up to $22 million or 4% of the previous financial year’s global revenue, whichever is larger. Experts estimate that businesses will face an average of $3.6 million in damages from a breach. Failure to notify of a breach results in an $11 million fine or 2% of global revenue, whichever is greater.

Steps to Prepare

• Make the C-Suite aware of the new regulation and the potential impact on the bottom line for breaches of the new rules.
• Hire or assign a Data Protection Officer (DPO) who will report directly to the Board and advise the Board of GDPR compliance issues.
• The DPO will also train staff in the issues of data protection, conduct compliance audits, and function as the company’s contact person for regulatory matters and reporting of data breaches. Most companies will need to hire such a new person with the requisite skills and experience to carry out these duties.
• Every company subject to the GDPR should review their data collection and protection policies to ensure they comply with GDPR’s rules for individual rights, meet special rules applicable to children, update consent forms, respond timely to access requests and update the company policy to adhere to rules regarding communication of private information.

For further information on GDPR, read Business.Com‘s article (modified March 2018) entitled “For U.S. Businesses, GDPR Takes Effect Next Year. Here are 9 Requirements You’ll Need to Meet” which served as an inspiration for this post.

GDPR compliance affects Latin America companies too. Learn specific regulations in each country and make sure your organization complies with the new regulation. Check out our blog post.