GDPR: What do you need to know?

What is GDPR?

Europe’s General Data Protection Regulation (GDPR) is a new law on data privacy, designed to protect people’s rights and their personal information. For the first time ever, individuals can demand that a company reveals or deletes the personal data they hold, while regulators will be able to work together across the European Union. The maximum fine will now reach either €20 million or 4 per cent of the company’s global turnover, whichever is higher.

When does it come in to effect?

Tomorrow.

Who does it affect?

The law will cover people or companies either in the European Union, or offering a service to persons in the EU, or monitoring the behaviour of persons in the EU. While this will encompass firms in every sector, experts say that technology firms, marketers, and the data brokers who connect them will be hardest hit.

What does GDPR mean for me?

You have the right to be forgotten, meaning you can demand the deletion of your name from websites, and you can also revoke your consent for data to be used by marketing firms and tech companies.

Why am I getting so many emails from companies suddenly?

Some companies have decided they need your explicit consent under GDPR to continue holding on to and using your personal data. Others, however, believe they have a “legitimate interest” in keeping your data, and will be notifying of the changes to their terms and conditions.

If this is a European law, why does it matter here in the UAE?

There are many companies in the UAE who operate in Europe, have European customers, or advertise online to Europeans, all of which would entail processing the data of people in Europe.

So UAE firms could be liable to fines if they don’t comply?

In theory, yes.

How will that be enforceable?

It is unclear if those fines would be enforceable in the UAE, but any UAE company looking to do business (or already doing business) in the EU could be sanctioned in the European jurisdiction.

Will it work?

That remains to be seen, though experts have praised the EU’s insistence that firms follow in the spirit of the law, as opposed to doing the bare minimum to be compliant. This means, for example, not bamboozling customers with densely-written terms and agreements but being more upfront about what they are requesting your consent for.

What happens next?

Most likely a wave of legal challenges from individuals and companies alike, as the ambiguities are hammered out in the courts.