Andrew Lacey
Managing Principal
The European Union (EU) has introduced the General Data Protection Regulation (GDPR). The GDPR introduces a new set of rules around data processing and privacy. The rules are fairly prescriptive, and apply broadly to businesses around the world, including many Australian businesses.
The European Union has introduced new data protection laws that apply broadly to businesses around the world, including many Australian businesses.
25 May 2018. There is no transition period, full compliance is expected from 25 May 2018.
The GDPR has broad extraterritorial application and governs the activities of not only organisations based in the EU, but also of many Australian organisations that are not located in the EU. Importantly, there is no annual turnover threshold for the GDPR to apply; even sole traders and small businesses are caught by the new laws.
To determine whether the GDPR applies to your organisation, ask the following questions:
OR
OR
If you answered yes to any of the above questions, the GDPR applies to you.
The GDPR definition of personal information covers any information that can identify a natural person, directly or indirectly, including things like location data, online identifiers, and IP addresses.
The fines for non-compliance are large. Your organisation could face eye-watering administrative fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of your business for the preceding financial year, whichever is greater.
Maximum penalties can be issued for any of the following behaviours:
At a minimum, you should:
Failure to meet the GDPR’s new obligations will have severe ramifications. If your organisation is likely to be affected by the GDPR, we recommend you contact our privacy expert, Jimmy Gill, who heads our IP and Technology Group, as soon as possible to discuss next steps.