EU GENERAL DATA PROTECTION REGULATION (GDPR) COMING ON MAY 25TH
April 2, 2018
The EU’s General Data Protection Regulation (GDPR), to be implemented on May 25th, 2018, will have a significant impact on the aviation industry. The regulation institutes a broad range of recordkeeping, reporting, consent and related data privacy requirements as well as various legal mechanisms for noncompliance, including penalties.
GDPR not only will apply to companies located or conducting business within the EU, but also to organizations located outside of the EU if they offer goods or services to EU citizens. Further, GDPR will apply to all companies processing and/or holding the personal data of “Data Subjects” residing in the European Union, regardless of the company’s location. Any information related to a Data Subject which can be used to directly or indirectly identify that person constitutes personal data under GDPR. Examples of personal data for purposes of GDPR include: a name, a photo, an email address, bank details, social media content, a computer IP address, and website tracking cookies, among others.
GDPR’s penalties are far more significant than current data protection regimes. Under the new regulation, companies can be fined up to 4% of their annual turnover or €20 million for violations, whichever is greater. GDPR has several requirements which could expose companies to the above fines for noncompliance, including a 72-hour deadline to report data breaches, a right of EU citizens to request data deletion, various data recordkeeping requirements, and appointment of company data protection officers in certain cases, among others.
There are several steps that companies in the aviation sector must already have taken to prepare for GDPR’s arrival, including beginning to establish the necessary recordkeeping regimes, data consent processes, and reporting protocols, among others. Below are steps that should be taken before May 25:
- Update your public-facing privacy policy to reflect GDPR’s requirements;
- Identify the personal data of EU citizens in your possession, where you have it, how it is protected, and how to access it. If you use a customer relationship management application (CRM), determine if it contains hidden personal data through data analytics;
- Establish data privacy protection policies and document how you follow them;
- If you have a website that collects data analytics, sells to EU citizens or EU companies or collects demographic data on EU citizens for any purpose, hire a data protection officer (DPO), as mandated by GDPR;
- Convert your data collection processes to require explicit opting-in by individuals. For example, a customer’s consent by clicking to accept a lengthy, unrelated Terms of Service document is not sufficient under GDPR;
- Delete personal data of EU citizens which you do not need. EU citizens have a legal right under GDPR to ask you to produce any data you have on the individual and for you to delete such data at their request. If you do have data on an EU citizen, it is possible you will be required to request permission from the individual for you to keep the data.
In order to ensure compliance as of GDPR’s effective date of May 25, 2018, companies must be able to demonstrate the steps they have already taken to meet the regulation’s compliance objectives. If you have any questions regarding GDPR compliance, please contact us.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com, 202-659-6622) or Drew Derco (dderco@eckertseamans.com, 202-659-6665).
Share This Post
Authors
