How Europe’s GDPR will affect Australian organisations
In May 2018, the General Data Protection Regulation (GDPR) will come into play, requiring organisations around the world that hold data belonging to individuals from within the European Union (EU) to provide a high level of protection and explicitly know where every ounce of data is stored.
Organisations that fail to comply with the regulation requirements could be slapped with administrative fines up to €20 million, or in the case of an undertaking, up to 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher.
The laws do not stop at European boundaries, however, with those in the rest of the world, including Australia, bound by the GDPR requirements if they have an establishment in the EU, if they offer goods and services in the EU, or if they monitor the behaviour of individuals in the EU.
The GDPR and the Australian Privacy Act 1988 share many common requirements, including to implement a privacy-by-design approach to compliance; to be able to demonstrate compliance with privacy principles and obligations; and to adopt transparent information handling practices.
There are a bunch of differences, too, with the appointment of a data protection officer to each organisation one significant requirement under the GDPR.
Speaking at the Data + Privacy Asia Pacific conference in Sydney on Wednesday, Australia’s Privacy and Information Commissioner Timothy Pilgrim explained that although Australian law doesn’t mandate having a data protection officer inside an organisation, the GDPR does, so organisations trading in the EU need to ensure they have an individual charged with the responsibility.
“These are key issues that you need to start thinking about if you are dealing or trading in Europe,” Pilgrim said.
He also recommends Australian organisations use the opportunity to ensure they are compliant with their requirements under the Privacy Act, such as having good governance in place and undertaking privacy impact assessments.
“There are a lot more similarities than difference and that’s what we need to draw on,” he said.
The GDPR is a somewhat consent-based law, with Article 17 of the regulation titled the Right to Erasure — the right for an individual to be “forgotten” by an organisation that holds their data.
“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay,” the GDPR states.
It also states that an individual can correct any misinformation held on them.
Under Australian law, Pilgrim explained that an organisation doesn’t even require specific consent for the general collection of personal information unless it is collecting sensitive information, let alone the mandate to erase the trace of an individual.
Under the GDPR, individuals are protected against being subject to determinations based on automated systems without human intervention. As such, practices employed by organisations similar to what the Australian Department of Human Services had adopted with its Centrelink automated debt recovery project may find themselves in deep water.
Simon Entwisle, Deputy Commissioner of Operations for the United Kingdom’s Information Commissioner’s Office (ICO), clarified the GDPR also covers an outsider who is in Europe.
“Anyone in Europe is covered and it’s not just citizens either …
