Europe has new data protection legislation - General Data Protection Regulation adopted

After more than four years of negotiations, the European Parliament finally adopted the General Data Protection Regulation (GDPR) on 14 April 2016. We have already reported on the most important aspects of its content in our Update Data Protection No. 5. Here once again is a summary of some of the main innovations:

• A single supervisory authority for companies operating internationally ("one-stop shop")  
• Changes concerning permissions for the use of personal data - in particular many special permissions under German data protection law no longer apply
• The written form is no longer required for consent; however, there are stricter requirements on the necessary voluntary nature and on the age of the consenting persons
• Changes concerning order data processing  
• Extended reporting obligations for violations of data protection  
• Europe-wide obligation to appoint a data protection officer  
• Significantly increased fines framework of up to 20 million euros or 4% of annual global turnover    

With the introduction of the GDPR, the European Union now no longer has just harmonised but rather uniform data protection legislation. Over the coming weeks and months we will report in detail on the main innovations resulting from the GDPR.

The newly-adopted GDPR will take effect 20 days following its publication in the Official Journal of the EU, and will become directly applicable to all companies two years later - i.e. foreseeably in May 2018. Many companies will be obliged to adapt things such as marketing measures, Internet presence, customer databases and data-intensive processes to the new rulings. It is worthwhile planning time windows for the necessary implementation steps now, so that high data protection compliance can be achieved in all critical areas by May 2018.