{"id":12368,"date":"2019-05-05T20:59:41","date_gmt":"2019-05-06T01:59:41","guid":{"rendered":"http:\/\/sites.law.duq.edu\/juris\/?p=12368"},"modified":"2019-05-05T21:00:29","modified_gmt":"2019-05-06T02:00:29","slug":"eus-gdpr-places-a-global-check-on-data-collection-practices","status":"publish","type":"post","link":"https:\/\/sites.law.duq.edu\/juris\/2019\/05\/05\/eus-gdpr-places-a-global-check-on-data-collection-practices\/","title":{"rendered":"EU\u2019s GDPR Places a Global Check on Data Collection Practices"},"content":{"rendered":"
\"\"
Image Credit: Pixabay.com<\/em><\/figcaption><\/figure>\n

By Natalia Holliday, Editor-in-Chief<\/strong><\/p>\n

The digital age brought the digitization of just about every aspect of our lives into data points, to be analyzed and used by businesses, researchers, and the government to further their respective causes. Our \u201cdigital fingerprints\u201d allow entities to predict our behaviors en masse<\/em> and target us online in ways to optimize beneficial outcomes to those entities. Certainly, this data can be used for respectable purposes \u2013 to improve customer relationships, optimize customer experiences, and create extraordinary convenience \u2013 but with this new online platform comes incredible vulnerability and opportunity for abuse.<\/p>\n

Between 2005 and 2018, the United States saw 9,700 data breaches resulting in the exposure of 1,537,040,000 records.[1]<\/sup><\/a> Among the different types of data breach incidents that exist,[2]<\/sup><\/a> identity theft is the most common worldwide.[3]<\/sup><\/a> These breaches are sometimes monumental in scale. For instance, every single Yahoo account that existed in August of 2013 \u2013 all 3 billion<\/em> of them \u2013 fell victim to a breach of names, email addresses, and passwords.[4]<\/sup><\/a> In 2011, an \u201c\u2018illegal and unauthorized\u2019\u201d person stole the names, home and email addresses, birth dates, passwords and usernames of 77 million Sony PlayStation Network users,[5]<\/sup><\/a> prompting Sony to pull the PlayStation Network offline for nearly one month.[6]<\/sup><\/a> The Facebook\/Cambridge Analytica data harvesting scandal showed the world how this extraordinary commodity can even affect the roots of America\u2019s democracy.[7]<\/sup><\/a><\/p>\n

In the wake of seemingly endless stories about misuse and breaches of data, the European Union drafted what would become the General Data Protection Regulation (\u201cGDPR\u201d). The GDPR is a comprehensive regulation designed to \u201charmonize data privacy laws across Europe, protect and empower all EU citizens\u2019 data privacy, [and] reshape the way organizations across the region approach data privacy.\u201d[8]<\/sup><\/a> For organizations controlling and processing personally identifiable information (PII) of so-called \u201cdata subjects\u201d (\u201can identified or identifiable natural person\u201d[9]<\/sup><\/a>), the GDPR imposes strict rules on such processing.[10]<\/sup><\/a><\/p>\n

As a default, processing the personal data of a natural person is illegal unless<\/em> a legal basis applies.[11]<\/sup><\/a> The seven legal bases are: consent, contract, legal obligations, vital interests of the data subject, public interest, and legitimate interests as stated in a related article of the GDPR.[12]<\/sup><\/a><\/p>\n

Additionally, the regulation emphasizes certain \u201cprinciples of data processing\u201d that are meant to guide organizations in proper data processing under the GDPR. The \u201clawfulness, fairness and transparency\u201d principle dictates that \u201cany information and communication relating to the processing [of personal] data be easily accessible and easy to understand, and that clear and plain language<\/em> be used.\u201d[13]<\/sup><\/a> The \u201cdata minimization\u201d and \u201cpurpose limitation\u201d principles work together to limit what data is actually processed as well as the purposes of the processing.[14]<\/sup><\/a> Other principles include accuracy, storage limitation, integrity and confidentiality, and accountability.[15]<\/sup><\/a><\/p>\n

One of the most profound provisions of the regulation is the applicable territorial scope. The GDPR is said to give control back to EU residents[16]<\/sup><\/a> by protecting \u201cfundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.\u201d[17]<\/sup><\/a> To give this \u201ccontrol\u201d to EU residents, the regulation attaches to the processing of an EU resident\u2019s personal data, no matter the location of the resident, the processing company, or the processing itself<\/em>.[18]<\/sup><\/a><\/p>\n

To illustrate, say an EU resident decides to visit sunny Pensacola, Florida for vacation. She finds a great rate at the Courtyard by Marriott, a company headquartered in Bethesda, Maryland.[19]<\/sup><\/a> She books the deal online and enjoys a delightful vacation. Any data Marriott collects in relation to the transaction with the EU resident is subject to the GDPR\u2019s rules, despite the fact that Marriott is headquartered in the United States. Why? Because the GDPR protects EU residents, regardless of location<\/em>.[20]<\/sup><\/a><\/p>\n

When you consider what a company must do to comply with the GDPR, as well as the penalties for failing to comply, the consequences of this extraterritorial scope hit like a tsunami. Among the many obligations of companies under the regulation, some of the major ones include:<\/p>\n