GDPR Will Impact Data Management In The USA

With Europe’s General Data Protection Regulation set to take effect on May 25, 2018, IT and data management leaders across the world, including those in the United States, should be preparing for the new requirements affecting organisations inside and outside of Europe.

You don’t have to have physical operations in Europe to be affected by the GDPR, and failure to prepare can have severe ramifications, including crippling fines.

Directives, Regulations, and Federalism
Data protection laws in Europe have had variances, as well. The difference between a directive and a regulation is important.
Under what is known commonly at the 1995 Directive, officially, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, European data protection law is somewhat like the federalism of US law.

In the US, one has 50 states, a federal district, and various territories making laws. At the same time, the EU—at least for the moment—has 28 member states, and a total of 31 nations comprise the European Economic Area (EEA). They make different laws that sometimes contradict each other. The 1995 Directive, which took effect in 1998, provides guidance, but Europeans sought a regulation that would harmonize European data protection laws.

Enter the General Data Protection Regulation (GDPR), which will become effective May 25, 2018. In this article, I’ll examine the rationale behind the new regulation, analyze the provisions of the GDPR, and let you know how you can prepare for next May.

Data Law Harmony in Europe
As an initial matter, I should note that—although many observers say simply the EU GDPR—the new regulation actually affects more than merely the EU.

First, the regulation itself is not merely for the 28 member states of the European Union. It is for the 31 member states of the European Economic Area (EEA), which includes the 28 EU member states plus Iceland, Norway, and Lichtenstein. The GDPR is being integrated into the 1992 EEA Agreement.

Second, if you’re sitting in Des Moines, thinking, “I don’t care what the Europeans do, I’m in Iowa,” you probably should care because the GDPR affects not only EEA nations, but any organization offering goods or services to European data subjects or organizations controlling, processing, or holding personal data of European nationals—regardless of the organization’s location. Yes, Des Moines, that means you, too.

At first glance, one would think the GDPR is good for cross-border business and for e-discovery with Europe. After all, with data protection laws and regulations harmonised among the 31 EEA nations, things should be easier, right? The problem is that some of the new provisions make European data protection law even more different from US law, a big challenge for international business and litigation.

What’s Changing?
To put the provisions of the GDPR in context, I should note the United States and Europe have very different views of data privacy. In the US, we tend to put greater value on free speech, and the right to evidence in litigation, than we do for data privacy. In fact, contrary to what many Americans think, there is no specific right to privacy in the US Constitution.

American courts have interpreted certain privacy rights from amendments to the Constitution, including the first 10 amendments, known commonly as the Bill of Rights. However, the original document is silent on the issue of privacy, and it wasn’t until 1965 that the US Supreme Court articulated an individual right to privacy when it overturned a state law on contraceptives in Griswold v. Connecticut.

Contrast that with Europe. From the beginning of Europe to the tragic history of World War II, privacy has come to carry greater importance there.