EU General Data Protection Regulation comes into effect
> June 2016
The EU General Data Protection Regulation (GDPR) came into effect on 25.5.2016 after publication in the Official Journal of the European Union on 4.5.2016. The new law will enter effect 24 months later. i.e. on 25.5.2018.
The purpose of the act is to standardise data protection within the European Union. In contrast to the EU Data Protection Directive (95/46/EC), which was superseded by the GDPR, the latter will have a direct impact on legislation in the member states of the EU. All national legislators are now required to review their internal data protection regulations and either amend or repeal them. Even though several paragraphs of the GDPR are based on German law, the GDPR will also lead to changes in Germany. Companies should therefore start preparing for the new data protection legislation and adjust their data processing processes and internal organisational structures.
The GDPR will impose much heavier fines than Germany's current Data Protection Act (BDSG). The maximum possible fine of €300,000 under the BDSG has rarely been enforced. Under the GDPR, penalties of up to 20 million Euros or 4% of the overall annual revenue of a group can be imposed from summer 2018 onwards. The GDPR even states that fines should be "deterrent". It is to be expected that the increased number of spot checks performed by companies and on-site checks by the relevant regulatory authorities will lead to much more importance being attached to data protection than previously. The GDPR also strengthens the rights of consumers, which will lead to the regulatory authorities receiving an increased number of complaints.
The data protection authorities have already increased pressure on companies in this area. The Bavarian State Data Protection Authority, for example, selected companies at random and used a questionnaire to review how they implement important data protection requirements, e.g. designation of data protection officers, directories of procedures, order data processing rules, security scheme etc. The statistics for the review performed in the first half of 2016 are available here.
These changes will therefore require companies to take significant action. We expect the regulations for data protection officers in the current Data Protection Act to be retained in German legislation. Companies in Germany are required to appoint a data protection officer if they have ten or more employees working with personal information (i.e. those which have access to a PC, for example). In order to prepare for the GDPR, companies should therefore review whether they will be obliged to appoint a data protection officer. The company's data processing processes should then be documented before introducing data protection plans and guidelines, in consultation with the data protection officer if relevant. Particular attention should be paid to the security of information when processing data. The possibility of obtaining certification should also be considered. > EU General Data Protection Regulation
> Infobroschüre der Bundesbeauftragten für Datenschutz und die Informationsfreiheit zur DSGVO (German)
