And for lawyers, the GDPR\u2019s gestation period has amounted to a cash bonanza. Legal professionals refer to the 88-page law<\/a> as the \u201cgift that keeps on giving\u201d due to the rich stream of billable hours and contractual work that come with it.<\/p>\n But despite its global consequences, few people outside the public policy sphere know what the GDPR is really about, and how it will impact their companies and lives.<\/p>\n POLITICO is here to help.<\/p>\n Here\u2019s a guide to the law, breaking down \u201cwhat it says\u201d and \u201cwhat it means.\u201d<\/p>\n What the text says:<\/em> Officially called \u201cthe right to erasure,\u201d the GDPR says \u201cthe data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.\u201d (Article 17<\/a>)<\/p>\n What it means:<\/em> Those embarrassing pictures from years ago could finally disappear. Europeans can ask companies to tell them everything they know about them, and delete it all. Businesses will have to set up their datasets in ways that they can trace and delete all the data they have on someone \u2014 a challenging engineering task for some.<\/p>\n The right to be forgotten is not entirely new. It goes back to a 2014 lawsuit in Spain<\/a> by someone who complained that Google\u2019s search engine linked his name to an incident dating back to 1998. While the court case concerned search results, EU lawmakers took the concept to another level by imposing a \u201cright to erasure\u201d across the bloc.<\/p>\n The extent to which Europeans can take this is still being litigated. Two cases against Google<\/a> are to be heard before the EU\u2019s highest court later this year. One involves the right to have information about past criminality and political affiliations removed. The other concerns whether such information should remain accessible outside of the EU.<\/p>\n What it says:<\/em> A company or authority \u201cshall be able to demonstrate that the data subject has consented to processing of his or her personal data\u201d and the consent has to be \u201cfreely given\u201d and asked in an \u201cintelligible and easily accessible form, using clear and plain language.\u201d<\/p>\n What it means:<\/em> Websites have been serving internet users with annoying pop-ups<\/a> asking if they agree to the terms and conditions. Clicking \u201cI have read [these] and agree\u201d has been dubbed \u201cthe biggest lie on the internet\u201d by academics<\/a>.<\/p>\n Under GDPR, internet service providers will have to try harder. Users will have to understand what they\u2019re signing up to, including if companies such as Facebook and Google use their data to target ads or sell it to others.<\/p>\n The question is what is meaningful, \u201cfreely given\u201d consent. Some startups have even specialized in designing new ways to catch people\u2019s attention.<\/p>\n What it says:<\/em> A company suffering a hack or breach of its data \u201cshall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority\u201d and \u201cshall communicate the personal data breach to the data subject [the user or customer] without undue delay.\u201d (Articles 33 and 34)<\/p>\n What it means:<\/em> There\u2019s a running joke in privacy circles that there are two types of people: Those that know they have been hacked, and those that don\u2019t yet know they have been hacked. You can check which group you belong to in the online database called Have I Been Pwned?<\/a><\/p>\n Since the regulation was adopted, the world has learned of a Yahoo data breach that affected 3 billion users, an Uber data breach that affected 57 million users, an Equifax breach that hit more than 143 million people (mostly in the U.S.) \u2014 and many more<\/a>.<\/p>\n Lawmakers figured out a framework to put responsibility with companies for holding data and protecting it from falling into the wrong hands. Most of all, companies will have to set up a crisis management process for when an intruder manages to snatch the personal data they hold \u2014 and they\u2019ll have to be open and transparent with authorities and customers about what happened.<\/p>\n One thing privacy lawyers agree on: Don\u2019t follow Uber\u2019s example<\/a>. The company hid its data breach from the public eye for over a year and paid hackers to keep it quiet.<\/p>\n What it says:<\/em> Each EU country \u201cshall provide for one or more independent public authorities to be responsible for monitoring the application\u201d of the GDPR. It comes with the power to conduct investigations, ask companies to \u201cprovide any information it requires\u201d and fine them. (Chapter VI)<\/p>\n What it means:<\/em> Europe\u2019s privacy watchdogs will bite. The so-called European data protection authorities have gained prominence as they launched probes into data breaches at Yahoo and Uber or challenged WhatsApp\u2019s data sharing with its parent company Facebook.<\/p>\n These authorities, long-time obscure organizations dealing with citizens\u2019 complaints, are getting more powers and more resources to go after big companies that venture into big data analytics. Many, however, are still growing into their new role<\/a>.<\/p>\n European authorities have investigated tech firms like Facebook | Carl Court\/Getty Images<\/p>\n What it says:<\/em> \u201cThe European Data Protection Board (the \u2018Board\u2019) \u2026 shall ensure the consistent application of this Regulation.\u201d (Articles 68 to 76)<\/p>\n What it means:<\/em> A new European super-watchdog is taking shape called the European Data Protection Board. The Board will be officially established when GDPR kicks in in May and include representatives of the national data protection authorities \u2014 much like the current Article 29 Working Party<\/a>, but with a lot more teeth.<\/p>\n The chair of the Board will have one of the highest-profile jobs in European privacy, acting as the voice and face of data protection authorities as they challenge tech giants.<\/p>\n What it says:<\/em> Certain \u201cinfringements [shall] be subject to administrative fines up to \u20ac20,000,000, or in the case of an undertaking, up to 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher.\u201d These fines would be \u201ceffective, proportionate and dissuasive.\u201d (Article 83)<\/p>\n What it means:<\/em> Regulators will hold a stick that\u2019s worth millions, in some cases billions, of euros.<\/p>\n The European Commission previously ordered Ireland to claw back \u20ac13 billion from Apple<\/a> for illegal state aid, and Google got slapped with a \u20ac2.42 billion fine for unfair competition practices in its Google Shopping services. But for privacy regulators, fining companies into the billions is a brand new power. It\u2019s scaring many companies into complying with the GDPR.<\/p>\n What it says:<\/em> A company or organization gathering personal data has to ensure that, \u201cby default, only personal data which are necessary for each specific purpose of the processing are processed.\u201d (Article 25)<\/p>\n What it means:<\/em> Everyone from browser services like Mozilla Firefox and Google Chrome to fridgemakers and the \u201cinternet of things\u201d industry has to tweak its products to make sure the default setting doesn\u2019t hoover up more data than is needed, and protects personal data immediately. The rule has kickstarted a whole redesign effort by online service providers.<\/p>\n What it says:<\/em> Companies handling data that \u201crequire regular and systematic monitoring of data subjects on a large scale\u201d need to have a \u201cdata protection officer.\u201d (Articles 37, 38 and 39)<\/p>\n What it means:<\/em> Larger businesses need a point person to manage your personal data, a go-to person that knows the risks to working with data and has the ear of the executives in an organization.<\/p>\n What it says:<\/em> A user \u201cshall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects.\u201d (Article 22)<\/p>\n What it means:<\/em> Having computers make important life decisions, like whether you can get insurance or how quickly a doctor should treat your illness, is not always a good idea, EU lawmakers think.<\/p>\n Companies and authorities using algorithms to speed up or decrease the workload will have to either ask for users\u2019 explicit consent (see above) or double-check a decision made by an algorithm if the user asks why he was treated in a certain way.<\/p>\n In short: It\u2019s not enough to say \u201cComputer says no.<\/a>\u201d<\/p>\n Original Article<\/a><\/p>\n [contf] The European Union is about to roll out the most far-reaching overhaul of data protection rules in a..<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[],"class_list":["post-68896","post","type-post","status-publish","format-standard","hentry","category-health"],"yoast_head":"\nRight to be forgotten<\/strong><\/h3>\n
Consent<\/strong><\/h3>\n
Data breach notification<\/strong><\/h3>\n
Data protection authorities<\/strong><\/h3>\n
![](\"https:\/\/www.politico.eu\/wp-content\/uploads\/2017\/03\/GettyImages-586113558-2-714x476.jpg\"\/)
<\/p>\nThe Board<\/strong><\/h3>\n
4 percent fines<\/strong><\/h3>\n
Privacy by design<\/strong><\/h3>\n
Data protection officer<\/strong><\/h3>\n
Profiling<\/strong><\/h3>\n
\n[contfnew]
\n <\/p>\n
<\/a><\/h5>\n","protected":false},"excerpt":{"rendered":"